Can an inactive user SEND and OUTBOUND email?

[Community Alums]

Hi all. There's plenty of threads here asking if inactive users can receive emails (which is not a bad thing).

But so far, I haven't seen anyone ask/answer if inactive users can somehow send outbound emails.

I'm sure the answer is obvious (no), but is there anything official backing it up?

[Anish Reghu · Accepted solution]

Hi @Community Alums,

NOTE - Emails can appear to come from inactive users if their sys_user record is used as the "From" or "Reply-To" address manually or by script.

There is no no explicit "Inactive users can't send emails" statement in the ServiceNow product documentation, but behavior is governed by these principles:

Email Sending is System-Driven

Outbound emails are initiated by the system via:

• Notifications

• Email Scripts

• Scripted Triggers

• Workflow/Flow Designer

• Outbound REST/API calls

So, the user record itself does not send out the emails. Instead, it might be referenced as the sender, recipient, or email reply-to name. 

“Notifications are triggered by record changes and system events… The system sends an email using the default system address unless overridden by configuration.”

- Product documentation

While emails being sent to inactive users can be skipped by the system (in this case ServiceNow), but emails triggered by inactive users is something uncommon, because Inactive users can’t log in, trigger flows, or perform actions. So: emails can technically be sent “on behalf of” or “from” inactive users — but those users are not actively sending them.

While using it in the scripts, validations like these are always useful to help you avoid inactive users being in the To field or the Sender field.

if (user.active) {
  template.from = user.email;
}

Regards,
Anish Reghu

Please mark my answer as Correct, if it resolves your query

Or Helpful, if it helped you in any way.

[Community Alums]

Hi Anish,

Yeah, this makes sense. Inactive users may be referenced in something that triggers a notification, but even those often have the system's email address as the sender. As you said, it's going to be uncommon.

After I made this post, I also considered if someone who has an inactive [sys_user] record in SN but still has an active email address (e.g. Outlook) could send an email to the SN instance. They probably can, since now we're talking about something outside of ServiceNow. If SN doesn't handle those OOB, I could probably make an inbound action that checks if the sender's email address is found in an active [sys_user] record.

⬆️ Let me know if this makes sense.