[ACC] Additional information about Gateway URL for Agent Client Collector with Mid-less (ICS) architectureSummary<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Agent Client Collector (ACC) in Mid-less (ICS) mode must connect to the gateway associated with the instance rather than the gateway that is geographically closest to the Agent itself. Administrators may observe that agents installed with an AMER or APAC gateway url automatically switch to an EMEA gateway url after registration , or vice versa This article explains why this behavior occurs, how to verify the correct gateway for your instance, and how to repoint agents to the correct endpoint if configured incorrectly. Facts<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Fact 1 — Gateway url must match the Instance Region, not the agent location The ICS (ITOM Cloud Services) gateway backend-url in acc.yml must align with the region where the ServiceNow instance is hosted — not where the physical agent machine resides. Routing agent data through a gateway in the wrong region causes connection failures and data collection timeouts. Region ICS Gateway URL AMER https://itomcnc-prod-gateway.amer.sncapps.service-now.com EMEA https://itomcnc-prod-gateway.emea.sncapps.service-now.com APAC https://itomcnc-prod-gateway.apac.sncapps.service-now.com Fact 2 — Installation Gateway url Is Bootstrap-Only The gateway URL specified during silent installation (via ACC_CNC parameter or the acc gateway ics command) is used only to bootstrap the agent and complete initial registration with the ServiceNow instance. Once registration is complete: The agent updates gateway URL to the correct gateway for the instance.The agent registration process overwrites acc.yml, including the backend-url, with the instance-authoritative gateway.This is expected, designed behavior. Fact 3 — ACC does not auto-switch gateway based on physical machine location The ACC agent does not detect or use the geographic location of the endpoint to choose a gateway. The instance's system property "sn_itom_cloud_svc.itomgateway_url" is the authoritative setting that controls where agents are directed post-registration. Fact 4 — Proxies that perform SSL inspection break mTLS Please also note that MID-less ACC agents use mutual TLS (mTLS) for secure communication. Any corporate proxy performing SSL inspection will intercept and break this connection. Always bypass SSL inspection for the following domains: .service-now.com.sncapps.service-now.com Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ALL Instructions<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Follow below instructions for setting up right Gateway URL for the Agents. Step 1 — Verify Your Instance's Region and Gateway URL ICS Diagnostics Page : Navigate to ICS Configuration under ITOM Cloud Services > Diagnostics on your instance.Locate the property sn_itom_cloud_svc.itomgateway_url.The value shown is the authoritative gateway URL your agents must use.=> You should see property value like in attached screenshot below Alternatively, search for this system property on your instance : sn_itom_cloud_svc.itomgateway_url. This value confirms the instance's datacenter region. Step 2 - Configure gateway during agent installation : Configure mid-less agent Step 3 - Re-configure existing agents to change gateway settings : If any agent, is configured to use the wrong gateway or if an agent is connected to a mid but must be reconfigured to use a gateway, use the following method. Stop the agent service, run the below command, then re-start the service. For an existing Agent that does not have correct Gateway or to re-configure , run the following command on each affected Windows endpoint to update acc.yml with the correct backend-url: "C:\Program Files\ServiceNow\agent-client-collector\bin\acc.exe" gateway ics -instance-url "https://<instance_name>.service-now.com" -registration-key "YOUR_KEY" -backend-url "https://<gateway_name>.service-now.com" =>Replace the backend-url value with the correct regional gateway URL identified in Step 1. => this command updates backend-url to the regional ICS gateway, sets connect-without-mid: true, adds instance-url/registration-key, removes MID-only settings, and enforces TLS Step 3 — Validate Configuration Post-Change Open acc.yml and confirm backend-url matches the correct regional gateway.Confirm connect-without-mid: true is set.Confirm registration-key is empty/null (expected after successful registration — certificates are stored in agent cache). Step 4 — Validate Agent Connectivity Test outbound HTTPS (port 443) reachability from the endpoint using a powershell query : Test-NetConnection itomcnc-prod-gateway.<region>.sncapps.service-now.com -Port 443 Monitor the agent in ServiceNow (Agent Client Collectors list) for a stable Up status.Review agent logs (Grab Agent Log) and confirm the connected URL matches the expected gateway with no repeated disconnect/reconnect cycles.If data collection errors persist after repointing, gather full ACC debug logs (after restarting the ACC service) to debug further Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ICS Gateway URL guidance My IP Information / Instance Datacenter toolConfiguring MID-less Agent Client Collector