User Administration

Applications you install on your instance may include additional roles. Follow the links in this section to see roles installed along with applications.

Changes to user roles are tracked in the Audit Roles [sys_audit_role] table.

Administrators can control access to features and capabilities on a ServiceNow instance by assigning roles to users.

Use the Type field to define categories of groups. Once defined, you can use these categories to filter assignment groups based on the group type using a reference qualifier.

Administrators can grant users the ability to assign roles within groups. However, these users can only assign roles that they already have.

Administrators are able to impersonate other authenticated users, a feature primarily used for testing.

Impersonations are logged in the system log.

The ServiceNow AI Platform provides the ability to view and terminate individual user sessions, lock out users from the system, and make users inactive.

The Non-Interactive Sessions plugin creates a distinction between interactive and non-interactive users.

You can change a normalized company name several different ways. In all cases, that change affects all normalized fields referring to that company.

The Normalization Data Services plugin helps maintain consistency for table fields that refer to a company name.

The read-only role (snc_read_only) restricts a user or a group of users to read-only access on the tables to which the user already has access.

Manage the individuals who can access your instance by defining them as users in the system. Create user groups and assign users to them. Use roles to specify what different users and user groups can see and do.

The User Registration Request [com.snc.user_registration] plugin provides the ability for unregistered users to request access to a ServiceNow instance. An administrator can activate the plugin.

If you're a role delegator, you can delegate roles that are assigned to you for groups that you manage.

You can create records with duplicate company names in extension tables, such as Customer Account [customer_account] table, without causing normalization conflicts in Normalization Data Services.

User administration controls who can access features and data on your instance by managing users, groups, and roles.

User impersonation auditing creates a structured, dedicated audit trail for every impersonation session.

You can implement Normalization Data Services using a guided setup.

Before users can impersonate another user, an administrator must make the feature visible.

Administrators can assign one or more base system user roles to grant access to base system platform features and applications.

The Normalization Data Services plugin stores the normalized company names in the Normalized Company Names table.

The Normalized Mappings table lists all the discovered names and the normalized name to which each maps.

On the normalization properties form, you can see and change the configurable properties for the Normalization Data Services plugin.

Certain roles grant specific administrative rights without the full privileges of the admin role. For example, an administrator can grant a user the right to change UI policy but not client scripts.

Use this filterable table to review a complete list of roles used in ServiceNow instances. The table includes important details for all base system roles as well as any roles added by installed plugins.

You can add companies that represent vendors, manufacturers, or customers with whom you do business. These companies provide a way to categorize users, groups, and assets.

Departments provide another way to categorize users, groups, and assets. You can add departments and assign them to users.

When you add a new role to an existing role for a user, the user inherits the access that is granted by the new role.

Add a user to a group so that the user inherits all the roles assigned to the group.

A user inherits roles from all groups to which they belong. You can also assign roles directly to a user. Whenever a user is assigned a new role, it only takes effect after logging in with a new session.

You can assign a role to a group to grant access to applications and modules to group members.

Create groups and assign roles to them. Users assigned to the group inherit the roles.

Create a group role to control access to features and capabilities in applications for all members in a group.

Create a role to control access to features and capabilities in applications and modules. The new role doesn’t have access to any application or module until you add other roles to it, or add it to the appropriate applications and modules.

You can add a user to your instance to enable them to log in and use designated application features.

Roles control access to features and capabilities in applications and modules. You add a role to an application or module to enable the role to grant access to the application or module for all users with the role.

You can select a user or enter a different user name to perform an impersonation.

You can prevent roles from being delegated to users.

Designate role delegators to assign roles to users who are in a particular group.

Time-limited roles give users the defined role during the defined time period.

Learn how to assign a role to a user temporarily. Use this feature if you have a user who needs to perform a one-time action that is normally outside their roles.

Admins can add users to one or more groups.

Administrators can create and configure roles that grant specific permissions, which govern what users and groups with that role can do.

Users are typically added through Lightweight Directory Access Protocol (LDAP) directory integrations. Admins can also manually add users to the instance, enable self-registration for new users, and impersonate users to ensure that they have the proper access privileges.

Learn about the tools available to administrators for monitoring users on their instance.

Learn about user records and their use within the ServiceNow AI Platform.

Create user records for the individuals who access your instance. Users can be assigned to groups with defined roles to determine what records and actions they can access.