Service Graph Connector – CIs Not Updating for Parent Domain User in Domain-Separated Instance

Hello,

We are using the Service Graph connector to integrate our domain-separated ServiceNow instance with Tanium. I’ve encountered an issue where Configuration Items (CIs) created by the integration during the first run are correctly placed in the expected domains. However, when I run the integration for the second time, the CIs are not updated if the job is executed by a user from the parent domain (even though the parent domain user has visibility to all child domains and their CIs).

Issue Details:

1. First Run: CIs are created successfully in the expected domains.
2. Second Run: CIs do not update when the user running the integration is from the parent domain, despite the fact that the parent domain user has visibility to the child domains and their CIs.
3. Child Domain Behavior: When the integration is run by a user from a child domain, the CIs are updated as expected.

What I’ve Tried:

• Verified that the user in the parent domain has visibility and appropriate access to all child domains.
• Checked scheduled import job settings and logs but couldn't identify any domain-specific restrictions for updates.
• Confirmed that the integration works correctly for creating CIs during the first run regardless of the user’s domain.

Questions:

1. Is this expected behavior in a domain-separated ServiceNow environment when using the Service Graph connector?
2. What can I do to ensure that the CIs are updated when the integration is run by a user from the parent domain?

Any insights or advice on how to resolve this issue would be greatly appreciated!

Thanks in advance!