How to create a report on all the individual users in the system currently holding roles?

[The Matrix]

Hi All,

How do I create a Dashboard Report on the detailed audit trail of user roles, including the role ID assigned to each user, who added or removed the role, and the corresponding timestamps. 

Thanks!

[miftikhar20 · Accepted solution]

Hi @The Matrix,

To achieve a dashboard report that shows the audit trail of user role assignments, including the role ID, user assigned, who added or removed the role, and timestamp, please follow these steps:

1. Ensure the glide.role_management.v2.audit_roles Property is Set to True

• Navigate to System Properties > All Properties.

• Search for the property glide.role_management.v2.audit_roles.

• If the property exists, ensure its value is set to True.

• If the property does not exist, create a new property with the following details:

  • Name: glide.role_management.v2.audit_roles

  • Type: True/False

  • Value: True

Setting this property to True enables automatic auditing of role assignments and removals, recording the relevant details in the sys_audit_role table (user, role, the user who made the change, and the operation performed).

2. Verify the sys_audit_role Table

The sys_audit_role table will now capture all role assignment and removal activities. Key fields in this table include:

• Created: Timestamp when the role was assigned or removed.

• Changed By: The user who made the change.

• Operation: Indicates whether the role was added (insert) or removed (delete).

• Role: The role assigned or removed.

• User: The user to whom the role was assigned or from whom it was removed.

3. Ensure sys_audit_role Table is in the glide.ui.permitted_tables system property

• Navigate to System Properties > All Properties.

• Search for the property glide.ui.permitted_tables.

• Verify that the sys_audit_role table is included in the list of permitted tables. If not, add it to the list.

The glide.ui.permitted_tables property controls which tables are available for reporting and UI access. If sys_audit_role is not listed here, you won't be able to create reports on that table. 

4. Create the Report on the sys_audit_role Table

1. Navigate to Platform Analytics Administration > Usage and governance > Reports, Click New.

2. Set the Report Source:

   • Report Name: User Role Assignment Audit Trail

   • Source Type: Table

   • Table: Audit Role [sys_audit_role]

5. Go to the Type tab and select the Report Type "List"

6. In the Configure tab, add the following columns to your report:

• Created: Timestamp when the role was assigned or removed.

• Changed By: The user who made the change.

• Operation: The action taken (Added/Removed).

• Role: The role that was assigned or removed.

• User: The user who was assigned or had the role removed.

7. Once you have configured and save the report and add it to the dashboard.

If my response helped, please mark it as the accepted solution so others can benefit as well.

[Ankur Bawiskar]

@The Matrix 
you can leverage OOTB sys_audit_role table for this

refer below links for the help and other member have already shared the steps

Audit user roles 

Enable role auditing with Contextual Security: Role Management V2 

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[GASHOK]

We are using the OOB Audit Roles [sys_audit_role] table to track user role additions and removals.

In our instance, the Dictionary entry for sys_audit_role has the attribute:

no_archive=true

Because of this, the table is not available for standard ServiceNow Archive Rules.

 I would like to understand the following:

1)Is sys_audit_role officially supported for archiving?

2)What is the purpose of no_archive=true on this table?

3)What would happen if we changed it to no_archive=false?

4)Would changing this attribute allow us to create a standard Archive Rule for sys_audit_role?

5)Are there any known risks or upgrade/customization impacts from changing this OOB attribute?

6)If archiving sys_audit_role is not supported, what is the recommended ServiceNow approach for long-term retention of these audit records?

7)We are using the Zurich release and would prefer an OOB/supported solution rather than customizing the audit mechanism.

Any guidance or official documentation would be appreciated.