Part 1 covered AI and identity governance. This part covers the Brazil changes you'll actually feel in production: data leaving the instance, Change and Incident behaviour, environments, and what to check before upgrading. Each section gives the facts, the settings, and a short checklist.

 

1. Data leaving your instance

Brazil gives you more ways to move data out of ServiceNow. Each one needs an owner and a scope.

Log Export Service (LES)

How it works

• LES streams system and application logs in near real time to tools such as Splunk or your own Kafka platform, with no integration scripts.
• It runs on the Hermes Messaging Service , ServiceNow's multi-tenant data transport built on Apache Kafka.

• Two ways to receive logs:

  • a dedicated MID Server that pulls from Hermes and pushes to your log tool over REST; or
  • your own Kafka system pulling directly using the native Kafka protocol (Splunk Connect for Kafka is supported).

• syslog and sys_audit are configured automatically as default log sources when the plugin is activated.

• A one-click connectivity test for the MID Server to the Kafka cluster is available from the UI, along with published MID Server sizing guidelines.

Licensing and roles

Item

|

Detail

Base allowance

|

Up to 500 GB per month

|
|

Above 500 GB

|

Add the Log Export Service Additional SKU (1,000 GB/month blocks)

|
|

With ServiceNow Vault

|

No usage limit

|
|

Delegated admin

|

sn_logstoanalytics.admin, so LES can be run without full admin

|

 

Checklist

1. Estimate monthly log volume against the 500 GB baseline before you enable extra sources.
2. Use a dedicated MID Server for LES; don't share it with Discovery or integrations.
3. Kafka consumers: configure consumer processes with separate bootstrap addresses for both Hermes Kafka clusters so failover works.
4. Add a clone step: check LES consumer records after cloning an instance that has a MID Server configuration.
5. Agree with security which log sources contain sensitive data before you export them.

 

Live Connect (formerly SQL API)

• Gives read-only SQL access through ODBC and JDBC drivers, so BI tools such as Power BI, Tableau and Pyramid Analytics can query tables directly without a sync job.
• Your existing security controls still apply. Access is set up per user account (service or personal), and OAuth authentication is supported, including for FedRAMP-compliant connections.

Checklist

1. Use dedicated service accounts per BI tool, not personal accounts.
2. Grant table access from an approved list; HR, security and financial tables need explicit sign-off.
3. Prefer OAuth over stored passwords in BI connections.

 

Encryption

• Cloud Encryption supports ServiceNow-managed keys or bring your own key (BYOK). It requires the Platform Encryption bundle, which also includes Field Encryption Enterprise.
• It is available in the ServiceNow Commercial Cloud, Government Customer Cloud pod 101, and ServiceNow Protected Platform – Australia, on MariaDB and RaptorDB instances.
• Vault Suite (Australia) installs all paid Vault capabilities in one package: Vault Console, Field Encryption, Zero Trust Access, Log Export Service, Code Signing Enterprise and Cloud Encryption.

 

2. Change and Incident behaviour

Change lockdown conflict detection

• Change lockdown lets change managers pause all, or a subset of, in-flight change requests.
• New in Brazil: any change request whose schedule overlaps an active lockdown is flagged automatically as an Inside Change Lockdown conflict and placed on hold. Rescheduling it outside the lockdown window clears the conflict so it can continue.
• Related Australia change: a change request can be excluded from conflict detection by setting Exclude from conflict detection to true. Configuration of Change properties uses the granular sn_change_admin role.
• Brazil also adds Downtime and Long Rollback as change risk conditions, and enhancements to Scaled and Major Change. Check the Change release notes for the configuration details.

 

Test cases to run in sub-production

|

Scenario

|

Expected result

1

|

Normal change scheduled inside an active lockdown

|

Flagged Inside Change Lockdown, set to on hold

|
|

2

|

Same change rescheduled outside the window

|

Conflict cleared, processing continues

|
|

3

|

Change with Exclude from conflict detection = true, inside a lockdown

|

Confirm whether it is still caught by the lockdown check, then document your policy

|
|

4

|

Emergency change during a lockdown

|

Confirm the behaviour matches your emergency-change policy

|
|

5

|

Lockdown applied to a subset (e.g. one CI class or service)

|

Only matching changes are flagged

|

 

Checklist

1. Decide who can create a lockdown, and for which scope.
2. Update the CAB process: changes on hold because of a lockdown need an owner to reschedule them.
3. Add a report or dashboard for changes currently on hold due to a lockdown.

 

Incident: awaiting-caller timers in business days

• When an incident is put On Hold – Awaiting Caller Information , the caller is sent a set number of reminders ("strikes") at set intervals. The intervals are counted in business days.
• If the caller still doesn't respond after the last attempt, the incident is auto-resolved with the resolution code Resolved – No response from caller and a resolution note explaining why.
• The wait between attempts is set by com.snc.incident.strike.wait_period (default: 1 business day). A separate property sets the number of attempts.
• Brazil also moves Auto-Close of resolved incidents to business days, so incidents don't close over a weekend.

Checklist

1. Check which schedule your instance treats as business days, especially across regions and holidays.
2. Choose the number of attempts and wait period with the service desk lead, not just the platform team.
3. Update notification templates so the caller knows the incident will auto-resolve.
4. Report on Resolved – No response from caller to spot groups using the on-hold state to manage SLAs.

Service Operations Workspace

• Brazil auto-installs Service Operations Workspace where entitlements allow, and shows Attached Knowledge by default when knowledge is linked to an incident. Check your landing page and agent experience after the upgrade so agents aren't surprised.

 

3. Environments

Developer Sandboxes

• Pooling (new): sandboxes are pre-created, so developers claim one instantly instead of waiting for provisioning. Update set sources between sandbox and base instance are configured automatically.
• The pool refreshes every 24 hours, so a claimed sandbox can be behind its base instance. Developers should check versions before starting.
• Sandbox URLs are random and no longer match the display name. Update any scripts or bookmarks.
• Removed in Brazil: data generation profiles and templates. Replace them if your test data depended on them.
• Licensing: Developer Sandboxes is an entitled product, installed through your account manager.

 

Clone Admin Console

• All clone functions sit under the Clone Admin Console menu, and legacy clone requests from lists and forms are no longer supported. (Australia)
• You can submit another clone to a target that already has one scheduled, as long as they are at least 7 days apart. A clone summary highlights clones on the same target in the next 30 days.
• Clone targets authenticate with OAuth 2.0 (see Part 1). Re-authorise expired tokens before scheduled clones run.

 

4. Upgrade readiness

Key facts

Item

|

Detail

Target patches to upgrade from

|

Australia Patch 5a, Zurich Patch 12

|
|

AI Risk and Compliance

|

Upgrade sequentially through each version; don't skip

|
|

Service Creator (com.glide.service_creator)

|

Reported as deprecated in Brazil with no named replacement. Check usage and the Changes to plugins list in your release notes.

|
|

Developer Sandboxes

|

Data generation profiles and templates removed

|
|

Approval rules

|

Classic approval rules are replaced by the Workflow Studio Ask for Approval action

|
|

Build Agent

|

Trial active by default; requires admin role (see the developer posts)

|

 

Use the release notes tooling

 

Brazil's curated release notes give you, per upgrade path:

• highlights;
• features and changes by product, already combined for cross-family upgrades (for example Zurich to Brazil);
• changes to plugins;
• personalised PRB release notes;
• available patches and hotfixes;
• browser support and accessibility notes.

Use the Combined release notes for upgrades from Zurich to Brazil pages if you are skipping Australia.

Pre-upgrade test plan

1. Run the instance scan and review skipped records from your last upgrade.
2. Check every Store app for Brazil compatibility.
3. Search for Service Creator usage and any other deprecated plugins listed for your path.
4. Regression-test approvals, Change (including the lockdown cases above) and incident on-hold behaviour.
5. Re-test integrations that use Basic Auth, certificates or MID Servers.
6. Confirm entitlements for anything newly auto-installed (for example Service Operations Workspace).
7. Brief agents and approvers on visible changes before go-live.

Quick checklist

• LES volume estimated against 500 GB/month; dedicated MID Server or dual-cluster Kafka consumers set up
• Live Connect limited to service accounts and an approved table list
• Encryption bundle and key ownership (ServiceNow-managed or BYOK) confirmed
• Lockdown test cases 1–5 passed in sub-production
• Awaiting-caller attempts, wait period and business-day schedule agreed with the service desk
• Sandbox users briefed on the 24-hour pool refresh and random URLs
• Clone runbook covers OAuth re-authorisation and the 7-day rule
• Deprecated plugins (including Service Creator) checked for your upgrade path
• Store app compatibility and entitlements confirmed

Part 1 covered Intelligent Approvals, AI Control Tower, MCP Server Console and non-human identities.

 

Sources

• Exploring Log Export Service
• Log Export Service actions and required roles
• Log Export Service (ServiceNow Store)
• Live Connect release notes (Brazil)
• Cloud Encryption with Key Management (Brazil)
• ServiceNow Vault release notes (Australia)
• Combined Change Management release notes, Zurich to Brazil
• Change Management release notes (Australia)
• Resolve and close an incident (Brazil)
• Developer Sandboxes release notes
• Instance Clone (Brazil)
• Brazil available versions
• Using the release notes (Brazil)