Group Management via Active Directory Groups

[nkouloungis]

We are new to ServiceNow and are interested to learn how others are managing groups and group membership. The recommendation that we've heard from our implementation partners is that groups and group membership should be managed in Active Directory and synchronized with ServiceNow. Catalog items can be used to allow users to request new groups or update group membership, but ultimately those changes are made in AD (through automated action) and synchronized back to ServiceNow. We use catalog items and automation to add users to groups today, so I don't have questions about that part. I am more interested in the mechanisms of group synchronization with AD.

Please let me know your strategy for group management. If you are syncing with AD, are you syncing all groups or are you limiting what syncs in some way? If limiting, what is your constraint based on? 

[Dr Atul G- LNG]

Hi @nkouloungis 

Yes, you heard correct. SN provide OOTB LDAP integration to get user and group from AD to SN.

You can refer these docs:

https://www.servicenow.com/docs/de-DE/bundle/xanadu-platform-security/page/integrate/ldap/concept/c_...

[nkouloungis]

I understand that ServiceNow provides these capabilities. I'm interested to know the lived experience and practical application of these capabilities in a real-life operating organization.

[Dr Atul G- LNG]

Hi @nkouloungis 

I don't have handy information about the same, might you can reach out to your SN account manager who can provide some cases from other customers?