Best Practice for Renaming/Replacing Mature AD Groups Used in ServiceNow

[Andrew Meza]

When we originally implemented ServiceNow about four years ago, we leveraged Active Directory groups that already existed in our environment. At the time, it was the quickest path forward, but as our platform has matured, we're realizing that some of these groups no longer align with how we want to organize ServiceNow fulfillment teams.

For example, we currently have an AD group called Tier 3 Support that is synchronized into ServiceNow and used extensively across the platform. The group is referenced by catalog items, assignment rules, workflows/flows, reports, and likely other configurations.

We'd like to move toward more clearly defined ServiceNow-specific groups, such as a Networking group, with appropriately named AD groups behind them.

I'm curious how others have handled this type of transition in a mature instance:

• Did you simply rename the existing AD group and update the display name in ServiceNow?
• Did you create a new AD group, sync it into ServiceNow, and then migrate all references to the new group?
• If you created a new group, what was your approach for updating assignments across catalog items, Flow Designer flows, business rules, assignment rules, reports, etc.?
• Were there any unexpected impacts or lessons learned during the migration?

My initial thought is that creating a brand-new group could require updating a significant number of references throughout the platform, whereas renaming the existing group might be less disruptive if the underlying identifiers remain unchanged.

I'd appreciate hearing how others have approached this and what you'd consider the current best practice.

Thanks!

[glideFather]

ahoy @Andrew Meza,

I believe that some answers to your questions will be depending on your configurations made in AD side.

It can be configured to rename as well as not rename... you can try to reach out to anyone from the AD support team and eventually they can rename one group slightly not to be noticed (e.g. adding suffix ".") to it and see if it is changed in ServiceNow and then eventually change it back.

[Its_Azar]

Hi there @Andrew Meza 

I’d avoid creating a new group unless there’s a real need. If the existing AD group can be renamed, keeping the same ServiceNow group/sys_id is usually much betttrr since all the existing references stay intact.

[Andrew Meza]

Im afraid we used a group that also utilize for other things so if I change it, it may break something else... Now... In a perfect world, would I just update the name in AD and once updated would ServiceNow just update the name as well?