Managing Users with multiple instances in sys_user table

[tomdickson2]

We have a requirement to record every employee’s Active Directory account in ServiceNow (sourced from Entra ID and/or on-prem AD). This is to support offboarding (ensuring all accounts are disabled/deleted) and to manage access extensions for accounts approaching or past expiry.

For some users, this results in multiple accounts being created in the sys_user table, for example:

• SmithJ (Standard account)
• SmithJ50 (Privileged account)
• SmithJ90 (Domain Admin account)

Each of these is currently created as a separate sys_user record.

This leads to multiple entries for the same person appearing in reference fields and catalogue variables, making it unclear which user record should be selected. While I could update reference qualifiers across catalogue items to filter by account type, we have 100+ items so this isn’t practical to maintain.

Ideally, I’d like to model this as:

• A single “person” / primary profile
• With one or more linked accounts (child records)
• Clean selection in forms (one person, not multiple accounts)

Not all users have multiple accounts, some records may only represent non-standard accounts (e.g. service accounts, vendor accounts). Data is typically sourced automatically via import/integration (not manually maintained)

Has anyone implemented a solution for managing multiple AD accounts per individual in ServiceNow without needing to retrofit all catalogue items?
Examples I’m particularly interested in:

• Leveraging existing tables
• Parent/child structure

Appreciate any guidance or real-world approaches.

We are on Yokohama with ITSM Pro, moving to Zurich in May 2026. We do not have HRSD. 

[Laveena-Agarwal]

Hi @tomdickson2 

I have a few questions:

1. What is the purpose of using accounts other than the primary account? Could you share some use cases?
2. Which type of account is considered the “primary” account?

[tomdickson2]

Hi @Laveena-Agarwal 

1. What is the purpose of using accounts other than the primary account? Could you share some use cases?
   - A user could request to have their non-primary account deactivated\deleted if no longer required, so being able to select the account name would be better than free text
   - A user could request to have the account expiry extended
   - Service Desk, when offboarding a user, will know what accounts the user has to deactivate.
2. Which type of account is considered the “primary” account?
   - In the example about, the "primary" is the SmithJ account.

[Laveena-Agarwal]

Hi @tomdickson2 

I have few more questions:-

Are requests restricted to users associated with the primary account via the portal, or can users from associated accounts (Privileged and Domain Admin) also submit them?

Additionally, should these associated account users have login access to perform tasks in ServiceNow?

Also please explain this usecase -  A user could request to have the account expiry extended

[tomdickson2]

The intent is that once primary and secondary accounts exist, users should remain using their primary account as the logged in user of Service Portal to raise requests, and anyone with the itil role would only have that role on their primary account to perform tasks. 
Privileged accounts have a 12 month expiry, so a request would need to be raised to extend the account expiry when the 12 months is almost up (or has expired)