Handling "mirroring" user access with another user

[Mike49]

Hi Community,

I'd like to know how others have developed the following use case:

A manager requests a user to have access to ServiceNow and wants the user's access to mirror another user on the team.  For each group, there needs to be an approval from the group's manager per Compliance.

The current process is that a manager selects a catalog item, selects an option called "Describe the user access" and in the textbox, says something like "This user joined my team and needs access like Joe Blow".

My current manager believes "mirroring" is not best practice. 

[Brian Lancaster]

We use groups to give access. The group provide the roles so all members of that group have the same roles. So I have 1 catalog item that automatically add/removes user from the group. It has 3 variables. 

Request type: dropdown with options Add user or Remove user

Group: reference to groups

User: reference to users

I also have a script include the based on the request type and group it will do the following.

If add user it will filter out all members of the group and only return users who are not members of the group to be selected in the users. It does the opposite if you want to remove users and only returns member of the group.

The workflow then requires Manger approval and group manager approval if they are not the same.