Minimum role required for CI Class Manager

[suvro]

Hi,

We want some users to give access to  CI Class Manager, but we do not want them to give itil_admin role to them.

What is the minimum role we can give them so that they can create health rules using CI Class Manager.

Thanks a lot in advanced 

regards,

Chandra

[Nilesh Pol]

@suvro users with itil can view the CI Class Manager, they cannot save changes to health rules.

The sn_cmdb_admin role is designed specifically for CMDB administrators. It provides the necessary write access to the CI Class Manager and all related configuration tables (like cmdb_health_config) without granting elevated ITIL process rights (e.g., deleting incidents or changes) that itil_admin provides.

[suvro]

sn_cmdb_admin also giving errors with query_match ACLs (Part of the query on sys_db_object has been ignored because of insufficient access for 'query_match' operation on sys_db_object.name). I saw this do you know what this condition means

[meghanakra]

query_match condition in an ACL ensures that access is granted only if the record satisfies a defined query condition. Even if a user has the required role like sn_cmdb_admin, access will be denied if the record does not meet the query criteria defined in the ACL. you can check the specific ACL

[SD_Akshay]

Hi,

There is no known workaround for this, as you can see the below article is still not resolved, maybe you can reply and ask what they did, or you can think of creating custom role but that too will require elevated write permissions.

https://www.servicenow.com/community/cmdb-forum/access-to-ci-class-manager-to-create-orphan-stalenes...