Partial admins unable to add members to Service Desk group after Australia upgrade

[cherlakolas]

Hi Team,

After upgrading to the Australia release, users with partial/delegated admin access are unable to add members to our Service Desk group.

Full admin users can add members successfully.

The same partial-admin users can add members to other groups.

This behavior was working before the upgrade.

Has anyone experienced similar behavior after the Australia upgrade? Are there any changes related to group membership ACLs/delegated administration that we should check?

Any guidance would be appreciated.

[Hemanth M]

Hi @cherlakolas ,

1. Can you add large images please (can't read attached screenshots)

2. Please review this KB article and check what roles in the Global Technology - Service Desk roles has these kind of roles - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1113558 

3. Can you share roles associated with Global Technology - Service Desk group, i can review from end.

[cherlakolas]

Hi @Hemanth M ,

I re-attached the image in a larger format, but I'm still not sure if it's clearly visible. This is the maximum size I can include here. In parallel, I've also attached the Excel sheet for a clearer view. Could you please review it from your end?

I'm still trying to understand the article, although I'm not getting a clear understanding from it yet. However, I have already verified the Assignable By field for all the roles, and it is empty in every case. Additionally, the Elevate Roles flag is set to false for all the roles as well.

Roles

scrum_user

nc_catalog_information

nc_itsm_servicedesk_analyst

nc_catalog_information

nc_nowassist_itsm

nc_itsm_asset_manager

nc_knowledge_information

nc.zscaler.otp_access

nc_incident_variable

nc_itsm_assignment_group_member

scrum_user

nc_itsm_hwvm_locker

nc_delegate_admin

[cherlakolas]

Hi @Hemanth M ,

Thank you for sharing the KB article. It was very helpful in identifying the root cause.

Following the KB guidance, I created a non-admin test user in DEV and was able to reproduce the issue. I then ran the diagnostic script from the article, which identified that the user was missing the role:

sn_templated_snip.template_snippet_reader

After assigning this role to the test user and re-running the script, the user successfully passed the iAccessHandler validation. I then impersonated the user and was able to add members to the Global Technology - Service Desk group successfully.

This confirmed that the issue was caused by the missing sn_templated_snip.template_snippet_reader role required for the group's role hierarchy validation.

Thanks again for pointing me to the KB article and diagnostic script. It helped us identify and validate the resolution quickly.

Thanks,
Surender Reddy

[Hemanth M · Accepted solution]

Hi @cherlakolas ,

Awesome,  could you please close this loop by accepting, if my response helped to resolve your query!