---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Exploring ZTA

# Exploring Zero Trust Access {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 Minuten Lesedauer

Zero Trust Access (ZTA) is a security model that assumes that no user or device is trusted by default.

ZTA ensures that all access to applications and data is granted on a least privilege basis, only after the user's identity verification and risk assessment.

## Zero Trust - Policy Based Session Access {#explore-zero-trust-access__section_g3z_1cs_zxb}

ServiceNow Zero Trust - Policy Based Session Access (Session Access) enables organizations to dynamically reduce user privilege in a web session based on a variety of factors, including IP address, location,
authentication method, user's role, group, user having MFA and attributes shared by the Identity Provider (IDP). This can help protect organizations from unauthorized access and data breaches, even when high-privileged users access
applications from untrusted devices or locations.

It enables the security admins to reduce or limit user access in a session based on IP address, location, Identity Provider attributes, and user attributes using adaptive authentication policies.  
Hinweis:  
* Session Access configurations can only be performed with <kbd class="ph userinput">security_admin</kbd> role. You must elevate your role to <kbd class="ph userinput">security_admin</kbd>.
* Session Access doesn't support integrations.
* Session Access has no impact if the reduced or limited role isn't assigned to a user. In this case, there are no changes to the logged in session. The user continues to access the instance with the assigned privileges.
* Session Access has no impact while the user is already logged in to the instance and simultaneously the admin configures the policy. The user has to log out from the session for the policy to be effective.
* Session Access has no impact when the user is in a trusted network and later switches to a VPN (change in location or network) within a session.
* Session Access is enforced at the time of login. Any change in risk parameters during the session won't result in reduced access. For example, a user switching from the corporate network to an untrusted network after establishing the session won't result in reduced access unless the user logs out and logs in again.
* Session Access (Zero trust access - ZTA) feature, roles like <kbd class="ph userinput">snc_internal</kbd> and <kbd class="ph userinput">snc_external</kbd> cannot be removed.
* Session Access (Zero trust access - ZTA) feature does not remove a role from the <kbd class="ph userinput">sys_user_has_role</kbd> or the user group membership table. Based on the ZTA policy, it establishes the user session with reduced or limited roles.
* The scripts running in the system context will not honor the ZTA session roles.
{#explore-zero-trust-access__ul_kcm_4vj_qxb}

## Use case {#explore-zero-trust-access__section_nbs_3q2_twb}

Following are some of the use cases of Zero Trust Access:

* Reduce privileges based on the risk associated with the session. For example, a fulfiller role user logging from outside the trusted network can be configured to have only the requester role for the session.
* Reduce access based on IDP response for a user session, if the user is using an untrusted device. For more information, see [Configure Identity Provider attribute for Session Access](https://servicenow-prod.fluidtopics.net/FX_Z0PEk1bTaOb4y2h~tiw "Use Identity Provider (IDP) attribute created from the Security Assertion Markup Language (SAML) response and OpenID Connect (OIDC) for removing or restricting user session access to the instance.").

{#explore-zero-trust-access__ul_mmn_pq2_twb}

This role relegation ensures that the user doesn't have any other existing privileges in a session. When the user is logging in from a trusted network, all the existing privileges are assigned for a session.

Multiple IP conditions and multiple role or group assignments can be defined as part of the policy.

## Zero Trust Access - Mobile {#explore-zero-trust-access__section_v5q_dzv_3zb}

You can use the Zero Trust Access - Session Access policy within the Adaptive Authentication policy to reduce the roles or privileges of the particular session in mobile.

Zero Trust Access - Session Access mobile can be enabled by enabling the glide.authenticate.session_access.mobile.enabled from the system properties table.

To use Zero Trust Access - Session Access mobile with the IDP attributes you can configure the glide.authenticate.session_access.mobile.refresh_token_interval field. This enables the administrators to
effectively control the session access based on refresh token.

For more information, see [Configure Zero Trust Access for mobile](https://www.servicenow.com/docs/access?context=configure-zero-trust-access-mobile&version=australia&pubname=australia-mobile&ft:locale=en-US).