--- sourceDocument: Australia ServiceNow AI Platform Administration sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/platform-administration Release : - australia ft:locale : - en-US ft:publication_title : - Australia ServiceNow AI Platform Administration ft:clusterId : - platadm bundleId : - platadm workflow : - Platform --- # Configure source system # Configure your ServiceNow AI Platform instance for external content indexing {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Create and configure a non-interactive service user account on your ServiceNow AI Platform® source instance to allow access by the ServiceNow instance external content connector. ## Before you begin Role required: admin and security_admin Note: The security_admin role is an elevated privilege role. To learn more about elevated privilege roles, see [Elevated privilege roles](https://www.servicenow.com/docs/access?context=c_ElevatedPrivilege&version=australia&pubname=australia-platform-security&ft:locale=en-US). For details on the security_admin elevated privilege role, see [Security_admin role](https://www.servicenow.com/docs/access?context=security-admin-role&version=australia&pubname=australia-platform-security&ft:locale=en-US). ## About this task The ServiceNow instance external content connector retrieves KB articles and security principals from a ServiceNow AI Platform instance. To allow the external content connector to access this content, you need to configure a non-interactive service user account that the connector will use when running document and user mapping crawls. Perform all of these steps on the ServiceNow AI Platform instance that you want the external content connector to retrieve searchable content and metadata from. This is your source instance. The instance where the connector runs and populates search applications with the retrieved data is your destination instance. ## Procedure 1. On your source instance, create a new non-interactive user and save its user ID. 1. Create a new user by following the steps from [Create a user](https://servicenow-prod.fluidtopics.net/MHDG~PN4HEy4MVidWe4SBA "You can add a user to your instance to enable them to log in and use designated application features."). Note: Make sure to select the Web service access only option on the new user record. This option designates your new user as a non-interactive user. To learn more about how non-interactive users differ from interactive users, see [Non-interactive sessions](https://servicenow-prod.fluidtopics.net/uK8qLPVhStVel6wcixU1kg#c_NonInteractiveSessions "The Non-Interactive Sessions plugin creates a distinction between interactive and non-interactive users."). 2. Copy the User ID for your new source instance user account and store it in a secure location. Important: Your connector administrator needs this user account's user ID when configuring the ServiceNow instance external content connector on your destination instance. {#configure-sn-aip-instance-external-content-indexing__store-service-user-id-step} {#configure-sn-aip-instance-external-content-indexing__store-service-user-id-step} {#configure-sn-aip-instance-external-content-indexing__substeps_v2l_tvs_tfc} 2. On your source instance, generate and copy a strong password for your new user. 1. Generate a strong password for your new user by following the steps from [Configure password for a user](https://www.servicenow.com/docs/access?context=reset-your-password&version=australia&pubname=australia-platform-security&ft:locale=en-US). 2. Store the copied password in a secure location. Important: Your connector administrator needs this user account's password when configuring the ServiceNow instance external content connector on your destination instance. {#configure-sn-aip-instance-external-content-indexing__store-service-user-password-step} {#configure-sn-aip-instance-external-content-indexing__store-service-user-password-step} {#configure-sn-aip-instance-external-content-indexing__substeps_nf4_3vs_tfc} 3. On your source instance, add your new user to the MFA Exempted User Group by following the steps from [Add a user to a group](https://servicenow-prod.fluidtopics.net/KfV4WUa2~RRjrhr0GCFJeA "Add a user to a group so that the user inherits all the roles assigned to the group."). Note: Inclusion in this group exempts your new user from the default requirement to use multi-factor authentication (MFA) when logging in to your source instance. This configuration is needed for proper operation of the ServiceNow instance external content connector. 4. On your source instance, create a new custom role in the Global application scope. 1. Select the Global application scope, following the steps from [Select an application from the application picker](https://servicenow-prod.fluidtopics.net/9MNZ9_AwPFEkMF3wq1PeOQ "Use the application picker to select the application scope to which any new records and updates apply."). 2. Navigate to AllUser AdministrationRoles. 3. Select New. 4. On the Role form, enter a name for your new custom role. As an example, you might enter ext_cont_connectors_custom_role. 5. Select Submit. {#configure-sn-aip-instance-external-content-indexing__substeps_rd1_v35_3hc} {#configure-sn-aip-instance-external-content-indexing__create-role-step} {#configure-sn-aip-instance-external-content-indexing__create-role-step} 5. On your source instance, create and edit ACLs (access control lists) to grant users with your new custom role access to the Security Attribute \[sys_security_attribute\] table. 1. Navigate to AllSystem SecurityAccess Control (ACL). 2. Select New. 3. On the Access Control form, fill in the fields. {#configure-sn-aip-instance-external-content-indexing__table_fgg_bpv_3hc__entry__2} | Field | Value | |-|-| | Type | Select record. | | Operation | Select read. | | Active | Select this option. | | Name | In the Tables list, select the Security Attribute \[sys_security_attribute\] table. Leave the Fields list set to its default value. | | Conditions || | Requires role | Insert a new row with the name of your new custom role. | [ ] {#configure-sn-aip-instance-external-content-indexing__table_fgg_bpv_3hc} 4. Select Submit, then select Continue. The new ACL record appears in the Access Control list view. 5. In the Access Control \[sys_security_acl\] table list view, create and apply a filter with the following condition. {#configure-sn-aip-instance-external-content-indexing__table_erf_1s5_3hc__entry__3} | Field | Operation | Value | |-|-|-| | Sys ID | is | ee3ebfdc9f4112108647e8c40b0a1cb0 | [ ] {#configure-sn-aip-instance-external-content-indexing__table_erf_1s5_3hc} For details on creating and applying filters to limit records shown in a table's list view, see [Create a filter in List](https://www.servicenow.com/docs/access?context=t_CreatingFilters&version=australia&pubname=australia-platform-user-interface&ft:locale=en-US). This filter should display a single Access Control record with Decision Type Deny Unless. 6. Open the filtered Access Control record. 7. On the Access Control form, in the Conditions section, find the Requires role condition list and insert a new row with the name of your new custom role. 8. Select Update. {#configure-sn-aip-instance-external-content-indexing__substeps_qgj_rp5_3hc} 6. On your source instance, assign roles to your new user. 1. Assign your new custom role to your new user by following the steps from [Assign a role to a user](https://servicenow-prod.fluidtopics.net/nlz1TIVlb6jMoA3CdcH80Q "A user inherits roles from all groups to which they belong. You can also assign roles directly to a user. Whenever a user is assigned a new role, it only takes effect after logging in with a new session."). 2. Assign each of the following roles to your new user by following the steps from [Assign a role to a user](https://servicenow-prod.fluidtopics.net/nlz1TIVlb6jMoA3CdcH80Q "A user inherits roles from all groups to which they belong. You can also assign roles directly to a user. Whenever a user is assigned a new role, it only takes effect after logging in with a new session."). {#configure-sn-aip-instance-external-content-indexing__table_cnm_wzs_tfc__entry__2} | Role | Description | |-|-| | access_analyzer_admin | Grants the user access to tables relating to access control in your source instance, including the Access Control \[sys_security_acl\], Role \[sys_user_role\], and Table \[sys_db_object\] tables. To learn more about access control, see [Access Control Lists (ACLs)](https://www.servicenow.com/docs/access?context=access-control-rules&version=australia&pubname=australia-platform-security&ft:locale=en-US). | | catalog_manager | Grants the user access to Service Catalog items in your source instance. For more details on this base system role, see [Base system roles](https://servicenow-prod.fluidtopics.net/1ADLDfs4TNQi4j3Zxdg7GA "Administrators can assign one or more base system user roles to grant access to base system platform features and applications."). | | itil | Grants the user access to incidents and user criteria in your source instance. For more details on this base system role, see [Base system roles](https://servicenow-prod.fluidtopics.net/1ADLDfs4TNQi4j3Zxdg7GA "Administrators can assign one or more base system user roles to grant access to base system platform features and applications."). | | knowledge_admin | Grants the user access to KB articles in your source instance. For more details on this base system role, see [Base system roles](https://servicenow-prod.fluidtopics.net/1ADLDfs4TNQi4j3Zxdg7GA "Administrators can assign one or more base system user roles to grant access to base system platform features and applications."). | | snc_platform_rest_api_access | Grants the user access to Platform Rest APIs in your source instance. The ServiceNow instance external content connector uses the [Attachment API](https://www.servicenow.com/docs/access?context=c_AttachmentAPI&version=australia&pubname=australia-api-reference&ft:locale=en-US) and [Table API](https://www.servicenow.com/docs/access?context=c_TableAPI&version=australia&pubname=australia-api-reference&ft:locale=en-US) to access your source instance during crawls. For more details on this base system role, see [Base system roles](https://servicenow-prod.fluidtopics.net/1ADLDfs4TNQi4j3Zxdg7GA "Administrators can assign one or more base system user roles to grant access to base system platform features and applications."). | | snc_read_only | Restricts the user to read-only access on all tables that it has access to. For more details on this base system role, see [Read-only role](https://servicenow-prod.fluidtopics.net/zCEgSReGxHvUdeWXnWDnUw#c_ReadOnlyRole "The read-only role (snc_read_only) restricts a user or a group of users to read-only access on the tables to which the user already has access."). | [ ] {#configure-sn-aip-instance-external-content-indexing__table_cnm_wzs_tfc} {#configure-sn-aip-instance-external-content-indexing__substeps_y2p_455_3hc} {#configure-sn-aip-instance-external-content-indexing__steps_el1_thl_tfc} ## What to do next Provide the following items to the connector administrator who will create the ServiceNow instance connector on your destination instance: * The URL for your ServiceNow AI Platform source instance. As an example, you might provide https://example.service-now.com/ as the instance URL. * The user ID for the non-interactive service user you created on your source instance, as copied in step [1.b](https://servicenow-prod.fluidtopics.net/~wk09FiLcLktBQCqInQqyg#configure-sn-aip-instance-external-content-indexing__store-service-user-id-step). As an example, you might provide sn.instance.connector as the user ID. * The password for the non-interactive service user you created on your source instance, as copied in step [2.b](https://servicenow-prod.fluidtopics.net/~wk09FiLcLktBQCqInQqyg#configure-sn-aip-instance-external-content-indexing__store-service-user-password-step). {#configure-sn-aip-instance-external-content-indexing__ul_rl2_xjd_tdc} Your connector administrator needs these items to configure a ServiceNow instance external content connector on your destination instance to retrieve content and security principals from your ServiceNow AI Platform source instance. For details on creating and configuring a ServiceNow instance external content connector, see [Create a ServiceNow instance external content connector](https://servicenow-prod.fluidtopics.net/rLMWtq8_~WkXP94oUnCHOA "Create an external content connector to retrieve searchable content and security principals from a ServiceNow AI Platform instance."). *[\>]: and then