Workflow can no longer update sys_user_group manager field

[Cheri M]

Hello,

I have a weird issue suddenly. Scenario, I have a workflow that goes to AD, updates the group manager and then, a script activity that updates the group manager field in ServiceNow - these are not type security group. This was created years ago and was tested and worked.  Suddenly we notice it is not updating the manager field in SN. The import from AD at night does update the field but there are some scenarios where it needs to be update immediately to create a new approval to the new group manager.

I checked my script as myself (admin) and it runs fine.  When I ran it in the WF I see this error in the logs.
'User mid_server_dev does not have the role 'sn_si.admin' which is required to grant/remove 'sn_si.read' under application administration, Resource: 'record/sys_user_group/write'

Odd, but in dev I added that role to the mid server account and it worked. WHY would it need that role to update a group manager on an ITIL group (not security group)?  Anyone else experience this?

Thanks,

Cheri

[SanjivMeher]

Can you check if the group has a role sn_si.read? If so, to grant manager access to that group, the mid server would need that role sn_si.admin.

[Cheri M]

Thank you for your reply. The only role it has is itil.  Only Type is itil.

[SanjivMeher · Accepted solution]

Did someone add sn_si.read under itil by mistake?

[Cheri M]

Well thank you for pointing me in the right direction, I didn't think to check roles under itil.
Yes sn_si.read was added. There was a direction to allow all ITIL to read sec. incidents despite my protest, it happened.  I will do some workaround for that org requirement like perhaps writing ACLs.