Get a first look at what's coming. The Developer Passport Australia Release Preview kicks off March 12. Dive in! 

Event Management: Incident auto-assigned to previous engineer instead of only assignment group

nameisnani
Mega Sage

3 weeks ago

Hi Team,

 

We are observing unexpected assignment behavior when incidents are created from Azure Monitor alerts via Event Management.

 

🔹 Scenario

  • Alert Source: Azure Monitor

  • Alert creates incident via Alert Management Rule + Flow Designer subflow

  • Assignment group is set correctly

  • Incident is also auto-assigned to the engineer who handled a previous incident for the same CI

🔹 Expected Behavior

Incident should be assigned only to the assignment group, allowing the team to take ownership.

🔹 Actual Behavior

Incident is created with:

  • Assignment group → correct

  • Assigned to → previous engineer (system set at creation)

This gives the impression that the ticket bypassed the group.

🔹 What we verified

✔ Alert Management Rule does NOT set Assigned To
✔ Flow Designer subflow sets only Assignment Group
✔ CI has no owner or assigned user
✔ Alert record does not contain Assigned To
✔ Assignment is set by “System” at creation

🔹 Question

  1. What mechanism in Event Management can cause the incident to inherit the previous engineer?

  2. Can this be due to:

    • Incident Assignment Rules?

    • Event Management correlation behavior?

    • Historical CI routing logic?

  3. What is the recommended approach to ensure incidents are assigned only to the group?

🔹 Environment

  • ServiceNow Event Management

  • Azure Monitor integration

  • Incident created via Alert Management Rule + Flow Designer

🔹 Goal

Prevent auto-assignment to a specific engineer and route incidents to the assignment group only.

 

 

 

what needs to here - please help us - where we need to check - 

 

Thanks

0 Helpfuls
  • 963 Views
15 REPLIES 15

MortenPettersen
Tera Contributor

3 weeks ago

Greetings

Can you let us know if there are any trigger rules [trigger_rule] defined in your SN Instance, and if so, are there any that could match (get triggered) when this type of Incident gets created? Trigger Rule extends the Assignment Rule table with some extra functionality, as a part of On-Call Scheduling. Just nice to rule this out.

0 Helpfuls