Impersonation

[sunny091213]

do  you think Impersonation is an security issue? if yes give me reasons?if not support it?

[Dr Atul - LNG]

Yes @sunny091213 

This poses a significant security issue if given in production to any user. By using impersonation, a user can approve or reject changes or manipulate data they do not have access to. This bypasses the established access controls and audit mechanisms, potentially leading to unauthorized actions and data integrity violations.

[sunny091213]

Then why did serviceNow allow impersonation if it is a security issue,even in Production a admin can impersonsinate the other users?

[Dr Atul - LNG]

Hi @sunny091213 

Only admins are allowed to impersonate users, which is useful for checking issues during odd hours when the user might not be available. Admins need the Impersonation role to view other user profiles or, in some cases, update records with necessary approvals.

[AndersBGS]

Hi @sunny091213 ,

I fully agree with @Dr Atul - LNG here. If you provide the impersonation to any user, they are able to act as the user under all circumstances in the ServiceNow platform.