How to move Application cross scoped privilege between instances.

[kfitch]

We are on Zurich Patch 12. After doing some application updates we are getting the following error, 

I did the steps to create the cross scoped privilege record.  Then from within the record had it 'Add to Update Set'. It created a batch update so one for each scope identified. In this case Global and Agency Support Model scopes.

Load it in the next instance and nothing happens.  Doesn't bring over any changes.   We then tried to export XML and imported it into the other instance. Still didn't change anything. 

This is my first time with crossed scoped privilege so not sure if I'm doing something wrong. Anyone else have this issue before or know what I need to do?

Thank you!

[Tanushree Maiti]

Hi @kfitch 

Refer KB: KB0724138 Execute operation on script include 'SysRelatedList' from scope 'Discovery and Service Map... 

Cause

The issue here is that they did not have the cross-scope privilege records configured correctly. 

Resolution

• Create  cross-scope privilege record for the Application

 Procedure : 

1. Navigate to System Application > Application Cross-Scope Access
2. Click on New to create a new record
3. In the form, fill in the following data:

• Target Scope:      Select your module scope
• Target name:       SysRelatedList
• Target type:         Script Include
• Status:                Allowed

[kfitch]

That does not help. I already have done that but now I need to move it into TEST Environment and it doesn't move with an update set or an export/import.  How do i get it moved?

[Vishal Jaswal]

Hello  @kfitch 

If the sys_scope_privilege record exists in the source instance but does not exist in the target instance after the Update Set was committed, then the privilege was likely captured but not applied; therefore due to this when Script include whose Accessible is From is "This application scope only" throws the error.

My recommendation is:

• To create a new Update set in your source instance ensuring application is not Global rather the scope in which you are working.
• Create a new script include exactly replicating your existing one where I believe you have Accessible is From is "This application scope only".
• ServiceNow automatically generates the cross scope privileges which you can validate in sys_scope_privilege along with it's status as Allowed. 
• Verify it is captured in your update set and if not then "Force to update set" under related links of the record.
• Retrieve, preview and commit this new update set to validate the script include and it's cross scope privileges in target instance.
  
  

Ensure the call made to this script include in target instance is from the same scope.

[kfitch]

Script Include, ServiceOrganizationUtilAJAX, is in Global scope so why does the error state (Script Include  'ServiceOrganizationUtilAJAX' from scope 'Agency Support Model')?

This error is occurring in Workspace form within 'SAGA Services' scope.

I'm having problems figuring out what scope to put the update set in, compared to the source scope and target scope.  Can you help with the information above?