Partial admins unable to add members to Service Desk group after Australia upgrade

[cherlakolas]

Hi Team,

After upgrading to the Australia release, users with partial/delegated admin access are unable to add members to our Service Desk group.

Full admin users can add members successfully.

The same partial-admin users can add members to other groups.

This behavior was working before the upgrade.

Has anyone experienced similar behavior after the Australia upgrade? Are there any changes related to group membership ACLs/delegated administration that we should check?

Any guidance would be appreciated.

[Hemanth M]

Hi @cherlakolas ,

When you say partial admins what roles do they have? and adding a user to the group is basically creating an entry in the "sys_user_grmember" table.

Please check this in the access analyzer to validate create access status

  And message in your attached screenshot it a info message that the addition/removal job triggered 

Hope it helps!

[cherlakolas]

Hi @Hemanth M ,

Thanks for your response. The user has around 185 roles, so I haven't included the full list here. I verified the Create ACL in Access Analyzer and it is passing successfully, but the record is still not being created in the sys_user_grmember table. Please let me know if you'd like me to share the assigned roles for further analysis.

[Hemanth M]

Hi @cherlakolas ,

What roles does this group has?, any new roles added to this Service Desk group?, can you also check if there are any BRs written to abort this action (just double check this).

[cherlakolas]

Hi @Hemanth M ,

Thanks for your response.

I reviewed the Service Desk group history and couldn't find any recent role additions or role-related changes. Most of the recent updates appear to be relation updates (Incident, Catalog Item, Change Request, Group Member, etc.).

I also reviewed the Business Rules surfaced during the access evaluation (Abort changes on group and group query). From my review, these appear to be query-related rules on the Group [sys_user_group] table and do not seem to directly prevent inserts into sys_user_grmember.

I had already verified the ACL evaluation on the Group Membership [sys_user_grmember] table earlier, and the Create ACL check was passing successfully.

As part of further troubleshooting, I ran the access evaluation on the Group [sys_user_group] table for the Global Technology - Service Desk group. The evaluation shows Write access = Blocked, and the blocker is reported as AssignableByRoleAccessHandler.

Could you please advise how I can further investigate AssignableByRoleAccessHandler? Is there a specific ACL, Script Include, or group configuration that I should review to understand why write access is being blocked for this group?

Thanks,

Surender Reddy