K20 LAB1132 - Leverage ​HR Service Delivery Features and Functionality Session Q&A

[Lena_Latham]

This article is for questions and answers for LAB1132 - Leverage HR Service Delivery Features and Functionality. This lab is being presented multiple times throughout the live K20 event May 5 - 8, 2020. During the live event, post your questions in the comments of this article, and one of our lab gurus will be happy to answer it.

[kareng]

Can you make fields on the Case Creation Config required?

[xianoh]

As of Orlando - not yet.  But it is on the roadmap to put a required fields in the future. 

[April Jones]

Good news! We will also be launching this LAB as a self-paced course on Now Learning. (https://nowlearning.service-now.com/lxp)
Be on the lookout for it in a few weeks.

[Marcelle Howard]

The lab will be available via Now Learning in a few weeks so keep an eye out for it!

[kareng]

Can you use reference qualifiers for fields listed on the Case Creation Config

Ex: Assignment Group- it shows all Groups and not those that are true Assignment Groups

[April Jones]

Attendee Question: Hi what is lower limit for minimum inut length and dose it refelct in the massage on employee/case search bar

[Michael Ritchie]

Unfortunately not at this time.  The new case creation dialog is a UI Page and configuring reference qualifiers is a bit different.

[kareng]

Can you create Related Lists- custom for our needs?

[Michael Ritchie]

Yes they are called "defined related lists" in docs though show up under System Definition \ Relationships, confusing I know.  More details are on Docs:

https://docs.servicenow.com/bundle/orlando-platform-user-interface/page/administer/form-administrati...

[xianoh]

No minimum limit in technical parameters, but there may be issues with record searches (in terms of volume of data).  Better querying.  So name lengths could be an issue (like my last name - OH). 

[Marcelle Howard]

You might want to post this question/use case to the HR Community Forum page to crowdsource how other customers are approaching this. As mentioned, this is not unique and might help to see how others are solving for a particular use case.

[April Jones]

Attendee question - Do you have any plans to build a portal for HR. Because our users are more used to the service portal view. 

[Michael Ritchie]

HR does have a portal called Employee Service Center which is built on the standard Service Portal features:

https://docs.servicenow.com/bundle/orlando-hr-service-delivery/page/product/human-resources/referenc...

This is a cross functional "portal" that works for HR content as well as IT and other.  It also includes campaign, content delivery, and community features.  This plugin is included with HR Pro and HR Enterprise licensing and it can be purchased as a standalone too.  Please consult your ServiceNow account team for pricing questions.

[V_18]

Is it possible to make HR service not read only? Maybe give the ability to change HR service as long as it's the same COE?

[Joel15]

I have noticed between all the COEs within ServiceNow they do not have individual roles. They appear to be using the basic HR Core case roles.

How do we strictly limit users from seeing other cases in COEs and manage that access?

Right now we use groups with roles to restrict access, which roles are specific to tables.

Does it just use User belongs to HR Payroll Group then they get access to that COE from the group membership and assign the OOB case roles to that group?

We are currently using HRSD with a custom COE structure but looking to move back to OOB

[xianoh]

Remember - you can control things at the application level, module level, table and record level.  We always say "who gets what" based on roles and ACLs.  So it is "possible" but be careful when you implement - those specific roles and accesses.  

[Michael Ritchie]

To add to Christian's comment, there are some out of the box security controls, assignment rules, and employee document management settings set at the HR service level so if this changes, it will affect those configurations.

[V_18]

Where is the ui page/ code for Transfer case dialog? Also is it possible to place that nice hierarchical Hr Service drop down box on the regular form?

[Michael Ritchie]

You are correct, all COE's included in the HR Core plugin all use the same read and write roles.  The Lifecycle Event plugin there are separate roles.  But this said because COE's are separate tables, the "plumbing" is there to create separate roles, security, etc based on each individual COE.  All standard ACL, query business rule, etc can apply to secure the COEs.  The Orlando release includes the COE ACL security that was discussed in this lab to make setting up that process much easier.

[Pete R1]

Do you suggest creating matching query business rules to make tables easier to navigate? Lists sometimes get messy when a lot of cases are restricted.

[Michael Ritchie]

Details on the transfer feature can be found here:

https://docs.servicenow.com/bundle/orlando-hr-service-delivery/page/product/human-resources/concept/...

The UI page can be found along with other UI Pages via System UI \ UI Pages and it is called "Transfer Case".

Just so you know, I created a solution in Share to transfer cases to Incidents in case this is of interest to you.  I did have to modify this UI page to accommodate this use case.  Details can be found in this blog article:

https://community.servicenow.com/community?id=community_blog&sys_id=15950317dbdc48545129a851ca9619a9

[Michael Ritchie]

I honestly prefer query business rules over ACLs or at the very least to support ACLs.  While ACLs are great, they are executed on a row by row basis and can be user unfriendly where the user may get a message that X number of records have been restricted from view.  So query business rules can help filter those out along with the query they are performing.  So for example if that user doesn't have access to Employee Relation cases, create a query business rule to filter those out so they don't see them when clicking all open hr cases.  Now this said the new Orlando COE ACL security that was presented in this lab makes all of this easier for you.

[Jakub4]

How much difficult or recommended is to combine ESC Portal with standard ITSM Service Portal widgets and functions? For example from the perspective of different scopes of the widgets or other things? Is there something to be aware of before implementation? Thank you.

[V_18]

I have requirement where they want to give HR agent ability to quickly create a HR case through inbound actions.  Currently, we are thinking of having an agent add a hashtag with COE and hr service. Is there a smarter way to do that? I'm afraid there will be misspellings and user error when they are typing things in the hashtags

[Marcelle Howard]

You can use Predictive Intelligence (PI) for HRSD to auto-categorize email intake of HR cases. Without PI, they are categorized as "General" and then must be triaged by an HR Agent to the correct COE. I would suggest looking into these capabilities before adding any unique hashtag or coding for services as that can be negatively impactful for reporting purposes. https://docs.servicenow.com/bundle/orlando-performance-analytics-and-reporting/page/administer/predi...

[Michael Ritchie]

As you may know the ITSM (/sp) and the HR ESC (/esc) portals are provided as frameworks.  The ESC is more than just a portal and it includes a bunch of widgets, content, and community feature widgets that can be added to existing portals.  For example Content Delivery while focused on HR out of the box can be used for IT campaigns like laptop refreshes, planned system outages, etc.  So you can decide to add this functionality to your existing portal or use the ESC and build upon it. 

Because of the security nature of HR data, most tables are setup with Restricted Caller Access so you may have to "allow" global or other scopes to consume data and include the RCAs with your update sets.

[V_18]

does that mean that they will need to be transfered to different COE/hr service if we dont have PI?

[Marcelle Howard]

Yes they will need to be manually transferred from a General case category.

[Michael Ritchie]

As you are noting, processing inbound emails can be challenging especially if "humans" are creating those versus an automated process.  But this said ServiceNow's inbound actions can already process data within the email.  Look at the out of the box "Create Incident" inbound action as an example.  If the email body contains the following, those values will be set to fields in the incident.  Same would hold true for HR:

assign:Michael Ritchie

Now all of this said COE is very tricky because that is the actual table behind the case.  So you could have a condition that looks for email.body.contains Employee Relations or something similar or you could have to follow example above:

coe:Employee Relations

if (email.body.coe != undefined && email.body.coe == "Employee Relations")
   current.sys_class_name = "sn_hr_core_case_relations";

But please note that changing the record's class can be super tricky and problematic.

[V_18]

there is probably going to be a lot of canceled cases because of transfers. Is that a good practice in general?

[Joel15]

We have a business requirement of attaching proprietary attachments to cases. I am curious if someone attached that to one of these cases how would we ensure no one can see these attachments in the global attachment tables within ServiceNow.

What solutions are available for HRSD to prevent unauthorized access to attachments that belong to sensitive cases.

Types of attachments can range from credit cards to design documents

[Marcelle Howard]

Many of our customers successfully use inbound actions to create cases, so I would review @Michael Ritchie 's response below on how to circumvent the case reclassification with the use of PI.

[Michael Ritchie]

Joel good news is ACLs on system tables like sys_attachment, sys_email, etc exist for HR out of the box to prevent global IT admins from seeing them.  Basically if the table is HR (starts with sn_hr) then it is restricted.

[Joel15]

Disregard misread! Thank you for the help! it has a condition of table being sn_hr to apply HR acls

Thank you!

[kareng]

My instance has the COE Employ Relation activated but in the Crate COE ACL config it cannot find any tables

[Marcelle Howard]

You might need to refresh the instance or try a cache clear (cache.do). You also need to be in the HR Core scope (Human Resources: Core).

[Michael Ritchie]

Attachments are stored in the database in two tables:

sys_attachment which serves as metadata for the attachment

sys_attachment_doc which contains the actual "chunks" of the attachment

In the sys_attachment table there are a few attributes like table_name and table_sys_id which link the attachment back to the record it is linked to.  So the ACLs that I mention that ship out of the box look at the table name and if it is for HR then it is restricted.  Keep in mind too that ACLs do require that you have read access to the record it is linked to in order to view it.  HR also turns off the "admin overrides" checkbox so IT admins cannot see them.

Now this said if you are considering Employee Document Management, there are many additional features there too with attachments.

[V_18]

I was thinking of creating a separate inbound action for each COE table and the and then parse the subject text in the condition line. 

If I just create a generic case and then agents transfer to a proper COE/ Hr Service? Do you see an issue with that? I'm just concern that there may be a lot of canceled cases because of the transfers 

[Michael Ritchie]

Please make sure you have the Human Resources: Core scope selected.  You can confirm this by looking at the application in the upper right corner of the COE ACL config screen as it might say Global which won't have access to the HR tables.

[Kent Montee]

For the lab class, I did not see my signature on the attached IP document, attached to my case.  The pdf does not show my actual signature, is that being help some where else, can the actual signature be viewed some where?  Thanks

[Michael Ritchie]

It may or may not show depending on the setup of the document template.  If the template doesn't tell it to include it, it won't show up.  But the signatures are stored in the Signature Image table.  You can view these by entering signature_image.list in filter navigator.

[Ashok78]

Same issue for me as well. I even tried adding HR Admin to the ER Tier 3 group but even the HR Admin couldn't see the new HR Case

[Joel15]

EDM has not been considered just yet, but I am the Product owner for HRSD at my current company and i plan on looking into this soon! thank you so much for all the help!

Thanks!

[Michael Ritchie]

You are very welcome!  Enjoy the weekend.