ServiceNow–Power Automate Integration: Authenticated Connection Setup

Every Power Automate integration with ServiceNow begins with a properly configured service account that has the right permissions. Without it, you cannot reliably perform CRUD operations across the two platforms. This guide walks you through the entire setup, from granting your own ServiceNow user the necessary admin role to finalising the connection in a flow. We will cover both Basic Authentication and OAuth2, and highlight security practices you should adopt from day one.

Scenario: Automated Change Request Retrieval

Contoso IT uses ServiceNow to manage change requests. The team wants a Power Automate flow that runs every morning, retrieves all newly submitted change requests, and stores them in a SharePoint list for easier reporting. The flow needs a service account that can query the change_request table and return only the records that match a specific "New" state. This article focuses on building that foundational connection.

Prerequisites

A ServiceNow instance (developer or production) with your personal user already set to the Admin role – you will use this to create the service account.
A Power Automate license that supports flows using the ServiceNow connector.

Step 1: Ensure Your User Has Admin Privileges

To create and configure a dedicated service account, your own ServiceNow user must belong to the admin role.

Open your ServiceNow instance and click your avatar in the upper‑right corner. Select Change User Role and confirm that the slider is set to Admin. If you are not already an admin, request the change from your instance administrator or, on a developer instance, you can switch roles immediately.

Step 2: Create a Dedicated Service Account

From the ServiceNow main menu, navigate to User Administration > Users. Click New and enter the following details:

textService account profile fields

User ID: svc_pa_connector
First name: Flow
Last name: Service
Web Service Only: Yes

The Web Service Only flag is critical – it restricts this account to API access only and prevents interactive logins, matching the principle of least privilege.

Click Submit to create the user.

Step 3: Set a Password and Record It Safely

Open the newly created user record (svc_pa_connector). On the form, select Set Password. Generate a strong password (or let ServiceNow generate one), copy it immediately, and store it in a secure vault or password manager. You will not be able to retrieve it later.

Step 4: Assign Security Roles

A bare user account cannot read any tables. You must grant roles that authorise REST API access and the ability to read or write the data Power Automate needs.

From the same user record, locate the Roles tab and click Edit. Add the following four roles:

textMinimum roles for Power Automate connections

admin
catalog_admin
rest_api_explorer
web_service_admin

After saving, ServiceNow may automatically inherit additional roles (such as snc_platform_rest_api). This is expected and does not need to be reversed.

The admin role provides broad read/write access. In a production environment you would customise roles further, but this combination works well for development and intermediate automation scenarios.

Step 5: Retrieve Your Instance Name

The instance name is the subdomain portion of your ServiceNow URL. For example, if your instance is hosted at https://dev270334.service-now.com, the instance name is dev270334.

Copy this value – you will need it in Power Automate.

Step 6: Build the Connection in Power Automate (Basic Authentication)

Create a new Instant – Cloud Flow in Power Automate. Give it a meaningful name, for example “ServiceNow Change Request Retriever”.

Add an action named ServiceNow – List records (or any other ServiceNow action). When prompted for connection details, choose Basic Authentication and fill in the fields:

textBasic Authentication connection fields

Authentication Type: Basic Authentication
Instance: dev270334
Username: svc_pa_connector
Password: < your securely stored password >

After the connection is created, configure the action:

Record Type: Change Request (table name change_request)
Limit: 10 (to test the connection with a small result set)

Step 7: Test the Flow

Click Test and run the flow manually. If the connection is successful, the outputs from the List records action will include a $values array containing the first ten change requests, together with standard fields such as number, short_description, and state.

If you receive errors related to authentication or permission, go back and verify the password, instance name, and the roles assigned to the service account.

(Alternative) Step 8: Use OAuth2 Instead of Basic Authentication

OAuth2 is strongly recommended for production environments because it avoids long‑lived hardcoded secrets and supports token rotation.

In ServiceNow, navigate to Application Registry (search from the main menu). Click New and then Create an OAuth API endpoint for external clients.

Enter a name such as PowerPlatformServiceAccount. ServiceNow will generate a Client ID and Client Secret. Copy both values.

For the Redirect URL, use the appropriate Microsoft endpoint:

textDefault OAuth2 redirect URL (US region)

https://global.consent.azure-apim.net/redirect

If you are outside the United States, replace global with the subdomain shown in the browser’s address bar when the consent dialog appears. For Canada, for example, use canada-001.consent.azure-apim.net/redirect.

Back in Power Automate, add a new ServiceNow action and select OAuth2 as the authentication type. Provide the instance name, Client ID, and Client Secret. When the consent window appears, review and accept it. The connection will be established.

Important

If you see the error Invalid redirect_uri, the redirect URL stored in ServiceNow does not match the one Power Automate is sending. Double‑check the subdomain and confirm there are no trailing spaces.

Security Considerations

Use OAuth2 in production – Basic Authentication passes a static credential and is harder to revoke without breaking all flows.
Store secrets in Azure Key Vault – For managed solutions, reference your password or client secret via a Key Vault connection.
Audit role assignments – The admin role is powerful. Consider creating a custom role that only grants the specific table permissions your flows need.
Rotate secrets periodically – Change the service account password or OAuth2 client secret on a regular schedule, and update the Power Automate connection accordingly.

Common Mistakes and Troubleshooting

Problem	Likely cause	How to fix
“User not authenticated”	Password is wrong or has expired	Regenerate password and update the connection
“Table not found”	The record type name does not match the ServiceNow table	Use the exact table name (e.g., `change_request`)
“Insufficient rights”	The service account lacks the required role	Assign at least `rest_api_explorer` and `web_service_admin`
OAuth2 redirect error	Redirect URL mismatch	Update the Redirect URL in the OAuth application registry

Final Recommendation

Start with Basic Authentication to confirm the overall setup works, then migrate to OAuth2 before moving the flow to a production environment. Always keep the service account’s privileges as tight as possible – grant the minimum roles that still let your flows complete their tasks.

References

Matthew Devaney, Create A Connection To ServiceNow In Power Automate (original reference) – https://www.matthewdevaney.com/create-a-connection-to-servicenow-in-power-automate/
ServiceNow Product Documentation – OAuth Setup
Microsoft Power Automate Connector Reference – ServiceNow