ServiceNow How-To: Send Physical Attachments via Email Without Login

ServiceNow How-To: Send Physical Attachments via Email Without Login

Most ServiceNow emails send links to attachments - but what if your recipients don’t have access to the platform? For one large government agency, that was exactly the problem during their HR onboarding process.

In this example we walk through a solution that injects physical file attachments into email notifications - without requiring login, cross-scope hacks, or extra manual steps.

Here’s a complete breakdown of the solution, use case, and code - aligned with the webinar’s structure.

Table of Contents

1. HR Onboarding Use Case
2. How We Can Send Attachments via Email
3. Why We Can’t Use Out-of-the-Box Options
4. How We Get Around the Roadblocks
5. Architecture
6. Q&A

1. HR Onboarding Use Case

A government agency needed to send onboarding documents(welcome letters, screening instructions, etc.) to new hires before they had access to ServiceNow.

Key constraints:

• No system access (so hyperlinks to attachments wouldn’t work)
• Scoped app (HR): Security and data protections must remain intact
• Physical attachments required: Must appear as files in the recipient’s inbox

2. How Can We Send Attachments via Email?

ServiceNow gives three approaches:

1. Include Attachments (OOTB)
       Checkbox on the notification record includes attachments from the     triggering record
   
2. Mail Script
       Pulls attachment and builds an HTML hyperlink into the body

3. Inject Attachment Before Processing (Custom/Chosen Solution)
       Inserts file into the sys_email record before it’s sent
   

3. Why the Out-of-the-Box Options Don’t Work

Option 1: Include Attachments Checkbox

• Only sends attachments on the triggering record
• Doesn’t work with external users or child workflows
• Risk: Accidental data exposure if unrelated attachments exist

Option 2: Mail Script

• Still creates a hyperlink—requires login
• Doesn’t work for pre-access onboarding
• Complex if attachments are on unrelated tables

4. Why Option 3 Works (Custom Injection)

• Physically attaches files to email (no hyperlinks)
• Preserves scoped app security (no cross-scope holes)
• Scalable to other tables/processes
• Doesn’t require user to log in
  

5. Technical Architecture

Two Main Components

1. Global Table (u_outbound_email_attachment)
    
   • Stores the file, description, and parm1/parm2
    
   • parm1: sys_id of the triggering record
    
   • parm2: Table name (optional, for scalability)
 
2. Business Rule on sys_email
   
    
   • Async
    
   • Triggered on insert
    
   • Attaches file before the email is sent
     

Code Sample (Business Rule Script)

javascript

CopyEdit

(function executeRule(current, previous) {

 var emailLog = new GlideRecord('sys_email_log');

 emailLog.get('email',current.sys_id);

 if (emailLog.event.name== 'sn_hr_le.notification_activity') {

   vargrOutboundEmail = new GlideRecord('u_outbound_email_attachment');

   grOutboundEmail.get('u_parm1',emailLog.event.parm2);

   if(grOutboundEmail.u_name) {

     var grSysAtt = newGlideRecord('sys_attachment');

     grSysAtt.get('table_sys_id',grOutboundEmail.sys_id);

     new GlideSysAttachment().copy(

       grSysAtt.getValue('table_name'),

       grSysAtt.getValue('table_sys_id'),

       current.getTableName(),

       current.sys_id

     );

   }

 }

})(current, previous);

6. Q&A Recap

Q: Can this be used with Incidents instead of HR?
A: Yes! Just create your own event trigger and pass the incident record details inparm1.

Q: Do I need to use a custom table?
A: No, but it centralizes control and keeps attachments off business records (like Incidents).

Q: Any other cool findings?
A: Flow Designer can be used to send physical attachments—but isn’t ideal for lifecycle events.

Final Thoughts

Our method for sending physical attachments through ServiceNow email is:

• Login-free
• Scoped-app safe
• Easy to maintain
• Scalable to other use cases

Whether you're onboarding new hires, supporting customers, or managing contracts, this approach ensures your users get what they need - without the headaches of platform access or clunky workarounds.

‍