Trying to understand the "APM" roles

[MEBoatman]

When we implemented Enterprise Architecture, it was back in the days it was called "APM". At that time, we were not using the EA Workspace and we only had need for sn_apm.apm_admin, sn_apm.apm_user, and sn_apm.apm_read roles. Our roles are assigned via group memberships. So we assigned  sn_apm.apm_analyst to the same group as sn_apm.apm_admin.

Fast forward to today. We are on Australia. We want to start using EA Workspace more actively and I am charged with determining how to do that. In digging into that, I want to be sure that we still don't have a need to differentiate between sn_apm.apm_admin and sn_apm.apm_analyst.

My understanding up till now is that apm_admin was the "highest" access level, followed by apm_analyst. The apm_user role is essentially the update role and we assign that to IT App Owners. And the apm_read role is for everyone else. If I am interpreting this page correctly, that's essentially what it says: Access roles • Australia Enterprise Architecture • Docs | ServiceNow.

However, as I've started digging into this, I'm starting to question my interpretation. It appears that the apm_admin role is CONTAINED by apm_analyst. This leads me to ask - what is the difference between apm_admin and apm_analyst?

It appears that both apm_admin and apm_analyst can configure EA Workspace. What I was originally expecting to be able to do is assign apm_analyst to the rest of my team and leave me in apm_admin and then I would be able to configure EA Workspace and the rest of the team would be able to use it and do anything else that EA should be doing in the tool. But it appears that there is no OOB way to achieve that. Am I missing something here?

[Mathew Hillyard]

Hi @MEBoatman 

This is one of the rare examples where SN has not used a read/user/manager/admin/developer role set.

It is probably from EA's origins in APM, where the scope was much narrower, so someone with full access to both data and config was considered an application analyst. The Admin role is really just a configuration role and is expected to be given to a user who does not manage EA day-to-day, but is responsible for the setup. EA does however have both Read and User roles.

Of course, today, in EA, this makes no sense at all, but unfortunately a new set of more relevant roles has not yet been forthcoming.

I hope this helps!

Mat