question Enrolling ACR (Account Recovery Users) looses admin role when logged in in Developer forum

Enrolling ACR (Account Recovery Users) looses admin role when logged in

Nisha30 — Thu, 01 Feb 2024 14:13:35 GMT

Hi,

We have Multi SSO enabled for AUthentication (Azure)

LDAP for User provisioning

FOr Security hardening we have added users as ACR to be compliant

Issue: ACR users (have admin roles) when they log in are not having the admin roles anymore its only self-service .

If ACR looses the role there is no purpose as Account Recovery as user cant perform any SErviceNow tasks.

Can anyone help how to implement this. I have gone through ServiceNow documenttaion its straightforward but did not help.

Thanks

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

mathieu_brule — Thu, 25 Apr 2024 10:53:25 GMT

Hi Nisha,

I've just faced the same issue, do you have any tips for recovering all admin access as an ACR user ?

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

Rim1 — Fri, 24 May 2024 07:51:47 GMT

what I noticed is that when you login with your own user account through ACR, you are actually logged in as ACR Recovery user, that's why you don't see your own roles, favorites, etc. hopefully, that account has enough permissions to sort out SSO issues 🙂

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

LearnUseThrive — Thu, 30 May 2024 14:05:29 GMT

I don't see it right now, but somewhere in the documentation I read that Account Recovery Users have very limited permissions to address certificate issues for login, to prevent a local account from having god mode admin permissions, so it should only be used to fix login issues, not for general administrative tasks.

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

mathieu_brule — Thu, 30 May 2024 14:10:22 GMT

Yes, that's what I read too, but ACR prevents also from any local connexion...

So, as a consultant for my customer, I can't do anything in the platform if ACR is enabled (given as it's mandatory while activation multi SSO).

My solution : disactivate ACR. 🙂

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

dangileri1 — Thu, 30 May 2024 14:21:44 GMT

I ended up disabling and will get another session in with SN to review - conceptually it is a good, in reality, does not seem to work as expected, and impacts the account used.

We did create an account specifically for this, but that had unwanted consequences of it's own, hence why I disabled until we can dig in further.

If I get additional information I'll post it.

David

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

Sravan Krishna — Wed, 03 Jul 2024 09:59:19 GMT

I am also facing same issue, i think what we can do is...we can create a new admin account and use that account as Account Recovery (ACR). And we shouldn't enable ACR for remaining admin accounts. Hope this works.

Thanks,

Sravan Krishna

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

LearnUseThrive — Wed, 03 Jul 2024 15:45:08 GMT

@mathieu_brule wrote:
Yes, that's what I read too, but ACR prevents also from any local connexion...
So, as a consultant for my customer, I can't do anything in the platform if ACR is enabled (given as it's mandatory while activation multi SSO).

We ended up having our vendors use a third party identity provider to sign in now, CyberArk Idaptive. That way everyone's sso except the recovery account.

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

Sravan Krishna — Mon, 08 Jul 2024 11:10:35 GMT

What happens to Service Accounts if we enable SSO, Any idea?

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

Raj Kumar29 — Tue, 09 Jul 2024 16:24:50 GMT

If you have any additional information about enabling ACR in Production and it's impact. Could you please share??

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

Rim1 — Wed, 17 Jul 2024 09:02:33 GMT

although it should not touch non-interactive logins, unfortunately, this was not the case when we enabled ACR - it killed many or our integrations in prod 🙂 apparently, there is a defect with ACR which we learned about it hard way, so be careful if you are planning to enable ACR 🙂

Defect with ACR: OAuth token fails to get access token when Account Recovery (ACR) is enabled on the instance - Known Error (servicenow.com)

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

Nisha30 — Thu, 18 Jul 2024 09:05:12 GMT

Thats true folks had a case raised with ServiceNow and it said enabling ACR will only have ACR role if there is any issue related to SSO , so it means platform admin capability is no more if that user has ACR enabled.

We disable it in production to avoid that panic.

Thanks all for your inputs

Re: Enrolling ACR (Account Recovery Users) looses admin role when logged in

abhishek_s — Wed, 28 May 2025 09:22:14 GMT

Did it work for you? I tried this before seeing your suggestion and it did not work.

The non-ACR enabled admin account faces an "Username or password is invalid" error on /login.do.

The ACR enabled admin account can login on /login.do with access to only SSO / cert related configurations (which is by design).

Even we opted to disable ACR and ignore the Healthscan recommendation because we have a particular use case where admin login via UI is necessary.