Way to make some users can create/delete role, user, and group.

[shog]

Hi,

I would like to make certain users in our instance able to perform the following actions:

1. Create and delete Users, Groups, and Roles.

2. Assign Roles to Users and Groups.

What I've already searched is:

1. Creating and deleting Users, Groups and Roles requires the admin role.

2. Assigning Roles requires the user_admin role.

My questions is :

1. Should I assign the user_admin role to those specific users?

2. Is there any better way to allow users to create/delete users, groups, roles without giving them the admin role?

Thank you for advice.

[Rafael Batistot]

Hi @shog 

• admin
  
• Full system control (including create/delete users, groups, roles, etc.).
• Too much power for what you’re describing.
• user_admin
  
• Can assign roles to users and groups.
• Does not by default create or delete users, groups, or roles.

Your Requirements vs. Roles

1. Create/Delete Users & Groups
   
• Out of the box, this requires admin.
2. Create/Delete Roles
   
• Also requires admin (and should usually be very tightly controlled — roles define access).
3. Assign Roles
   
• Requires user_admin (or a custom delegated ACL).

[Nikhil Bajaj9]

Hi @shog ,

Please check this - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0723786

This may give you an idea how you can achieve it.

This is ACl solution but if you want - you can also create - Catalog item + Flow or Record producer to create User/Group and you can control it using User criteria.

If my answer helped you, please mark it- solution accepted. 

Regards,

Nikhil Bajaj

[Dr Atul G- LNG · Accepted solution]

Hi @shog 

As per recommendation, user_admin is the minimum role required to update a user. It’s better to use the out-of-the-box role instead of creating a new ACL