Hello community,
Hope everyone is doing great!
As Service-now rolls out Washington DC release, the most talked about feature in this release is 'Time-Limited User Roles'.
How does it work?
Well, to put together in a single line, it is a feature that provides a user with a particular role for a limited amount of time which you define. To safeguard this feature so that it’s not utilized incorrectly this feature has a built-in option so that the role cannot be provided for more than 2 weeks.
Although, it’s very rare that someone will misuse this feature, it is a two-edged sword for ‘admin’ role. Why is that? Let’s dive in with an example.
Let’s say we have @Chuck, who came as a senior developer to conduct a maintenance over the weekend. In order to complete proper maintenance services, Chuck needs to have administrative privileges during the span of weekend, so he’s been granted admin role with time-limited user roles feature. Be mindful that this has to be only for the weekend.
Come weekend, Chuck starts to work on the maintenance where he got to know that he’s been assigned time-limited admin role. Here’s how:
Now, Chuck being a naughty developer with a sharp mind wants to explore what it is and finds out about time-limited roles. He then goes to the module and opens the record which has his name on it and tries to extend the time period to more than just the weekend (let’s say for a month). He gets an invalid update error quoting time-limited role may not be active for more than 2 weeks.
Chuck is intrigued now. He goes on to digging how it’s working and finds out the business rule stopping that update and changes the valid period from 2 weeks to 7 weeks. See comparison below:
After that he goes on to time-limited roles record and extends the time period for a month. Voila, the role which was provided for 2 days got extended for a month now.
While many organizations having a proper practice in place, the chances of this happening is very thin but still it’s a feature to lookout for. The person having an admin role via time-limited user roles is like a dark knight in the kingdom. And since few of the roles in Service-now incur licensing, this might lead to paying extra if not monitored properly.
Please give a thumbs up and mark it helpful if you like this article.
Cheers,
Uttkarsh
Hello,
We have just upgraded to Washington DC release. When i access the Time-Limited Role form and click on create new, I click on the look up on "Role" and can only see three roles available, admin, impersonator and snc_read_only. How do i get the itil role to be selectable.
Thank you!
When I go into this property, its read only :(, how can i update it?, i have elevated my.
