ServiceNow use verification report for overlapping applications

[Vivek81]

We have both ITSM and CSM subscriptions, and users are assigned the itil role directly.

In the Audit Report / Use Verification Report, we observed that out of 680 users assigned the itil role, 678 users are mapped to an ITSM subscription, while 2 users are mapped to a CSM subscription.

Given that ITSM and CSM share overlapping applications (such as Incident Management) that are associated with the itil role, we would like to understand:

• What logic does ServiceNow use to determine whether a user consuming the itil role is assigned an ITSM or CSM subscription?
• Which table(s), mapping(s), or entitlement records are evaluated during this subscription classification?
• Why are the majority of users assigned to the ITSM subscription while only two users are classified under CSM, despite all users having the same itil role?
• Is there any subscription precedence, application usage tracking, or licence allocation logic that influences this behaviour?

We are looking for details on the underlying classification mechanism used by ServiceNow to associate users with a specific subscription in the Audit Report / Use Verification Report.

[musislam]

Hi Vivek,

The split you're seeing (678 vs 2) is actually the expected outcome of how Subscription Management handles overlapping roles, it isn't random. Rough shape of it:

- Each subscription (System Applications > Subscription Management > Subscriptions) carries a list of entitled roles. Because itil is entitled under both the ITSM and CSM subscriptions, every itil user is a candidate for both.

- When a user qualifies for more than one subscription, the platform doesn't double count them. It looks at the applications the user has actually touched (the usage tracking that feeds the Use Verification report) and allocates them to the subscription whose app they used. Someone who has only ever worked incidents / requests / changes lands in ITSM; someone who has been working on customer cases (sn_customerservice tables) lands in CSM.

- If there's no distinguishing usage, the fallback is the subscription order / precedence, and ITSM is normally first, which is why the bulk ends up there.

So the 2 CSM users are most likely the only itil users who have actually used CSM-specific tables in the measured period - worth opening their user records and checking if they also hold sn_customerservice_agent or similar, and looking at the CSM subscription's allocated users related list.

Couple of questions so I can be more precise:

1. Which release are you on? The allocation logic and the tables behind it changed a fair bit around Utah/Vancouver.

2. Is this the Use Verification report generated from the Subscription Management app in the instance, or the one sent by ServiceNow account team? They're populated from the same data but presented differently.

3. Do those 2 CSM users hold any CSM-specific roles besides itil?

[Vivek81]

Hi @musislam 

We are on post Washington release.

The use verification report was shared by ServiceNow team.

Yes, the users contains CSM specific roles as well. 

[musislam]

Hi Vivek,

Thanks for confirming - post-Washington, an account-team generated report, and CSM-specific roles in the mix explains the split exactly.

Short version: Use Verification allocates each user to one subscription only. The itil role on its own cannot decide between ITSM and CSM, because it is a licensable role under applications belonging to both. Users holding only itil therefore fall to ITSM, and the only ones that break out to CSM are those carrying something CSM-exclusive. That is your 678 / 2.

1. What the classification actually evaluates

Roles are not mapped to a subscription directly. They are mapped to applications, and applications are what sit under a subscription / SKU. The chain is user -> role -> application -> subscription. When a role is claimed by applications in more than one subscription (itil is claimed by both ITSM and CSM), the tie is broken in roughly this order:

a. Exclusive licensable role - if the user holds a role only one subscription entitles (sn_customerservice_agent and friends under CSM), they are allocated there.

b. Measured application usage - if only shared roles are held, the usage measured for the period decides. Someone who has only ever touched incident / request / change lands in ITSM; someone working sn_customerservice tables lands in CSM.

c. Default precedence - shared role and no distinguishing usage means allocation falls to the first entitling subscription, which for itil is ITSM. That is where the bulk of your 678 comes from.

2. Tables and records worth opening in your instance

- license_role_list - every licensable role with its Role Type and Application. Filter on itil and you will see each application that claims it. This is the single most useful view for your question.

- Subscription records under System Applications > Subscription Management > Subscriptions, and the Subscription Applications / entitled applications related list - which applications sit under the ITSM SKU versus the CSM SKU.

- sys_user_has_role - who actually holds what, including roles inherited through groups. Direct assignment of itil is what makes this hard to read.

- The Allocated Users related list on the subscription (user_has_subscription) - the allocation itself, one row per user per subscription.

- ua_app_usage / usageanalytics_count - the measured application usage that feeds the Use Verification numbers.

3. Why only 2 land under CSM

Because only 2 of the 680 have something that is CSM-only. Pull those two user records, put their roles next to license_role_list, and you should find a CSM-exclusive licensable role, or CSM application usage inside the measured window. Everyone else holds itil and nothing CSM-specific, so there is nothing for the allocation to act on and they stay in ITSM. Expected behaviour rather than a defect in the report.

4. Precedence and double counting

Yes, there is precedence, and in practice it is exclusivity first, then measured usage, then default subscription order. There is no double counting in Use Verification - each user is counted once, which is exactly why 678 + 2 lands on your 680 rather than something larger.

Two practical follow-ups

- Since the report came from your ServiceNow account team, it is computed from the usage data collected out of your instance, so Subscription Overview inside the instance will not always line up row for row with it. Ask the account team for the per-user allocation extract behind the report - that tells you why each user landed where they did, which is far quicker than reverse engineering it from the tables.

- Longer term, stop direct assignment of licensable roles. Put itil and the CSM roles behind dedicated security groups, kept separate from assignment and approval groups. Allocation then becomes deterministic and your next Use Verification is much easier to defend.

If this answers your question, would you mind marking it as the recommended solution? It helps me keep supporting these licensing questions properly, and it makes it much easier for the next person hitting the same ITSM / CSM overlap to find a resolved answer in the Community.

Macki | Deloitte AU | Engineer Lead