Skip to content
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Credential stores for Password Reset

Credential stores hold user information such as user names and passwords that can be used as login credentials. Examples include the User table [sys_user] or an Active Directory server.

Users with the password_reset_admin or password_reset_credential_manager role can create and modify connections to credential stores.

Credential store types installed with the base system

A credential store type is a set of workflows that specify how to connect to a credential store. Navigate to Password Reset > Credential Store Types to view the list of example credential stores that are based on the base-system types. The base system includes the following credential store types:

NameDescription
Local ServiceNow InstanceRepresents the current (local) ServiceNow instance.

Credential store types included in Store apps

NameDescription
Microsoft AD Credential StoreRepresents a Microsoft Active Directory credential store. See Set up Microsoft Active Directory for Password Reset.
Microsoft Entra ID Credential StoreRepresents a Microsoft Entra ID credential store.
Okta credential storeRepresents an Okta credential store.
Google credential storeRepresents a Google Directory credential store.

Connection subflows for credential store types

A credential store type workflow requires a subflow that defines how to connect to the store, and can include an optional subflow that defines how to test the connection. Use the Pwd reset – AD and Pwd Reset - Local subflows as models for your custom connection workflows.

Image omitted: PwdResetLocalServiceNowSubWorkflow.png
Pwd Reset Local sub workflow
Image omitted: PwdConnectionTestLocalSNSubWorkflow.png
Pwd connection test local SN sub workflow

Creating a custom credential store type

You can use a credential store type as a model to create a custom type. See Create a credential store type for Password Reset.

  • Configure the connection to a credential store for the Password Reset processes
    You create a Password Reset credential store record to configure access to your credential store server while a user is changing or resetting a password. In addition to host connection information, you can specify the password hints that users should see, restrictions on password reuse, the allowed number of failed reset attempts, and other settings.
  • Credentials Store for Password Reset for Active Directory
    A credential store type is a set of workflows that specify how to connect to a credential store. You can connect to Password Reset Credential Stores to view the list of example credential stores that are based on the base-system types.
  • Credential Store for Password Reset for Microsoft Entra ID
    A credential store type is the set of flows to manage password and account of Microsoft Entra ID user. Navigate to Password Reset > Credential Stores to view the list of example credential stores that are based on the base-system types.
  • Test the connection to a credential store
    You should test the connection to a credential store after you configure a new credential store or when users experience problems that might involve the connection.
  • Delete a connection to a credential store for Password Reset
    Important: Before you delete the connection to a credential store, check all Password Reset processes to ensure that the credential store is not in use. If the credential store is being used by a process, update the process before deleting the credential store.

Parent Topic:Configure your Password Reset process

Related topics

Calculating the security score for password reset process

Configure password expiration reminder

Password Reset verifications

Configure your Password Reset process to auto-enroll users

Enable users to enroll for Password Reset

Configure Password Reset properties

Send email to remind users to enroll for Password Reset

Configure the required strength for passwords

Specify lockout for failed login attempts

Configure Google reCAPTCHA for the password reset process