user administrator

[vodnalar26]

Hi Everyone,

I'm working on a custom ServiceNow application called Access Automation and Governance Framework and would appreciate guidance on the best approach to automate the following user administration activities:

• Assign a single role to a user.
• Assign multiple roles to a single user.
• Assign multiple roles to multiple users in a single request.
• Add a user to a group.
• Add multiple users to a single group.
• Add multiple users to multiple groups.
• Copy all roles and group memberships from one user to another while avoiding duplicate assignments.

The solution should also include:

• Approval workflows (especially for privileged roles such as admin, security_admin, and user_admin).
• Validation to prevent duplicate role and group assignments.
• Audit logging and notifications.
• A Record Producer for end users to submit access requests.
• Automation using ServiceNow best practices.

I'm looking for recommendations on the best architecture and implementation approach. Specifically:

1. Is Flow Designer sufficient for handling these operations, or is it better to use Script Includes for the business logic and call them from Flow Designer?
2. Which ServiceNow tables and APIs are recommended for assigning roles and managing group memberships?
3. How would you design this solution to ensure it is scalable, maintainable, and follows enterprise ServiceNow best practices?
4. Are there any out-of-the-box capabilities or patterns that can be leveraged instead of building everything from scratch?

I would appreciate any suggestions, implementation patterns, or real-world experiences from the community.

Thank you!

[pavani_paluri]

Hi @vodnalar26 ,

For a requirement like this, I would recommend designing it using a hybrid approach: Record Producer + Flow Designer for orchestration + Script Includes for reusable business logic. This provides better scalability, maintainability, and governance than trying to implement everything directly in Flow Designer.

Recommended Architecture
1. Request Intake
Create a Record Producer (or Catalog Item) for access requests.
Allow the requester to select:
* Users
* Roles
* Groups
* Access action (Role Assignment, Group Assignment, Copy Access, etc.)
* Business justification

2. Approval Process
Configure Flow Designer approvals based on the requested access:

* Standard roles/groups → Manager approval
* Privileged roles (admin, security\_admin, user\_admin, etc.) → Additional approvals from Application Owner, Security Team, or IAM Team
* Multiple approval stages as required by organizational policy

Business Logic

Instead of implementing complex logic directly in Flow Designer, create a reusable Script Include that handles:

* Role assignment
* Group membership assignment
* Bulk processing of users
* Copying access from one user to another
* Duplicate validation
* Audit logging

The Flow should simply orchestrate the process and invoke the Script Include.

Core Tables
For user administration, ServiceNow already provides the necessary relationship tables:
Roles:sys_user_has_role
Groups: sys_user_grmember
Users:sys_user
Groups:sys_user_group
Before inserting records into relationship tables, always validate whether the relationship already exists to prevent duplicates.

Use Cases
1.Assign Single Role to One User:
Create a record in sys_user_has_role
2.Assign Multiple Roles to One User:
Iterate through selected roles and perform validation before insert.
3.Assign Multiple Roles to Multiple Users:
Use nested processing:
* User Collection
* Role Collection
Validate existing assignments before creating records.

4.Group Membership Management
Insert validated records into sys_user_grmember
5.Copy Access:
When cloning access from User A to User B:

1. Retrieve all roles assigned to User A
2. Retrieve all group memberships assigned to User A
3. Check existing assignments for User B
4. Insert only missing records

This prevents duplicate memberships and role assignments.

Audit & Compliance

I strongly recommend creating a custom audit table such as`x_company_access_audit.Capture fields like
* Requested By
* Requested For
* Action Type
* Roles Added
* Groups Added
* Approval Details
* Execution Timestamp
* Execution Status
This becomes extremely valuable during audits and compliance reviews.

Notifications

Use Flow Designer notifications for:

* Request Submitted
* Approval Required
* Request Approved/Rejected
* Access Granted
* Access Failed

Best Practice Considerations
Keep business logic in Script Includes
Use Flow Designer only for orchestration and approvals
Create reusable APIs for role/group assignment
Avoid direct GlideRecord logic scattered across multiple flows
Enforce duplicate validation before inserts
Log every access change for auditability
Use role-based approval policies for privileged access
Design bulk operations to handle thousands of records efficiently

Leverage Out-of-the-Box Capabilities
Before building everything from scratch, also evaluate:
* Access Requests through Service Catalog
* User Criteria
* Delegated Administration
* Identity Governance (if licensed)
* Role-based group assignment models
* Approval Policies in Flow Designer

If the environment has IRM/IGC/Identity Governance capabilities, some access request and approval processes may already be available out of the box and could significantly reduce custom development.