---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure Microsoft SCCM Patch Orchestration

# Configure Microsoft SCCM Patch Orchestration {#ariaid-title1}

* Release version: Australia
* 
* Updated July 23, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read

Configure the Microsoft SCCM Patch Orchestration integration with your account credentials to enable data ingestion and patch deployment.

## Before you begin

Role required: sn_vul.vulnerability_admin and sn_vul_sccm.configure_integration  
Before configuring the integration, complete these prerequisites for the JDBC Connection tab:

1. Install the Java Database Connectivity (JDBC) driver for SQL Server on your MID Server. For instructions, see [Synchronize a JAR file to MID Servers](https://www.servicenow.com/docs/access?context=t_SynchronizeAJARFiletoMIDServers&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US).
2. Set up a JDBC credential with the username and password for your SCCM SQL Server. For instructions, see [Create and test your credentials](https://www.servicenow.com/docs/access?context=t_CreateCredential&version=australia&pubname=australia-platform-security&ft:locale=en-US).
3. Set up a JDBC connection that references the credential above, with the SCCM SQL Server host, database name, and (if applicable) a non-default port. For instructions, see [Create a JDBC connection](https://www.servicenow.com/docs/access?context=create-JDBC-connection&version=australia&pubname=australia-platform-security&ft:locale=en-US).
{#vr-mspatch-config__ol_fds_wqx_zjc}

## Procedure

1. Navigate to AllMicrosoft SCCM Patch Orchestration IntegrationConfiguration.
2. In the Integration instance field, above the JDBC Connection and WMI Connection tabs, select the name of the Microsoft SCCM instance account you want to configure, for example, <kbd class="ph userinput">Microsoft SCCM Patch management Integration</kbd>.
3. On the JDBC Connection tab, fill in the fields to configure data ingestion (collections, devices, patches, and deployments).  
   {#vr-mspatch-config__steps_jwy_vdz_5sb__entry__2}

   | Field | Description |
   |-|-|
   | JDBC connection | Reference to the JDBC Connection record you created as a prerequisite. JDBC is the primary connection used for all data ingestion (collections, devices, patches, and deployments). |
   | Security updates only | Select this check box to retrieve only security-classified updates. Clear this check box to retrieve all update types. |
   | JDBC process timeout (minutes) | Maximum time, in minutes, that an SCCM JDBC integration process can remain in a waiting state before it's automatically marked as timed out and failed. Enter 0 to disable this timeout. Default: 60. |
   [ ]

4. On the WMI Connection tab, fill in the fields to configure the Windows credential for the Microsoft SCCM server for patch deployment.  
   {#vr-mspatch-config__table_zjz_byv_hsb__entry__2}

   | Field | Description |
   |-|-|
   | WMI Connection | The Connection record \[sys_connection\] that stores the host, credentials, and MID Server details for this integration. The default VR Microsoft SCCM connection record is pre-populated. |
   | Host | Enter the host name of the Microsoft SCCM server, for example, <kbd class="ph userinput">sccm2603.secops-eng.com</kbd>. |
   | User name | Enter your Microsoft SCCM account username. |
   | Password | Enter your Microsoft SCCM account password. |
   | MID Server | Enter the name of the standalone MID Server from the list that you want to use. See [Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM](https://servicenow-prod.fluidtopics.net/xif4rExgP1RX8BKHypcG5w "Prepare for the integration by performing the following setup tasks.") for more information about MID Servers and set up tasks in your ServiceNow AI Platform®. |
   | SG connector connection | The integration uses a Service Graph Connector (SGC) connection to identify imported assets and match them with existing Configuration Items (CIs). A valid SGC connection is required for CI matching; if this field is not configured, imported assets cannot be associated with existing CIs. |
   [ ]

   {#vr-mspatch-config__table_zjz_byv_hsb}
5. Select Save and Test Credentials.  
   The status of your connection between Microsoft SCCM and your ServiceNow AI Platform® instance is displayed in the Validation Status field. If the test is unsuccessful, follow the on-screen prompts.
6. **Optional:** Configure domain separation for this integration.  
   To add configurations to your instance:
   1. Navigate to AllMicrosoft SCCM Patch Orchestration IntegrationIntegration Instances.
   2. Confirm the application scope, Vulnerability Response Patch Orchestration with Microsoft SCCM, is displayed in the Application scope field.
   3. Select New.
   4. Fill in the form.  
      {#vr-mspatch-config__table_v4x_qbw_hsb__entry__2}

      | Field | Description |
      |-|-|
      | Name | Name for the integration instance. |
      | Application | Vulnerability Response Patch Orchestration with Microsoft SCCM |
      | Integration | \[Read only\] Microsoft SCCM Patch management is the default. |
      | Active | Selected by default. If cleared, the instance is inactive. |
      [ ]

      {#vr-mspatch-config__table_v4x_qbw_hsb}
   5. Click Submit.  
      Your new integration instance is displayed on the Integration Instances list.
   6. Repeat steps 1-3 to configure your integration instance and test your credentials.
   {#vr-mspatch-config__substeps_v1d_gbw_hsb}
7. Set up approvals for patch requests.  
   By default, the Patch approval required (sn_vul_patch_orch.patch_approval_required) property is active so that when patch deployments are scheduled, they are submitted for review and approval to users assigned to the Level 1 - Patch update approval group.

   If you want users with the sn_vul_patch_orch.configure_patch role to schedule patches without approval, you can deactivate the Patch approval required (sn_vul_patch_orch.patch_approval_required) property. You might prefer to leave approvals activated so that scheduled patches don't conflict with normal working
   hours.  
   Note:  
   If you deactivate the approval system property, any user with the sn_vul_patch_orch.configure_patch role can schedule and deploy patches without review and approval.

   As a user with the sn_vul.vulnerability_admin role, to deactivate the system property:
   1. Navigate to All and enter <kbd class="ph userinput">sys.properties.list</kbd> in the filter navigator.
   2. Locate sn_vul_patch_orch.patch_approval_required and select it to open the record.
   3. In the Value field, type <kbd class="ph userinput">false</kbd>.
   4. Click Update.
   {#vr-mspatch-config__substeps_myd_235_ssb}
8. If the approval property is active, assign approvers for patch requests.
   1. Navigate to AllVulnerability ResponseAdministrationApproval Rules.
   2. If the Deploy patch update approval Approval Rule is not displayed, select All in the filter to display the full list.
   3. From the list, select Deploy patch update approval.
   4. On the record, with the Approval Configuration tab selected, select Default Configuration Patch Update approval.
   5. On the record, select Level 1 - Patch update approval.
   6. Add users in this group.  
      The users assigned to this group approve patch requests submitted by users with the sn_vul_patch_orch.configure_patch role. Navigate to My Approvals to view and process the requests.
   {#vr-mspatch-config__substeps_o45_g12_3sb}
9. Select Update.
10. **Optional:** Set up multi-level approvals to require more than one approval before deploying scheduled patch requests.
    1. With the Default Configuration Patch Update approval record displayed, click New.
    2. Fill in the fields.  
       {#vr-mspatch-config__id_hd3_r25_ssb__entry__2}

       | Field | Description |
       |-|-|
       | Name | Approval level name, for example, Level 2 - Patch update approval. |
       | Active | Active by default. When active, the approval level is in use. |
       | Required approval | Select how many approvals are required for the selected level: * One approver required * All users must approve {#vr-mspatch-config__ul_lm1_bpz_kqb} |
       | Order | Execution order of various configurations within a rule. For example, a configuration with an order entry of 100 runs before a configuration with an order entry of 200. |
       | Role | Select a role for the group from the list. |
       | Approval rule | Contains the table and type details for the approval rule. |
       | Approval configuration | Contains the approval configurations. |
       | Assign using | Select an option: * User and user group * Approval table field * Script {#vr-mspatch-config__ul_vg5_v4z_kqb} |
       | Groups | Approver level group consisting of multiple users. The user must have one of the following roles that you specify. |
       | Users | Edit the users listed in the groups. |
       [ ]

       {#vr-mspatch-config__id_hd3_r25_ssb}
    3. Select Submit.
    {#vr-mspatch-config__substeps_fzn_xd5_ssb}
{#vr-mspatch-config__steps_jwy_vdz_5sb}

*[\>]: and then