ServiceNow CPQ: User Access Control

---
title: ServiceNow CPQ: User Access Control
description: View access types, access areas, and user roles that can be managed via the User Access utility.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/order-management/logik\_admin\_user\_access\_control.html
release: australia
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [ServiceNow CPQ admin settings, ServiceNow CPQ with other apps, Integrate, Sales Customer Relationship Management]
---

# ServiceNow CPQ: User Access Control

View access types, access areas, and user roles that can be managed via the User Access utility.

**Note:** This feature must be enabled by support request. Create a support case by using the [ServiceNow Support portal](https://support.servicenow.com). For step-by-step instructions, see [Create a case on Now Support for CPQ Customers](https://support.servicenow.com/kb?sys_kb_id=d67d3e71475d7a90f64de825126d4326&id=kb_article_view).

Use the User Access utility to manage access to ServiceNow CPQ Admin. Admin users have full admin access unless their access level is modified via CSV import.

For basic user access in ServiceNow CPQ, see [User access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown).

## Access levels

-   NONE
-   READ
-   EDIT
-   ADMIN

## Access areas

-   END\_USER
-   CONFIG

    Users with ADMIN can use the Matrix Loader, including product filters and the catalog enrichment script MANAGED\_TABLES.

-   TRANSACTION

    Users with ADMIN can use the Matrix Loader.

-   MANAGED\_TABLES
-   TABLE

    Applies permissions for an individual table listed in addition to any MANAGED\_TABLES access level. Examples:

    -   EX: MANAGED\_TABLES: NONE + TABLE “myTable” Edit = ability to edit “myTable” only
    -   EX: MANAGED\_TABLES: READ + TABLE “myTable” Edit = ability to read all tables and edit "myTable"
-   DEPLOY
    -   Applies all blueprint, transaction, product catalog enrichment, and product filter deploys
    -   Roles are either NONE or ADMIN UTILITIES
-   UTILITIES
    -   Logs, user access, runtime clients, admin API keys, external connections, settings, webhooks, connections
    -   Products \(for Ecommerce tenants\)

## Tables

User access can be limited to specific tables via CSV or API.

**Note:** These are additive permissions with the overall tables permission set, so if the user has read access for all tables, the individual permission of NONE would have no effect.

## User roles

-   END\_USER: This is the only permission for the runtime
-   CONFIG\_NONE / CONFIG\_READ / CONFIG\_EDIT / CONFIG\_ADMIN
    -   READ correlates to GET endpoints
    -   EDIT additionally correlates to POST PUT PATCH DELETE endpoints
    -   ADMIN additionally correlates to Matrix Loader endpoints
-   TRANSACTION\_NONE / TRANSACTION\_READ / TRANSACTION\_EDIT / TRANSACTION\_ADMIN
    -   READ correlates to GET endpoints
    -   EDIT additionally correlates to POST PUT PATCH DELETE endpoints
    -   ADMIN additionally correlates to Matrix Loader endpoints
-   MANAGED\_TABLES\_NONE / MANAGED\_TABLES\_READ / MANAGED\_TABLES\_EDIT / MANAGED\_TABLES\_ADMIN
    -   READ correlates to GET endpoints
    -   EDIT additionally correlates to POST PUT PATCH DELETE endpoints
    -   ADMIN additionally correlates to Matrix Loader endpoints
-   DEPLOY\_NONE / DEPLOY\_ADMIN \(no EDIT or READ\): ADMIN everything deployment related, including Product Filter Rules and Product Catalog Enrichment Deployments
-   UTILITIES\_NONE / UTILITIES\_READ / UTILITIES\_ADMIN \(no EDIT\)
    -   READ correlates to GET endpoints
    -   ADMIN correlates to everything else

## Modifying access controls

Admin users can modify access via CSV upload \(Admin > Utilities > User Access\). The User Access list shows existing users.

\[Omitted image "cpq-user-access-control-list.png"\] Alt text: Admin: User Access Control

Steps:

1.  Hover a tooltip to view a userʼs access.

    \[Omitted image "cpq-user-access-control-list-tooltip.png"\] Alt text: Admin: User Access Control

2.  Create a CSV file to add users, make changes to users, or delete users. \(See below for sample CSV files.\)

    \[Omitted image "cpq-user-access-control-list-sample-csv.png"\] Alt text: Admin: User Access Control

3.  Import the CSV file.

    \[Omitted image "cpq-user-access-control-csv-import.png"\] Alt text: Admin: User Access Control

    You will receive a message confirming success or failure.

    \[Omitted image "cpq-user-access-control-csv-import-status.png"\] Alt text: Admin: User Access Control


Changes to user list are now made.

\[Omitted image "cpq-user-access-control-list-updated.png"\] Alt text: Admin: User Access Control

## Sample CSVs

Default all-access admin CSV:

```
name,userName,area,access,action
User,email@example.com,DEPLOY,ADMIN,
User,email@example.com,UTILITIES,ADMIN,
User,email@example.com,CONFIG,ADMIN,
User,email@example.com,TRANSACTION,ADMIN,
User,email@example.com,MANAGED_TABLES,ADMIN, 
```

Example complex-access CSV:

```
name,userName,area,access,action
User 1,user.one@example.com,DEPLOY,ADMIN
User 2,user.two@example.com,UTILITIES,ADMIN
User 2,user.two@example.com,CONFIG,ADMIN
User 2,user.two@example.com,TRANSACTION,ADMIN
User 3,user.three@example.com,END_USER,END_USER
User 4,user.four@example.com,END_USER,END_USER,DELETE
User 5,user.five@example.com,CONFIG,ADMIN
User 5,user.five@example.com,TRANSACTIONS,ADMIN
User 5,user.five@example.com,MANAGED_TABLES,READ
User 5,user.five@example.com,UTILITIES,ADMIN
User 5,user.five@example.com,DEPLOY,ADMIN
User 6,user.six@example.com,CONFIG,ADMIN 
```

CSV adding user to the table "sampleTable":

```
name,userName,area,access,variableName,action
John Smith,john.smith@example.com,CONFIG,ADMIN,,UPSERT
John Smith,john.smith@example.com,TRANSACTIONS,ADMIN,,UPSERT
John Smith,john.smith@example.com,TABLE,ADMIN,sampleTableName,UPSERT
Jane Doe,jane.doe@example.com,MANAGED_TABLES,READ,,DELETE
Jane Doe,jane.doe@example.com,UTILITIES,,NONE
```