Can login.do be disabled completely?Summary<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } No. There is currently no supported method to completely disable or remove the login.do endpoint. The login.do page is a core platform login endpoint and serves as a fallback authentication path. It may be needed for: Account recovery scenariosAuthentication troubleshootingAdministrative access during Identity Provider (IdP) outagesBreak-glass access procedures For these reasons, ServiceNow recommends keeping the endpoint available. Why is login.do still accessible when SSO Auto-Redirect is enabled? → This is expected behavior. When SSO Auto-Redirect is enabled: Users navigating to the instance normally are automatically redirected to the configured Identity Provider.Users typically do not see the standard login form.However, if a user manually enters a URL such as: https://instance.service-now.com/login.do, the login.do page remains accessible by design. Can access to login.do be restricted? Yes! While the page itself cannot be fully disabled, customers can restrict or control authentication through the page. Available options include: 1: Use SSO Auto-Redirect (Recommended): SSO Auto-Redirect provides the best user experience by sending users directly to the Identity Provider without presenting the local login form. → How to configure SSO Auto-Redirect: Navigate to Multi-Provider SSO > Identity Providers.Open the desired Identity Provider record.Enable the Auto Redirect IdP option.Test in a non-production environment before deploying to production. 2: Restrict Authentication Using Adaptive Authentication 3. Although certain customizations may be technically possible, they are not recommended. Some customers consider: Making the login page non-public.Overriding the default login behavior.Redirecting login.do to another page. FAQs Does enabling SSO Auto-Redirect disable login.do? No. Auto-Redirect changes the default authentication experience but does not disable the login.do endpoint. Can I prevent users from seeing the local login form? For normal access, SSO Auto-Redirect can prevent users from seeing the local login form. However, users who directly browse to login.do may still reach the endpoint. Can I use side_door.do instead of login.do? Side Door functionality can be used for break-glass access, but it does not replace or disable login.do Does ServiceNow recommend disabling login.do? No. ServiceNow recommends keeping login.do available to preserve account recovery, troubleshooting, and emergency access capabilities.