---
sourceDocument: Australia ServiceNow AI Platform Capabilities
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/servicenow-platform

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# MID Server Azure Key Vault integration

# MID Server Azure Key Vault integration {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 Minuten Lesedauer

The MID Server integration with the Azure Key vault enables Orchestration, Discovery,
and Service Mapping to run without storing any credentials on the instance.

## Vorbereitungen

To install the required application on the instance, navigate to Plugin ManagerExternal Credential Storage and Management.

|-|
|   |
[ ]

{#mid_azure_key_vault_integration__table_m2t_cv4_nhb}

Role required: External Credential Storage and Management application Scope ID is required: com.sn_mid_extcredstrg

## Warum und wann dieser Vorgang ausgeführt wird

When setting up access to the Azure Key Vault, the MID Server is either within the
Azure environment or it is on an external virtual machine. This procedure covers
setting up the Azure Key Vault for a MID Server within the Azure environment.

For more information about specific Azure and Azure Key Vault procedures, see the
[Azure Key Vault documentation](https://learn.microsoft.com/en-us/azure/key-vault/).

## Prozedur

1. Within the Azure cloud environment, create a virtual machine.
2. Navigate to the Identity section of that virtual machine.
3. Enable system assigned identity.  
   Once it is enabled, you have the option to assign a role for that identity.
4. Navigate to the Add role assignment menu.
5. Set the scope to your Subscription.
6. Add the Key Vault administrator role.
7. Set the resource to the key vault that you want to integrate with the MID Server.
**Zugehörige Konzepte**   

* [MID Server certificate check policies](https://servicenow-prod.fluidtopics.net/VBqU5CHqCSU2m2xJd2a6uA "MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.")
* [MID Server authentication credentials and SOAP requests](https://servicenow-prod.fluidtopics.net/80f2cul5Bjz0opflAxzxPg#mid-authentication-soap-requests "Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.")
* [MID Server unified key store](https://servicenow-prod.fluidtopics.net/zWbtuI59iqjA5LfLDw8VPA#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.")
* [MID Server command audit log](https://servicenow-prod.fluidtopics.net/hMnNVhNJPmpY4gLr76lWAg "The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to check for anomalies or errors.")
* [MID Server FIPS Enforced Mode](https://servicenow-prod.fluidtopics.net/dqBc9MICWmUraTd809_RJw#mid-fips-enforced "The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.")
* [MID Server Governance](https://servicenow-prod.fluidtopics.net/aFXIuu3zlxcmFMjRZPM1Ug "Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.")  
**Zugehörige Tasks**   

* [Encrypt or decrypt MID Server configuration file values](https://servicenow-prod.fluidtopics.net/iCgc9bn4JQYK9vgd1wAC6w "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.")
* [Enable MID Server mutual authentication](https://servicenow-prod.fluidtopics.net/UdSuWRmz6ZGA~Y6dkWvyeQ "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.")
* [Rekey a MID Server](https://servicenow-prod.fluidtopics.net/pL97YclPNbf5hsjR6JhaEA "Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.")
* [Add SSL certificates for the MID Server](https://servicenow-prod.fluidtopics.net/Wze_LuvGY3XWJMv9a~ORjg#add-ssl-certificates "Configure the MID Server to connect to a source over SSL.")
* [Attach a script file to a file synchronized MID Server](https://servicenow-prod.fluidtopics.net/vu1Hjk_D3VmPooctXzxerQ#mid-server-script-attach "You can attach a script file to synchronize to a connected MID Server. Windows Internet Explorer enhanced security blocks downloaded files that it determines are potentially dangerous. However synchronizing the files avoids this security problem.")  
**Zugehörige Verweise**   

* [MID Server configuration file security](https://servicenow-prod.fluidtopics.net/pExtHd2xoAcm8Vh~FXV9oQ "Sensitive MID Server configuration data can be protected using several different schemes, including internal and external data encryption and external data storage.")
* [MID Server SSH cryptographic algorithms](https://servicenow-prod.fluidtopics.net/6XDl6hCCpG2wR7zHUqkWng "The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.")

## Azure Key Vault Integration for External Virtual Machine MID Servers {#ariaid-title2}

The MID Server integration with the Azure Key vault enables Orchestration, Discovery,
and Service Mapping to run without storing any credentials on the instance.

### Vorbereitungen

Role required: External Credential Storage and Management application (Scope ID:com.sn_mid_extcredstrg) is required.

### Warum und wann dieser Vorgang ausgeführt wird

When setting up access to the Azure Key Vault, the MID Server is either within the
Azure environment or it is on an external virtual machine. This procedure covers
setting up the Azure Key Vault for a MID Server that is on an external virtual
machine.

For more information about specific Azure and Azure Key Vault procedures, see the
[Azure Key Vault documentation](https://learn.microsoft.com/en-us/azure/key-vault/).

MID servers can use the Vault Credential Resolver to consume secrets directly from
Vault for the purpose of performing discovery. The External Credential Storage and
Management Application offers out-of-the-box integration to external credential
providers. MID Servers support certificate-based authentication when connecting to
Azure Key Vault. This provides a more secure and flexible way to authenticate,
especially for enterprise environments that prefer certificate credentials over
client secrets. For more information on managing certificates, see [MID Server unified key store](https://servicenow-prod.fluidtopics.net/zWbtuI59iqjA5LfLDw8VPA#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.").

### Prozedur

1. In the Azure portal, navigate to App registrations.
2. Create a new application for the MID Server.
3. Take a note of the tenant id and client id because these are used later.
4. Provide API Permission for Azure Key Vault to the application.
5. Navigate to Certificates and Secrets for the new application.
6. Generate a new client secret and take a note of that client secret.  
   At this point, you should have the client_id, tenant_id, and secret_key for the application registration.
7. Add the following parameters to the MID Server config.xml using the recorded values.  

       <parameter name="ext.cred.azure.vault_name" secure="false" value="<azure_key_vault_name>"/> (optional) 
       <parameter name="ext.cred.azure.tenant_id" secure="true" value="<tenant_id_value>"/> 
       <parameter name="ext.cred.azure.client_id" secure="true" value="<client_id_value>"/> 
       <parameter name="ext.cred.azure.secret_key" secure="true" value="<secret_key_value>"/> 

   {#mid_azure_key_vault_integration_external__codeblock_blw_tfx_dcc}

## Supported Credentials for Azure Key Vault Integration {#ariaid-title3}

The MID Server supports specified credentials for integration with the Azure Key
vault.

### List of Credentials {#mid_azure_key_vault_intergration_ref__section_emn_chx_dcc}

SNMPV3 Credentials
:

          {
            "type": "snmpv3",
            "user": "<user_value>",
            "authentication_key": "<authentication_key_value>",
            "privacy_protocol": "<privacy_protocol_value>",
            "privacy_key": "<privacy_key_value>",
            "authentication_protocol": "<authentication_protocol_value>",
            "snmp_context": "<snmp_context_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_jfj_1hx_dcc}

VMWare Credentials
:

          {
            "type": "vmware",
            "password": "<password_value>",
            "user": "<user_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_qjt_1hx_dcc}

SSH Credentials
:

          {
            "type": "ssh",
            "password": "<password_value>",
            "user": "<user_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_t25_1hx_dcc}

Windows Credentials
:

          {
            "type": "windows",
            "password": "<password_value>",
            "user": "<user_value>",
            "domain": "<domain_value>" // If it is null or empty, user name will become `.\user`
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_an5_1hx_dcc}

Azure Service Principal Credentials
:

          {
            "type": "azure",
            "client_id": "<client_id_value>",
            "tenant_id": "<tenant_id_value>",
            "secret_key": "<secret_key_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_s55_1hx_dcc}

SSH Private Key Credentials
:

          {
            "type": "ssh_private_key",
            "password": "<password_value>", // optional
            "user": "<user_value>",
            "ssh_certificate": "<ssh_certificate_value>",
            "ssh_private_key": "<ssh_private_key_value>",
            "ssh_passphrase": "<ssh_passphrase_value>" // optional
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_kcv_1hx_dcc}

AWS Credentials
:

          {
            "type": "aws",
            "access_key": "<access_key_value>",
            "secret_key": "<secret_key_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_r3v_1hx_dcc}

API Key Credentials
:

          {
            "type": "api_key",
            "api_key": "<api_key_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_s4v_1hx_dcc}

Applicative Credentials
:

          {
            "type": "<applcation_type>", // generated by JSON builder: TODO
            "password": "<password_value>",
            "user": "<user_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_uvv_1hx_dcc}

Azure Enterprise Agreement Credentials
:

          {
            "type": "ea_azure",
            "access_key": "<access_key_value>",
            "enrollment_number": "<enrollment_number>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_rb1_g3x_dcc}

Azure SAS Credentials
:

          {
            "type": "azure_sas",
            "sas_key": "<sas_key_value>",
            "sas_key_name": "<sas_key_name_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_cv1_g3x_dcc}

Basic Auth Credentials
:

          {
            "type": "basic_auth",
            "password": "<password_value>",
            "user": "<user_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_sy1_g3x_dcc}

CIM Credentials
:

          {
            "type": "cim",
            "password": "<password_value>",
            "user": "<user_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_lcb_g3x_dcc}

Cloud Foundry Credentials
:

          {
            "type": "sn_itom_pattern_pcf",
            "password": "<password_value>",
            "user": "<user_value>",
            "ssh_private_key": "<ssh_private_key_value>",
            "ssh_passphrase": "<ssh_passphrase_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_gj1_n3x_dcc}

Google API Credentials
:

          {
            "type": "gcp",
            "email": "<email_value>",
            "secret_key": "<secret_key_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_wy1_n3x_dcc}

SSL Keystore Credentials
:

          {
            "type": "keystore",
            "keystore_password": "<keystore_password_value>",
            "keystore_path": "<keystore_path_value>",
            "key_password": "<key_password_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_c3b_n3x_dcc}

JMS Credentials
:

          {
            "type": "jms",
            "password": "<password_value>",
            "user": "<user_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_qnb_n3x_dcc}

SNMP Community Credentials
:

          {
            "type": "snmp",
            "password": "<password_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_x5b_n3x_dcc}

SSL Credentials
:

          {
            "type": "keystore",
            "user": "<user_value>",
            "password": "<password_value>",
            "additional_properties": "<additional_properties_value>",
            "key_password": "<key_password_value>",
            "keystore": "<keystore_value>",
            "keystore_password": "<keystore_password_value>",
            "keystore_type": "<keystore_type_value>",
            "ssl_provider_name": "<ssl_provider_name_value>",
            "security_protocol": "<security_protocol_value>",
            "truststore": "<truststore_value>",
            "truststore_password": "<truststore_password_value>",
            "truststore_type": "<truststore_type_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_z1c_n3x_dcc}

IBM Credentials
:

          {
            "type": "ibm",
            "user": "<user_value>",
            "password": "<password_value>",
            "softlayer_user": "<softlayer_user_value>",
            "softlayer_key": "<softlayer_key_value>",
            "bluemix_key": "<bluemix_key_value>"
          }

    {#mid_azure_key_vault_intergration_ref__codeblock_ihc_n3x_dcc}
{#mid_azure_key_vault_intergration_ref__dl_c4m_zgx_dcc}

### Gov Cloud Support for Azure Key Vault Integration {#mid_azure_key_vault_intergration_ref__section_ujs_djx_dcc}

You may need to override authentication and the vault URL when operating in
government cloud environments. The following examples are for US government
clouds.

Auth endpoint:

:   For US government clouds:
    https://login.microsoftonline.us/%s/oauth2/v2.0/token

    For US government cloud support: \<paramter name="ext.cred.azure.vault_auth_endpoint" value="https://login.microsoftonline.us/%s/oauth2/v2.0/token"/\>

**Scope:**

:   For US government clouds: https://vault.usgovcloudapi.net/.default

    \<paramter name="ext.cred.azure.endpoint_scope" value="https://vault.usgovcloudapi.net/.default"/\>

    For Germany government clouds:
    https://vault.microsoftazure.de/.default

    For Chinese government clouds: https://vault.azure.cn/.default
{#mid_azure_key_vault_intergration_ref__dl_yb3_ljx_dcc}