Basic Auth Hybrid Accounts Undecided

This page describes the nowisor-basic-auth-hybrid-undecided check (new in pack v1.1.0). It counts records in sys_user_basic_auth_exception that have not been triaged (action_taken = false) and samples the most-used accounts.

What this finding means

When Basic Auth tracking is on, ServiceNow records every interactive account that authenticates to inbound APIs with Basic Auth in sys_user_basic_auth_exception. Each record carries a decision (grant = maintain both UI and API login, no_grant = block API login, converted = make it web-service-access-only, global = apply the system default) and an action_taken flag. This check fires when one or more records are untriaged (action_taken = false), and lists the top accounts by usage_count with their decision and last_seen.

An untriaged record is a hybrid account: it can log into the UI and it authenticates to APIs with single-factor Basic Auth. That is an MFA-bypass surface today, and an unmanaged outcome at enforcement — depending on the decision applied, the bypass persists (grant) or the account is blocked with a 401 (no_grant).

Why it matters

These are the accounts the whole feature exists to surface. Left untriaged, each one is both a present-day single-factor path onto the platform and a future support ticket: at enforcement, an undecided account either keeps its bypass or breaks an integration without warning. The action_taken = false set is your decision queue.

How to remediate

Triage every untriaged record and apply a decision: convert integration identities to web-service-access-only, revoke API Basic Auth for accounts that should not use it, or — only as a time-boxed exception — explicitly maintain access. Migrate human / interactive API use to OAuth. Treat the snc_basic_auth_api_access role as a temporary exception, not a standing grant.

If the exception table is absent the check reports feature_table_not_found; if the scan account cannot read it, insufficient_access — never a silent pass.

Verified against ServiceNow Zurich Patch 6 (dev265147), 2026-06-11.