The reason you aren't finding any answers is that it is license related. There is only one party that can answer these questions for you and that's your ServiceNow rep. They know what you have and they know how everything is structured for you.

The ServiceNow licensing is very complex and varies almost per customer, making any answer you get from the community a possible wrong answer. Your ServiceNow sales rep is the person that can give you this information without any maybes.

Hi @Shaik22 - Mark & Sandeep are correct: best to tallk to your ServiceNow account rep about this.

It should be easy to resolve. From your question, it sounds like the [GRC Business User - Lite] role has been assigned to all users in the organisation, whereas this is probably not necessary in reality. By restricting that role only to users who need it, you should be able to stay within the limits of the contract.

this did happen automatically in one release a while back! depending how many users, a support ticket may be required 

Hi Shaik,

I too am having similar issues trying to understand SN IRM / GRC subscriptions. My company has purchased a number of GRC Operator (full) subscriptions and some GRC Lite Operator subscriptions. However here is where the confusion begins...

ServiceNow does not have a simple way to limit the number of GRC users to the number of subscriptions purchased! There is a calculation in the backend that is not clear. It is not as simple as associating one user to one subscription. Or as simple as creating a GRC groups and assigning users to those groups (which is what we have done/ attempted). As a result we are finding it almost impossible to contain the number of GRC users to subscriptions purchased.

But to answer your question:

1. A full operator subscription can be granted any role within GRC .

2. A lite operator has a limited subset of the GRC roles. But if you exceed this subset it is counted as a full operator.

When you install the Lite Operator plugin a role called GRC Lite User (or similar) is created which is given all the available roles for a lite operator. See list below. Any GRC roles other than these will result in that role (and associated users) being counted as full Operator.

Available GRC Lite Operator roles:

sn_audit.external_auditor
sn_compliance.reader
sn_grc.confidential_user
sn_grc.reader
sn_grc.user_hierarchy_reader
sn_grc_pa.sn_grc_pa_viewer
sn_grc_workspace.task_reader
sn_risk.reader
sn_risk_advanced.ara_approver
sn_risk_advanced.ara_reader
sn_risk_advanced.qualitative_risk_appetite
sn_risk_advanced.quantitative_risk_appetite
canvas_user