Restrict admins from adding roles

[Brian S5]

Is there a way role assignment can be restricted to one particular Admin instead of having a group of admin users spread across the globe being able to add ITIL roles without verifying they have purchased those licenses ?

[Goran WitchDoc]

Hi Brian,

This a bit touching the area of "don't try to solve people problem with product". I would rather see this being solved outside of ServiceNow. But if it isn't possible, I would create another role like "allowed to add roles" and then give that role to a those who are allowed to do it, then you will need to make a ACL restricting that those the check for you before inserting a new role.

[Brian S5]

yeah its a touchy subject here, which is why i wanted to see if it could be done first before taking another step forward. The problem is that only 1 person is keeping track globally and when others add roles without verifying it has been indeed purchased, creates a mess of trying to stay compliant.

Appreciate the advice, Im already making a list of the "why we shouldnt do this" in SN and do it on a more business based process. Thinking about using the service catalog to create a "If you need a role" request with a workflow, and having only one person in charge of assigning in SN, but wanted to know if role assignment could be delegated to just one person before i did this. Thanks for the quick response.

[Allen Andreas]

Hi Brian,

Yea I agree with Goran, definitely a rough edge there.

The only other thing beyond what he suggested, that I can think of, would be to see if you can't drop down those admins to ITIL, but maybe up some permissions for ITIL?

Probably messy either way, but that could help get the admin back to 'true' sys admin type status.

[adamjgreenberg]

Goran is on the money here. You can make different levels of admin (JR v SR) and restrict certain items to the SR Admin only.