Hi Everyone,
I wanted to share a finding regarding the system property sn_itam_restrict_asset_read and get feedback from others who are managing recent platform upgrades/installations.
According to the ServiceNow documentation, the property sn_itam_restrict_asset_read is intended to default to false so that baseline read visibility for snc_internal users on alm_asset isn't disrupted unexpectedly.
However, upon checking the audit history on an instance upgraded to Australia, this system property actually initialized at creation (Update Number 0 by System) to true.
When true, users holding only the snc_internal role are immediately restricted to seeing only asset records where they are explicitly referenced (e.g., Assigned to, Reserved for, Managed by, Owned by).
-
Fresh Installs vs. Upgrades: Is anyone else seeing true as the hardcoded default on fresh family instances vs. upgrades from previous releases?
-
Platform Strategy: Is ServiceNow shifting toward a strict "secure by default" posture for ITAM tables out-of-the-box, making the documentation outdated, or is this an unintended initial dictionary value?
-
Workflow Impacts: Has anyone experienced broken catalog items or portal scripts due to this property defaulting to true unexpectedly after a fresh deployment?
Curious if others have logged HI/Support cases on this discrepancy or if setting it manually back to false is the standard workaround you're applying during initial instance provisioning.
Thanks!
