Removing 2 Roles from a Group Also Removed Roles Granted by Other Groups, Inherited By the 2 Roles

[puffysleaves]

I have a group called Viewer. It had 2 Roles that granted too much access so they were removed: x_except_man.user and sm_user. Those Roles contained the itil Role. So removing those 2 Roles from the group also removed the itil Role from all group members even though they were getting the itil Role from other groups. Just went to the group record, removed the 2 Roles, and saved. 

ServiceNow isn't sure what happened. Has anyone seen this kind of behavior before? 

[Dr Atul G- LNG]

Hi @puffysleaves 

This is a core part of the system. A user can be part of many groups, and many roles can be assigned to multiple groups. So, even if you remove a user from one group, they may still be part of other groups. If another group has the ITIL role assigned, the user will still have the ITIL role, which is the expected behavior.