Security Admin Elevate Issue

[SandeepKSingh]

Hi Team,

How can you set up a notification in ServiceNow to alert a specific group when a user elevates their role to security_admin?

[Dr Atul G- LNG · Accepted solution]

Hi @SandeepKSingh 

https://www.servicenow.com/community/developer-forum/notification-on-security-admin-role-elevation/t...

[Dr Atul G- LNG · Accepted solution]

Hi @SandeepKSingh 

https://www.servicenow.com/community/developer-forum/notification-on-security-admin-role-elevation/t...

[Ankur Bawiskar]

@SandeepKSingh 

is this a valid business requirement?

In PROD very limited set of users belonging to Particular Group will have security_admin role.

Why would they need this?

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Ravi Gaurav · Accepted solution]

@SandeepKSingh 

 The problem

A user wants to trigger a notification when a user is elevated to the “security_admin” role. In the post:

• They note that when a user is elevated to the role, an event with name security.elevated_role.enabled is generated. In that event:

  • parm1 holds the user ID of the user who got elevated. ServiceNow+1

  • parm2 holds the value “security_admin”. ServiceNow

• They created a Notification (Send When → Event is fired → event name = security.elevated_role.enabled). ServiceNow

• Then, they added an Advanced Condition Script to filter further:

  function elevated() { var sysEventGr = new GlideRecord('sysevent'); sysEventGr.addQuery('sys_id', event.name.toString()); sysEventGr.query(); if (sysEventGr.next()) { if (sysEventGr.parm2 == "security_admin") { gs.print(sysEventGr.parm2); return true; } } }

  They expected it to check that parm2 == "security_admin" and only trigger if so. ServiceNow

• The issue: Even though the script works when run in background, the Notification did not trigger when the role elevation happened in production. ServiceNow

---

🛠 The solution

A reply from a ServiceNow Employee suggests a simpler approach:

if (event.parm2 = 'security_admin') { answer = true; } else { answer = false; }

Which avoids querying the sysevent table entirely. ServiceNow

So instead of loading a GlideRecord, just use the event object directly in the Notification advanced condition.

So follow the below Article :-

https://www.servicenow.com/community/developer-forum/notification-on-security-admin-role-elevation/t...