Best Practice for Renaming/Replacing Mature AD Groups Used in ServiceNow

[Andrew Meza]

When we originally implemented ServiceNow about four years ago, we leveraged Active Directory groups that already existed in our environment. At the time, it was the quickest path forward, but as our platform has matured, we're realizing that some of these groups no longer align with how we want to organize ServiceNow fulfillment teams.

For example, we currently have an AD group called Tier 3 Support that is synchronized into ServiceNow and used extensively across the platform. The group is referenced by catalog items, assignment rules, workflows/flows, reports, and likely other configurations.

We'd like to move toward more clearly defined ServiceNow-specific groups, such as a Networking group, with appropriately named AD groups behind them.

I'm curious how others have handled this type of transition in a mature instance:

• Did you simply rename the existing AD group and update the display name in ServiceNow?
• Did you create a new AD group, sync it into ServiceNow, and then migrate all references to the new group?
• If you created a new group, what was your approach for updating assignments across catalog items, Flow Designer flows, business rules, assignment rules, reports, etc.?
• Were there any unexpected impacts or lessons learned during the migration?

My initial thought is that creating a brand-new group could require updating a significant number of references throughout the platform, whereas renaming the existing group might be less disruptive if the underlying identifiers remain unchanged.

I'd appreciate hearing how others have approached this and what you'd consider the current best practice.

Thanks!