--- title: Configure Microsoft SCCM Patch Orchestration description: Configure the Microsoft SCCM Patch Orchestration integration with your account credentials to enable data ingestion and patch deployment. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/vr-mspatch-config.html release: australia product: Vulnerability Response classification: vulnerability-response topic_type: task last_updated: "2026-07-23" reading_time_minutes: 5 breadcrumb: [Vulnerability Response patch orchestration integration with Microsoft SCCM, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Configure Microsoft SCCM Patch Orchestration Configure the Microsoft SCCM Patch Orchestration integration with your account credentials to enable data ingestion and patch deployment. ## Before you begin Role required: sn\_vul.vulnerability\_admin and sn\_vul\_sccm.configure\_integration Before configuring the integration, complete these prerequisites for the JDBC Connection tab: 1. Install the Java Database Connectivity \(JDBC\) driver for SQL Server on your MID Server. For instructions, see [Synchronize a JAR file to MID Servers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/t_SynchronizeAJARFiletoMIDServers.md). 2. Set up a JDBC credential with the username and password for your SCCM SQL Server. For instructions, see [Create and test your credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_CreateCredential.md). 3. Set up a JDBC connection that references the credential above, with the SCCM SQL Server host, database name, and \(if applicable\) a non-default port. For instructions, see [Create a JDBC connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-JDBC-connection.md). ## Procedure 1. Navigate to **All** > **Microsoft SCCM Patch Orchestration Integration** > **Configuration**. 2. In the **Integration instance** field, above the **JDBC Connection** and **WMI Connection** tabs, select the name of the Microsoft SCCM instance account you want to configure, for example, `Microsoft SCCM Patch management Integration`. 3. On the **JDBC Connection** tab, fill in the fields to configure data ingestion \(collections, devices, patches, and deployments\). |Field|Description| |-----|-----------| |JDBC connection|Reference to the JDBC Connection record you created as a prerequisite. JDBC is the primary connection used for all data ingestion \(collections, devices, patches, and deployments\).| |Security updates only|Select this check box to retrieve only security-classified updates. Clear this check box to retrieve all update types.| |JDBC process timeout \(minutes\)|Maximum time, in minutes, that an SCCM JDBC integration process can remain in a waiting state before it's automatically marked as timed out and failed. Enter 0 to disable this timeout. Default: 60.| 4. On the **WMI Connection** tab, fill in the fields to configure the Windows credential for the Microsoft SCCM server for patch deployment. |Field|Description| |-----|-----------| |WMI Connection|The Connection record \[sys\_connection\] that stores the host, credentials, and MID Server details for this integration. The default **VR Microsoft SCCM connection** record is pre-populated.| |Host|Enter the host name of the Microsoft SCCM server, for example, `sccm2603.secops-eng.com`.| |User name|Enter your Microsoft SCCM account username.| |Password|Enter your Microsoft SCCM account password.| |MID Server|Enter the name of the standalone MID Server from the list that you want to use. See [Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-mspatch-setup-checklist.md) for more information about MID Servers and set up tasks in your ServiceNow AI Platform®.| |SG connector connection|The integration uses a Service Graph Connector \(SGC\) connection to identify imported assets and match them with existing Configuration Items \(CIs\). A valid SGC connection is required for CI matching; if this field is not configured, imported assets cannot be associated with existing CIs.| 5. Select **Save and Test Credentials**. The status of your connection between Microsoft SCCM and your ServiceNow AI Platform® instance is displayed in the Validation Status field. If the test is unsuccessful, follow the on-screen prompts. 6. Configure domain separation for this integration. To add configurations to your instance: 1. Navigate to **All** > **Microsoft SCCM Patch Orchestration Integration** > **Integration Instances**. 2. Confirm the application scope, `Vulnerability Response Patch Orchestration with Microsoft SCCM`, is displayed in the Application scope field. 3. Select **New**. 4. Fill in the form. |Field|Description| |-----|-----------| |Name|Name for the integration instance.| |Application|Vulnerability Response Patch Orchestration with Microsoft SCCM| |Integration|\[Read only\] Microsoft SCCM Patch management is the default.| |Active|Selected by default. If cleared, the instance is inactive.| 5. Click **Submit**. Your new integration instance is displayed on the Integration Instances list. 6. Repeat steps 1-3 to configure your integration instance and test your credentials. 7. Set up approvals for patch requests. By default, the **Patch approval required** \(**sn\_vul\_patch\_orch.patch\_approval\_required**\) property is active so that when patch deployments are scheduled, they are submitted for review and approval to users assigned to the Level 1 - Patch update approval group. If you want users with the sn\_vul\_patch\_orch.configure\_patch role to schedule patches without approval, you can deactivate the **Patch approval required** \(**sn\_vul\_patch\_orch.patch\_approval\_required**\) property. You might prefer to leave approvals activated so that scheduled patches don't conflict with normal working hours. **Note:** If you deactivate the approval system property, any user with the sn\_vul\_patch\_orch.configure\_patch role can schedule and deploy patches without review and approval. As a user with the sn\_vul.vulnerability\_admin role, to deactivate the system property: 1. Navigate to **All** and enter `sys.properties.list` in the filter navigator. 2. Locate **sn\_vul\_patch\_orch.patch\_approval\_required** and select it to open the record. 3. In the Value field, type `false`. 4. Click **Update**. 8. If the approval property is active, assign approvers for patch requests. 1. Navigate to **All** > **Vulnerability Response** > **Administration** > **Approval Rules**. 2. If the **Deploy patch update approval** Approval Rule is not displayed, select **All** in the filter to display the full list. 3. From the list, select **Deploy patch update approval**. 4. On the record, with the Approval Configuration tab selected, select **Default Configuration Patch Update approval**. 5. On the record, select **Level 1 - Patch update approval**. 6. Add users in this group. The users assigned to this group approve patch requests submitted by users with the sn\_vul\_patch\_orch.configure\_patch role. Navigate to **My Approvals** to view and process the requests. 9. Select **Update**. 10. Set up multi-level approvals to require more than one approval before deploying scheduled patch requests. 1. With the Default Configuration Patch Update approval record displayed, click **New**. 2. Fill in the fields.
Field Description
Name Approval level name, for example, **Level 2 - Patch update approval**.
Active Active by default. When active, the approval level is in use.
Required approval Select how many approvals are required for the selected level:- One approver required - All users must approve
Order Execution order of various configurations within a rule. For example, a configuration with an order entry of 100 runs before a configuration with an order entry of 200.
Role Select a role for the group from the list.
Approval rule Contains the table and type details for the approval rule.
Approval configuration Contains the approval configurations.
Assign using Select an option:- User and user group - Approval table field - Script
Groups Approver level group consisting of multiple users. The user must have one of the following roles that you specify.
Users Edit the users listed in the groups.
3. Select **Submit**.