一般のユーザーにuser, role, groupを操作できる権限を設定する方法

[shog]

はじめまして、

現在、特定なユーザーに対し、以下の操作を許可したいと考えております。

・User、Group、Roleの作成、削除

・GroupとUserへRoleの割り当て

自分で調べたところ、

・User、Group、Roleの作成、削除

　→adminロールが必要

・GroupとUserへRoleの割り当て

　→user_adminロールが必要

そこで2点質問があります。

1. 特定のユーザーにuser_adminロールを付与すべきでしょうか。

2. adminロールを付与せずに、上記の操作ができるような設定方法などありますでしょうか。

他にいい設定の仕方やデザインがございましたら助かります。

よろしくお願いいたします。

[Rafael Batistot]

Hi @shog 

Regarding your questions:

1. Assigning user_admin role:
   Yes, if you want specific users to be able to assign roles to Users and Groups, they will need the user_admin role. This is the standard approach in ServiceNow.
2. Allowing creation/deletion without admin:
   Unfortunately, creating or deleting Users, Groups, or Roles requires the admin role. There isn’t a supported way to allow these operations without admin, because these are sensitive actions that could affect the entire instance.

Recommendation:

• If you only want to allow role assignment, give them user_admin.
• For full management of Users, Groups, and Roles, you will need to assign admin.
• Alternatively, consider creating a custom role with limited access via ACLs if you want a more controlled approach, but this requires careful planning to avoid security risks.

[GlideFather]

Hi @shog,

usually the users are managed in some 3rd party system (LDAP, Workday, Google) and ServiceNow is "mirroring" this source by integration. However if you want to manage it in SN it's not impossible... 

Regarding the user_admin role, it strongly depends on each client's needs and requirements, there is no general or universal answer to this.

NOTE: be very careful about user and group deletion!

It's always better to deactivate user rather than to delete it. Imagine an incident where a User A is a caller and User B is assignee, then you delete both User A and User B, then the incident will display no value while the field will not be empty (it will still hold non-existing sys ID but with nothing to display)....

You can easily test this in PDI, create a user, assign it to incident, keep the incident open and delete this user in another tab and then go back to incident and refresh the window...

So it's a good practise to always deactivate users rather than to delete them.

[Ankur Bawiskar]

@shog 

Users are usually provisioned and brought via LDAP.

If you need to do user management then please give user_admin role to your group and ensure you add members to that group.

Those group members will inherit the role and will be able to perform the actions.

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Ankur Bawiskar]

@shog 

Thank you for marking my response as helpful.

As per new community feature you can mark multiple responses as correct.

If my response helped please mark it correct as well so that it benefits future readers.