CSDM Alignment - Business and Technology Management Services not selectable from incident

[ahbrook]

Hello everyone! I feel like I'm missing something obvious in terms of ServiceNow usage, so feel free to point me in the right direction. I wanted to ask here before opening a support request with ServiceNow directly.

I am working on an architectural model for my institution, and am trying to follow CSDM v5. To demonstrate how I understand things will work, I wanted to show how the business services and technology management services could be used in ITSM incident creation and service requests. I wanted to do this by using my personal development instance. 

However, when I went to try and test what a help desk user would be able to do, the system only displayed the demo services included in the PDI - and it reported that security constraints blocked my elements from being viewable. 

My question has 2 parts: 

1. Am I correct in assuming that help desk workers (or customers) would be able to select the business and technology management services when creating an incident, or is there some other mechanism that ties these services to the "Day to day" operations of ITSM?

2. Assuming I'm correct above, can anyone give me pointers on what I'm doing wrong to have the services visible?

Here is the steps I've taken, starting with a fresh personal development instance: 

• Requested a Zurich PDI
• Activated the "ITSM Roles" plugin without demo data (using the Manage instance interface)
• Logged in to PDI as admin
• Used the Application Management dashboard to install the following:
  • Digital Portfolio Management (product)
  • Service Portfolio Management (product)
  • CMDB And CSDM Data foundations Dashboards (plugin)
  • CMDB CI Class Models (application)
• Created and switched to a unique updat set (scope of global)
• Used the "Service Portfolios" view to create a unique service portfolio
• Created 8 nodes under the primary Service Portfolio
• Used the "Service Builder" application to create business services and technology management services
  • All of the services are owned by the "System Administrator" user, and other details are not filled out
  • Most of the services have service offerings under them
  • All services are listed as published
• Switched off of the update set (without completing it)
• Confirmed the admin user could see all business and technology management services when creating an incident
• Created a sample user
• Assigned the sample user to the pre-built "Help Desk" and "Service Desk" groups
• Assigned the role "itil" to the "Service Desk" group
• In a private browsing session, logged onto the sample user
• Accessed the Service Operations Workspace
• Created a new incident
• Attempted to select a non-demo business service or technology management service from the lookup tool and failed.

I should note that initially, I did not set any assignment groups, change groups, or management groups to any of the services or offerings I created. However, this does not seem to be affecting anything. I suspect I am missing some fundamental permission, but I am not sure where to look for that or what controls exactly how the "service" and "Service offering" lookups interact with the Service Builder.

[Mathew Hillyard · Accepted solution]

Hi @ahbrook 

The Incident form only requires the snc_internal role to view the Service field.

The Service Table has no explicit read ACLs OOTB. Therefore records on the parent cmdb_ci_service table will be visible.

However, the child Business Service and Technology Management Service tables have read ACLs that require the service_viewer role and this is indeed not inherited by itil.

I have confirmed this on a vanilla Zurich PDI - itil users cannot see any Business Service and Technology Management Service records.

So you must either add the service_viewer role to the itil role or (depending on who needs access) add a table read ACL for these tables granting the necessary role(s).

@AndersBGS there is no Technical Service field in the baseline platform so your screenshot looks like it is from a customised instance.

I hope this helps!

Mat

[ahbrook]

Thanks Mat! 

I did some playing and came to the same kind of conclusions. Given the CSDM realignment, I'm not entirely sure why business and technology management services require a specific role to view, but I also can't find any documentation on best practices on granting or revoking that permission, so I think it will be fine to do so.

I also went through the labs that @Vijaya_Mnpram referenced, and it appears they are more demonstrative of the process than implementation. They walk you through the steps of how to create the baseline objects, and showing how they relate to each other, but they do not talk about setup. In fact, the entire time you appear to be running as the built in admin account, which can see those tables just fine. It almost implies that if a user has a CI or dynamic CI group that is associated with the service or service offering, then the option will be available. That's fine for the supporting teams, but our help desk is not associated with any particular system or service. 

This may be a point of confusion with the rollout of CSDM that ServiceNow needs to address. After making this thread, I found another one made recently that is essentially asking the same thing:

https://www.servicenow.com/community/creator-studio-forum/what-is-the-role-quot-service-viewer-quot/...

An older thread indicates this change may have happened around the New York release.

https://www.servicenow.com/community/upgrades-and-patching-forum/service-viewer-role-is-preventing-n...

It, in turn, references a KB article that I cannot access, but there is another one talking about how some ACL development might be needed in order to allow proper access. I'm not sure if this KB is referring to ServiceNow or customer/vendor customization. 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0997137

Long story short... I do not know what kind of information one can access with the "service_viewer" role, but at the moment it seems fine to give this to our support staff and folks that will be making service requests and incidents. 

[Mathew Hillyard]

Hi @ahbrook 

Actually you can work out what users with the service_viewer role has access to quite easily from the Access Role [sys_security_acl_role] table. The role inherits the cmdb_read role. If you append this URL to your instance you should see all the ACLs that reference this role: sys_security_acl_role_list.do?sysparm_query=sys_user_role.name%3Dservice_viewer%5EORsys_user_role.name%3Dcmdb_read&sysparm_first_row=1&sysparm_view=

In summary, I can't see any obvious red flags regarding table access - Services, Offerings, CI Relationships, CIs, Service Portfolio Taxonomy etc. - basically anything that is likely to reference a service object.

I hope this helps!
Mat

[Damhoej]

A support agent works out of Business Service Offerings. The offerings are the crucial record to populate.
The Business Service Offering should be in a language that the caller can relate to.
The classic example is a caller reports that outlook does not work. 
The agent select "outlook" as the Business Service Offering (the OOB filter is set to BSO) and the support group in that offering show the Exchange Management group.

Servicenow will automatically populate "assignment group" with Exchange Management group.
In that way we do not need to teach the agent that outlook is delivered by exchange, and the BSO is in a language that caller relates to.
Using Service Builder will help you to make the correct relationship to different part of the CMDB and other vital functions.
So in the "CSDM" approach we focus on offerings instead of services. A service is "just" a collection of offerings. The offerings have all the information and is basically a record that contains:

- What will be delivered  (what is sold)

- Who is going to do it (who will deliver)

- How fast will it be delivered (SLA/OLA/Quality)

- How much will it cost (and who will pay)