Fulfiller user cleanup

[JakeBaynes]

Hey SN people,

New job, trying to clean up fulfillers, it's a mess lol.

I wanted to post my workflow to see if what I'm doing makes sense to others and whether it is going to accurately identify where we can clean things up.

Our account reps have provided a report of all users who have roles that are considered fulfillers and how that all ties in to our subscriptions.

We have a custom built app that extends the incident table which has two roles, one of which has been given to way too many people and it is flagged as a fulfiller role.

I have been using this query on the User has roles table.

user.active=true^user.last_login_timeRELATIVEGT@dayofweek@ago@365^user.internal_integration_user=false^role.nameIN{fulfiller roles}

This gives me all users who have one of the roles identified in our account reps report, have logged in within the last 365 days, are not internal integration users, and are active.

I then used the Task table with a similar query to get all tasks that have been assigned to a user who has one of the roles listed, logged in within last 365 days, not an internal integration user, and is active.

I then used the Python Pandas library to take the two sets of users, merge them with what is essentially a left inner join, which gets all users who have never been assigned to any Task (Incidents, Requests, etc.) and have one or more of the highlighted roles.

       LEFT                                                           INNER LEFT                                                            RIGHT

(users with roles(<-users who have never been assigned to a task)tasks assigned to users with roles)

I'm trying to understand if there are any other criteria that would make someone a fulfiller that I'm not thinking about. 

I appreciate any incite!

[Rafael Batistot]

Hi @JakeBaynes 

Gaps / Extra Criteria to Consider:

1. Groups & Assignment Rules – Some users may fulfill tasks indirectly (via group membership, not direct assignment). Check if they are in assignment groups that actually handle work.
2. Delegated or Secondary Activity – Look at approvals, catalog tasks, or change tasks. Some users may not touch Incidents/Requests but still act as fulfillers in other processes.
3. Role Inheritance – Some roles come bundled with others (e.g., itil being inherited). Make sure you’re not double-counting or missing indirect role assignments.
4. License Type Mapping – Fulfillment is often tied to subscription allocation. Compare your findings against license reports to see if SNOW is already flagging unused licenses.
5. Edge Cases – Contractors or temporary staff who still should have the role but haven’t had recent tasks. Decide how far back you want to look (365 days may or may not be enough).

Bottom line: Your workflow makes sense and should identify a big portion of unnecessary fulfillers, but also check group activity, other task types beyond Incident/Request, and role inheritance to avoid removing legitimate but less visible fulfillers.

[kaushal_snow]

Hi @JakeBaynes ,

You're on the right track with your approach to cleaning up fulfiller users in ServiceNow....I can add few more...

• Regularly audit active fulfiller users who haven’t logged in days, then deactivate or downgrade to reclaim unused licenses efficiently.....
• 
  Avoid direct role assignments, use group based assignments instead to simplify license governance and prevent accidental fulfiller allocations.....
• 
  Convert users with fulfiller roles but minimal engagement to Business Stakeholder roles to reduce licensing costs and retain access relevance......
• 
  Automate user cleanups on inactivation, strip group memberships and log history, preserving audit data while freeing fulfiller roles.....
• 
  Use reports on sys_user_has_role for active users logged in past year to identify idle fulfiller role assignments for cleanup.....

If you found my response helpful, please mark it as ‘Accept as Solution’ and ‘Helpful’. This helps other community members find the right answer more easily and supports the community.

[Mark Manders]

Best practice is to use groups to add roles and users. That way you can also easily utilize the Subscription Management dashboard that is in ServiceNow.

Also check if the numbers you have are aligned with what ServiceNow is showing you. If there are (huge) differences, you are probably missing something. But it also depends on the modules you are using (licensed modules all have fulfiller roles, but if you have ITSM and CSM as separate licenses (example), your CSM users won't count to the ITSM licenses, even though they have ITIL.

[JakeBaynes]

Hey everyone, I appreciate the feedback.

We are using groups to allocate roles, not much direct assignment of roles that I have found.

When I group by the 'Task Type' column on the Task table with all records, I get 45 different record types, so I'm hoping that I'm covering the majority of tickets that a fulfiller would be touching, catalog tasks, change tasks, etc. 

I forgot to mention that when I use the queries outlined in my original post I'm also grouping by the User (User has Roles) or the Assigned To (Task) columns which essentially gives you a view of all relevant users without duplicates. After exporting to csv files, I had to use Data Wrangler in VS code to remove the duplicates again and the results matched the number using the group by feature in SN. I feel like that is addressing any double counting because on the User has roles table, grouping by the User column makes sure you're not double counting any roles that a user has.

I like the idea of automated role removal after not logging in for a set time.

After this initial evaluation, I will have to come up with new groups and roles to separate users into those who can read and comment on records, and those who actually need full write access to fulfill the tickets.

Thanks again for the responses.