ServiceNow Users Groups Roles

ServiceNow controls what every person can see and do through three connected concepts: Users, Groups, and Roles. Together, they form the access control system that keeps data secure and ensures each person has exactly the access they need — no more, no less.

Users

A user is one person with an account in ServiceNow. User records live in the sys_user table. Each user account stores details like name, email, username, password, department, manager, and active status.

User Record: John Smith
──────────────────────────────────────────────
Field            │ Value
──────────────────────────────────────────────
Name             │ John Smith
User name        │ john.smith
Email            │ john.smith@company.com
Department       │ Information Technology
Manager          │ Sarah Lee
Active           │ ✓ (checked = can log in)
──────────────────────────────────────────────

Active vs. Inactive Users

Setting a user's Active field to false (unchecked) immediately blocks that user from logging in. The user record stays in the system — preserving historical data and audit trails — but access is disabled. Administrators deactivate users when employees leave the company instead of deleting their records.

Groups

A group is a collection of users who share the same work responsibilities. The sys_user_group table stores all groups. Every IT team, HR team, and finance team has a corresponding group in ServiceNow.

Groups in a typical IT department:
──────────────────────────────────────────
Group Name          │ Members
──────────────────────────────────────────
IT Service Desk     │ 12 agents
Network Support     │ 5 engineers
Desktop Support     │ 8 technicians
Security Operations │ 4 analysts
Incident Managers   │ 2 managers
──────────────────────────────────────────

Why Use Groups Instead of Assigning Directly to Users?

Assigning tickets and permissions directly to users creates problems when staff changes. When an agent leaves, all their tickets lose context. Using groups, tickets stay assigned to the group. Any member of the group can pick up and work on them. Adding or removing a person from a group immediately changes their access without touching individual tickets or records.

Roles

A role grants a user or group specific permissions within ServiceNow. Roles control what a user can read, write, create, and delete across tables and modules. Roles are the foundation of ServiceNow's security model.

Common Built-in Roles

• admin: Full access to everything in the instance — all tables, modules, configuration, and scripts. Reserved for administrators only.
• itil: The standard role for IT service desk agents. Grants access to read and update incidents, problems, changes, and service requests.
• itil_admin: Extended ITSM access including configuration of ITSM modules.
• catalog: Access to browse and submit catalog items.
• report_user: Permission to create and run reports.
• snc_internal: Basic internal user access. Most employees who only submit requests have this role.

How Roles, Groups, and Users Connect

Role assigned to Group:
  ITIL Role → "IT Service Desk" Group
      │
      └── All members of IT Service Desk automatically get ITIL access:
           John Smith    ← inherits ITIL role from group
           Maria Garcia  ← inherits ITIL role from group
           Tom Chen      ← inherits ITIL role from group

Add a new agent to the group → they instantly get ITIL access
Remove an agent from the group → access removed immediately

Roles Can Also Be Assigned Directly to Users

Administrators assign roles directly to individual users when that person needs a permission that doesn't apply to their whole group. For example, one person in the Service Desk might need the report_admin role to manage shared reports — but not the entire team.

Role Inheritance

Roles can contain other roles. When one role includes another, the user gets the permissions of both. For example, the itil_admin role includes the itil role. Assigning itil_admin automatically grants itil permissions too. This hierarchy reduces duplication and makes permission management easier.

itil_admin role
  └── includes: itil role
       └── includes: catalog role
            └── includes: snc_internal role

Checking a User's Effective Roles

Administrators can see exactly what roles a user has by opening the user's record and scrolling to the Roles related list. This shows both directly assigned roles and roles inherited through group membership. The Effective Roles tab shows the complete combined list — the definitive source of what that user can do in the system.

Group Managers

Every group has a manager field that points to one user. The group manager often receives escalation notifications, approval requests, and management reports for the group. Defining group managers inside ServiceNow makes automated notifications meaningful — the right person gets alerted without manual configuration for each notification.