Microsoft Defender for Cloud

Create a ticket in Defender for Cloud

4 September 2026Doc update+8 / −4 lines

In brief

The article now introduces prerequisites, clarifies supported incident, change request, and problem ticket types, explains that deleting the integration removes associated assignments within up to 24 hours, and updates the next-steps heading and anchor.

What Defender admins need to know

Administrators have clearer guidance when configuring or deleting the Defender for Cloud–ServiceNow integration.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Prerequisites

Before you create tickets in ServiceNow, make sure the following prerequisites are met:

Have an application registry in ServiceNow.
Enable Defender Cloud Security Posture Management (CSPM) on your Azure subscription.

Select the ticket type.

:::image type="content" border="true" source="./media/create-ticket-servicenow/assignment-type.png" alt-text="Screenshot of how to complete the assignment type.":::

After the assignment is created, the Ticket ID assigned to this affected resource will appear next to the resource in the recommendation. The Ticket ID represents the ticket created in the ServiceNow portal. You can select the Ticket ID to navigate to the newly created incident in the ServiceNow portal.

Next steps

[!div class="nextstepaction"] Assign an owner to a recommendation or severity level

@@ -2,8 +2,9 @@ title: Create a ticket in Defender for Cloud  description: Learn how to create a ticket in Defender for Cloud that connects and synchronizes with your ServiceNow account. ms.topic: how-to-ms.date: 08/20/2024+ms.date: 07/03/2026 ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1013 #customer intent: As a user, I want to learn how to Create a ticket in Defender for Cloud for my ServiceNow account. --- @@ -13,6 +14,8 @@ The integration between Defender for Cloud with ServiceNow's IT Service Manageme  ## Prerequisites +Before you create tickets in ServiceNow, make sure the following prerequisites are met:+ - Have an [application registry in ServiceNow](https://www.opslogix.com/knowledgebase/servicenow/kb-create-a-servicenow-api-key-and-secret-for-the-scom-servicenow-incident-connector).  - Enable [Defender Cloud Security Posture Management (CSPM)](tutorial-enable-cspm-plan.md) on your Azure subscription.@@ -47,7 +50,7 @@ Security admins can create and assign tickets directly from the Defender for Clo 1. Select the ticket type.     > [!NOTE]-   > In ServiceNow, there are several types of tickets that can be used to manage and track different types of incidents, requests, and tasks. Only incident, change request, and problem are supported with this integration.+   > In ServiceNow, there are several types of tickets that can be used to manage and track different types of incidents, requests, and tasks. Only incident, change request, and problem ticket types are supported with the Defender for Cloud and ServiceNow ITSM integration.     :::image type="content" border="true" source="./media/create-ticket-servicenow/assignment-type.png" alt-text="Screenshot of how to complete the assignment type."::: @@ -69,9 +72,10 @@ Security admins can create and assign tickets directly from the Defender for Clo After the assignment is created, the Ticket ID assigned to this affected resource will appear next to the resource in the recommendation. The Ticket ID represents the ticket created in the ServiceNow portal. You can select the Ticket ID to navigate to the newly created incident in the ServiceNow portal.  > [!NOTE]-> When the integration is deleted, all of the assignments will be deleted. Deletion can take up to 24 hrs.+> When the Defender for Cloud–ServiceNow integration instance is deleted, all associated assignments are also deleted. Deletion can take up to 24 hrs. -## Next step+<a name="next-step"></a>+## Next steps  > [!div class="nextstepaction"] > [Assign an owner to a recommendation or severity level](create-governance-rule-servicenow.md)