Deny internal access to explicit external roles \[Updated in Security Center 1.3 and 1.5\]

reference australia Updated Sep 10, 2026 1 min read sc-enable-explicit-roles-internal-denylist.md

Use system properties to determine whether external users can be assigned the snc_internal role.

Use the glide.security.explicit_roles.enable_internal_user_blacklist system property to prevent external users from being assigned the snc_internal role. When this property is set to true, it enforces the parameters of the maint-protected glide.security.explicit_roles.internal_user_blacklist property. This property assigns the snc_external role to a list of untrusted user classes. If glide.security.explicit_roles.enable_internal_user_blacklist is set to false, the glide.security.explicit_roles.internal_user_blacklist property is ignored.

Note: Instances without Explicit Roles installed are not affected. As of the Paris release, new installations of Explicit Roles get the property with a default value of true.

More information

Attribute	Description
Configuration name	glide.security.explicit_roles.enable_internal_user_blacklist
Configuration type	System Properties (/sys_properties_list.do)
Data type	Boolean
Recommended value	true
Default value	true
Fallback value	false
Category	Session management
Security risk	Severity score: 5.4 CVSS score: Medium Misconfiguration of this property increases the risk that an external user account gains access to internal information.
Dependencies and prerequisites	None

**Parent Topic:**[Access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-access-control.md)

110 lines · 2.9 KB Wrap lines

---
title: Deny internal access to explicit external roles \[Updated in Security Center 1.3 and 1.5\]
description: Use system properties to determine whether external users can be assigned the snc\_internal role.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/instance-security-hardening-settings/sc-enable-explicit-roles-internal-denylist.html
release: australia
product: Instance Security Hardening Settings
classification: instance-security-hardening-settings
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Access control, Hardening settings, Platform Security]
---

# Deny internal access to explicit external roles \[Updated in Security Center 1.3 and 1.5\]

Use system properties to determine whether external users can be assigned the snc\_internal role.

Use the **glide.security.explicit\_roles.enable\_internal\_user\_blacklist** system property to prevent external users from being assigned the **snc\_internal** role. When this property is set to **true**, it enforces the parameters of the maint-protected **glide.security.explicit\_roles.internal\_user\_blacklist** property. This property assigns the **snc\_external** role to a list of untrusted user classes. If **glide.security.explicit\_roles.enable\_internal\_user\_blacklist** is set to **false**, the **glide.security.explicit\_roles.internal\_user\_blacklist** property is ignored.

**Note:** Instances without Explicit Roles installed are not affected. As of the Paris release, new installations of Explicit Roles get the property with a default value of true.

## More information

<table id="table_ajc_b43_3kb"><thead><tr><th>

Attribute

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Configuration name

</td><td>

**glide.security.explicit\_roles.enable\_internal\_user\_blacklist**

</td></tr><tr><td>

Configuration type

</td><td>

System Properties \(/sys\_properties\_list.do\)

</td></tr><tr><td>

Data type

</td><td>

Boolean

</td></tr><tr><td>

Recommended value

</td><td>

true

</td></tr><tr><td>

Default value

</td><td>

true

</td></tr><tr><td>

Fallback value

</td><td>

false

</td></tr><tr><td>

Category

</td><td>

[Session management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-session-management.md)

</td></tr><tr><td>

Security risk

</td><td>

-   Severity score: 5.4
-   CVSS score: Medium
-   Misconfiguration of this property increases the risk that an external user account gains access to internal information.

</td></tr><tr><td>

Dependencies and prerequisites

</td><td>

None

</td></tr></tbody>
</table>**Parent Topic:**[Access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-access-control.md)