Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field
Hi there,
A new ServiceNow family release packed with a ton of new and updated features. A true gem - and not yet documented - the new "Time-Limited User Roles" functionality. In very short terms: the ability of providing users temporarily with a role based on time constraints.
Time-Limited User Roles
End users requested a Role for a short time period, a developer needing a (read-only) admin role, on a higher instance, very common use cases. Though how do you keep track of this, and revoke the roles in time? Some companies might have built a custom app for such, to request temporary elevated privileges.
Because that does involve quite a bit of work, I also see a lot of customers just providing admins with two user accounts: one for their normal filfiller activities, and one for their admin activities. And ofcourse, there are still companies where an admin has just one account with an admin role in production 😅.
Washington DC (Patch 0)
Using the new out-of-the-box Time-Limited User Roles functionality is pretty straightforward. First, navigate to "User Administration > Time-Limited User Roles".
When opening a new record, a few basic fields are present which all are pretty clear without any explanation. The user/role of course important and the Start time/End time.
After submitting the new Time-Limited User Role record, you are good to go! Nothing more is needed to start using the new out-of-the-box Time-Limited User Roles functionality.
When the User concerned logs in, very briefly the below info message is visible. Info message describing which time-limited role(s) are granted. The info message does mention at the end "Please reload current page", though that should happen automatically 😀.
In this example the User is temporarily granted the "itll" Role and will have the same permissions etcetera as when the itil Role would have been added through conventional ways of adding the Role to the User (or with a Group in between).
I haven't found any technical details yet on how the mechanism works under the hood. Like is a Schedule being used and calling certain Script Includes or APIs, how is this being tracked in regards to licensing, etcetera.
Idea
You can now just start using Time-Limited User Roles and add Users manually. An idea could also be to automate this. Just brainstorming out loud, for example requesting Time-Limited User Roles through a Catalog Item. Adding a User Criteria which Users should be able to open and submit the Catalog Item, adding a Reference qualifier to trim the available Roles for a User, asking the User for a reason/justification for why requesting the access, perhaps adding a manager approval in the Flow attached to the Catalog Item, etcetera.
---
That's it. Hope you like it. If any questions or remarks, let me know!
| C |
If this content helped you, I would appreciate it if you hit bookmark or mark it as helpful.
Interested in more Articles, Blogs, Videos, Podcasts, Share projects I shared/participated in? |
Kind regards,
Mark Roethof
Independent ServiceNow Consultant
9x ServiceNow MVP
---
I have created something very similar to this for my employer that works across all of our instances. All records must be created and managed in our production instance (It is restricted in sub prod) and are passed down into sub prod via BR/table API. However it does not use roles specifically, instead we create empty "Delegation Groups" and assign the roles to those groups, for instance; we have " ServiceNow Delegated Impersonator".
All records go into the table in production and are filtered down via REST, any updates (which would only be from the flow, I.e. state changes) come back via REST. When a record is created in the target instance the group membership is handled via a flow. this gives us visibility of what access we have provided to users in all of our instances in one location and the ability to cancel if required.
We also provide the ability to create multiple records via record producer, for security reasons we only allow multiple of users though, not multiple groups or instances but this could be done if so desired.
When selecting a group we show what roles will be granted by providing membership to said group.
It will be interesting to have a play with "Time-Limited User Roles" once we get our hands on Washington and see how the two compare.
