Okta generates a provisioning error for ServiceNow when the service account lacks appropriate permissions or the external ID mismatches. Verifying the ServiceNow credentials and the target user external ID resolves this issue. The following errors appear on the Okta dashboard during the provisioning flow:

Errors during execution: Error executing pushUserProfile: 404. No Record found. Record doesn't exist or ACL restricts the record retrieval. Error Code: null

403. Operation Failed. ACL Exception Insert Failed due to security constraints

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN)
• ServiceNow Provisioning

The error occurs due to a misconfiguration in the ServiceNow environment or because the service account used for the Application Programming Interface (API) integration lacks the appropriate permissions to view or edit user objects in the ServiceNow application. Access control list (ACL) rules restrict access to data by requiring users to pass a set of requirements before interacting with it. 

The object is the target to which access needs to be controlled. Each object consists of a type and name that uniquely identifies a particular table, field, or record.

All-access control list rules specify:

• The object and operation being secured
• The permissions required to access the object

How are the ServiceNow credentials verified?

Locate the credentials in the ServiceNow instance and verify they match the integration settings in the Okta Admin Console.

1. Sign in to the ServiceNow instance.
2. Navigate to Your instance actions > Manage instance password to locate the credentials.
   
3. Navigate to the Okta Admin Console and go to Applications > Applications.
4. Select the ServiceNow application.
5. Go to the Provisioning tab and select Integration in the left settings menu.
6. Verify the credentials match the ServiceNow instance.

Verify the Target User External ID in Okta

Check the external ID in the application assignments and reassign the user to obtain the current external ID from ServiceNow.

1. Navigate to the Okta Admin Console and go to Applications > Applications.
2. Select the ServiceNow application.
3. Go to the Assignments tab.
4. Select the Edit (pencil) icon next to the affected user to view the external ID.
5. Verify the external ID matches the unique ID for the user record in ServiceNow.
6. If the external ID does not match, unassign the user from the application.
7. Reassign the user to the application to initiate the provisioning flow and obtain the current external ID from ServiceNow based on the username.

NOTE: Contact ServiceNow Support for more details if further challenges occur when locating the user accounts or required permissions in the ServiceNow environment.

Related References

• Access control list rules
• Demystifying Access Controls | ACL Basics
• Why the External ID is Necessary for Provisioning to Downstream Apps