Warde / Saviynt
ServiceNow and Saviynt,
approved once.
Staff ask for access in your ServiceNow portal, approvals run in ServiceNow, and Saviynt provisions the change without asking anyone again. Warde does the ServiceNow half, connected to Saviynt Enterprise Identity Cloud.
One path from the request to Saviynt and back.
Saviynt stays the system of record. Your role model, separation-of-duties rules and connections to applications stay there.
01 · Your portal
Ask
Staff search by name and put several applications in one request. What they hold is marked.
02 · ServiceNow
Approve
Your approval policy picks the approvers in order. A bundle is approved once.
03 · Saviynt
Provision
Saviynt makes the change the way it already does. Warde shows the requester a promised date.
04 · ServiceNow
Confirm
The request reads done only when Saviynt confirms it. Removals and review decisions take the same path.
Nobody approves the same access twice.
Approved in ServiceNow
Entitlements go to Saviynt as auto-approved requests, so Saviynt’s approvers are not asked again. Enterprise roles go as Saviynt’s own role request.
Done when every task is
A Saviynt request can read complete before the application is touched. Warde waits until every task Saviynt opened is finished.
Saviynt’s names, your people
Endpoints, entitlements and roles keep Saviynt’s names. Each entitlement’s first-ranked owner in Saviynt becomes its owner in Warde.
What Warde reads from Saviynt.
Several times a day, and whenever an administrator runs a sync.
Endpoints become collections
Each endpoint arrives under its display name with its entitlements. Enterprise roles arrive grouped by role type.
Accounts matched to people
Each account is matched to a ServiceNow user through the Saviynt user it names. One that matches nobody is listed as an orphan for an administrator to link.
Saviynt’s settings respected
An entitlement with no request form in Saviynt, or a role marked not requestable, cannot be requested here either.
Warde next to Saviynt’s own ServiceNow application.
A tick means the work happens in ServiceNow. A dash usually means Saviynt does it in its own console.
| In ServiceNow | Warde | Saviynt for ServiceNow |
|---|---|---|
| Ask for access in the ServiceNow catalog | yes | yes |
| Approve it in ServiceNow | yes | yes: approvals in ServiceNow, with the approval policy kept in Saviynt |
| Checked before it is sent: separation of duties, terms of use and the owner’s notes | yes: terms of use and the owner’s notes wherever they are set, and Saviynt’s separation-of-duties verdict | partly: the requester sees possible separation-of-duties conflicts; terms of use and owner’s notes are not documented |
| Saviynt does the provisioning | yes | yes |
| Time-bound access: an end date on the request, within a limit you set, with a warning before it ends | yes | partly: start and end dates on the request; who removes the access, and any warning, are not documented |
| Removing access in ServiceNow, by the holder or their manager, confirmed back | yes | partly: a Remove access item, with the request updated once Saviynt completes it; who may remove for whom is not documented |
| User access reviews decided in ServiceNow | yes | no |
| Campaigns defined and scheduled in ServiceNow | yes | their console |
| Approval policies built in ServiceNow | yes | no |
| Access bundles curated in ServiceNow | yes | no |
| My Access: one page for what you and your team hold, and the reviews waiting on you | yes | not stated |
| An admin workspace on the instance: what is stuck, what is stale, connector health | yes | not stated |
| The auditor’s evidence pack, in ServiceNow | yes | no |
| Applications Saviynt does not reach, run the same way | yes: provisioned by ServiceNow tasks | yes: Saviynt can raise a ServiceNow ticket for a person to provision |
| Spots the joiner and the leaver for you | not on its own: your joiner and leaver trigger calls Warde’s lifecycle endpoint, and Warde provisions from there | yes |
How we read the vendor
The Saviynt column is read from the Saviynt Identity Governance App listing on the ServiceNow Store, its release notes and configuration guide, in October 2026, as in the comparison on the Warde home page. A dash means the work is done in Saviynt’s console, or the documentation does not say it is done in ServiceNow. On the last row, Saviynt watches your HR source itself; Warde is called by whichever system already knows somebody has joined or left.
When Saviynt does not answer.
- A lost answer
- Warde looks for the request in Saviynt by its reference before sending anything again. If it cannot find it within 30 minutes, a person takes over.
- A request Warde gives up on
- Warde cancels it in Saviynt while it is still open, and the task for a person says whether Saviynt cancelled it.
- A partial read
- A sync that Saviynt refuses part of retires nothing on that run, so access does not drop out of ServiceNow because of one bad read.
- Your tenant’s limits
- Each engine has a call budget, 150 calls in any ten seconds for a new Saviynt engine, which you can change. When it is spent, changes wait their turn.
What your Saviynt team sets up.
01 · Saviynt
Service account
One that can sign in to the API and read users, accounts, endpoints, entitlements and roles.
02 · Saviynt
Approval workflows
A workflow named AUTOAPPROVAL, and the enterprise role workflow set to approve this account’s requests. Without AUTOAPPROVAL, each grant goes to a person.
03 · ServiceNow
Connect
The tenant address and the service account go on a connection record in your instance.
04 · ServiceNow
First sync
Pick the attribute that matches a Saviynt user to a ServiceNow user, and run the first sync.
Certifications decided in ServiceNow.
Campaigns over Saviynt entitlements and enterprise roles are scheduled and decided in ServiceNow, so reviewers stay in your ServiceNow portal. A take-away decision goes back to Saviynt down the same path as a removal, and the evidence pack keeps its own copy of every row. User access reviews
Questions about Saviynt
Does Warde replace Saviynt?
No. Saviynt holds the role model, the rules and the connections to your applications, and it provisions. Warde puts the request, the approval and the review in ServiceNow.
Do I still need Saviynt’s ServiceNow app?
Not for access requests. Keep Saviynt’s ServiceNow connector if Saviynt governs who holds roles inside ServiceNow itself.
Does Warde create accounts in Saviynt?
No. Access is asked for on an account the person already holds, and the requester picks which one on the form.
Does it need IntegrationHub or a MID Server?
No IntegrationHub and no paid ServiceNow subscription. Saviynt is reached from your instance, outbound only, on credentials you hold. A MID Server is needed only if your instance cannot reach Saviynt directly.
More of Warde
Bring the Saviynt request your users wait longest for.
Forty-five minutes on a live instance, connected to Saviynt, with no slides.
Warde is priced per user. Book a walkthrough or get in touch for a quote.