---
sourceDocument: Australia Operational Technology Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/operational-technology

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Operational Technology Management

ft:clusterId :

    - optm

bundleId :

    - optm

workflow :

    - Technology


---

# Migrating site user access to user criteria and groups

# Migrating site user access to user criteria and groups {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Migrating site user access to user criteria and groups

This content explains the migration process for site user access control within the ISA Equipment Model on the ServiceNow platform, focusing on upgrades to versions 1.0.12 and 4.2.0.
It details how user access transitions from site user records to a more granular, user criteria- and group-based model that enhances permission management for equipment model entities tied to specific sites.
Show full answer Show less  

## Key Changes and Features in Version 1.0.12

* Improved site-level access control using user criteria to define read or write permissions for equipment model entity sites.
* Automatic migration of existing site user records to the new model, preserving existing access levels.
* Creation of system-generated user criteria and user groups for each site, categorized by viewer (read) or editor (write) access.
* Introduction of new tables to manage user criteria associations for viewing and editing equipment model entities.
* Removal of the Site User application menu and related lists, replacing them with new application menu items and related lists focused on read and edit access via user criteria.
* Assignment of OT viewer (cmdbotviewer) and OT editor (cmdboteditor) roles to control access to Operational Technology (OT) devices within assigned sites.

## Key Changes and Features in Version 4.2.0

* Replaces user criteria access with granular access controls for Equipment Model Entities.
* Deactivation of existing query business rules on the OT Entity (cmdbotisaentity) table, shifting permission management to OT administrators.
* Access control rules are enforced via three new tables managing entity access by users and groups: isaentityaccess, isaentityuseraccess, and isaentitygroupaccess.
* Validation rules require site selection before assigning access to an entity, with dynamic display of entities filtered by the selected site.
* Two interface options for managing user and group access to equipment model entities are available under All \> Equipment Model - ISA: "ISA Access - by User" and "ISA Access - by Group."
* Introduction of the Primary Equipment Model field in OT device lists, showing the equipment model entity linked to an OT device through an Automates relationship scoped to a site.

## Practical Implications for ServiceNow Customers

* Upgrading to these versions automates and improves the security model by transitioning from legacy site user records to a more flexible and maintainable user criteria- and group-based access control system.
* Administrators gain finer control over who can view or edit equipment model entities and OT devices per site, enhancing compliance and governance.
* The migration process preserves existing permissions while facilitating future scalability and easier permission management.
* Customers should note that user criteria configurations are not supported with ISA Equipment Model version 4.2.0 and plan upgrades accordingly.  
When you upgrade to version 1.0.12 of the ISA Equipment Model, the migration from site user access to user criteria and groups begins automatically.
Note:  
Current users can decide whether to migrate to other available versions of the ISA Equipment Model. However, user criteria configurations aren't available with the ISA Equipment Model version 4.2.0. For more information, see .

## Upgrading to ISA Equipment Model version 4.2.0 {#migrating-site-user-access-to-user-criteria-and-groups__section_shv_p3s_tkc}

The following changes occur when you upgrade to version 4.2.0 of the ISA Equipment Model.

* Granular access for Equipment Model Entities replaces the user criteria access.For more information see, .
* With version 4.2.0 the existing query business rules on the OT Entity (cmdb_ot_isa_entity) table are turned off.
* The OT administrator sets users and groups permission to write, or edit, a site's equipment model entities.
* Access rules are set by three tables:
  * Equipment Model Entity Access (isa_entity_access)
  * Equipment Model Entity User Access (isa_entity_user_access)
  * Equipment Model Entity Group Access (isa_entity_group_access)

  {#migrating-site-user-access-to-user-criteria-and-groups__ul_gpy_yn2_tkc}For more information see, .
* The access control tables enforce two validation rules:{#migrating-site-user-access-to-user-criteria-and-groups__tables-equipment-model-access-control-tables-para-8}

  * A site is required. You must select a site before you can assign access to an entity.
  * The Equipment Model Entity field is hidden until you select a site. After you select a site, the entity field displays only entities that belong to that site.
  {#migrating-site-user-access-to-user-criteria-and-groups__ul_w4h_4j1_lkc}
* There are two options for creating or editing users and groups accesses to a new equipment model entity. Navigate to All \> Equipment Model - ISA then select from these options:
  * ISA Access - by User: for more information see, .
  * ISA Access - by Group: for more information see, .
  {#migrating-site-user-access-to-user-criteria-and-groups__ul_zjb_3ns_tkc}
* The Primary Equipment model field has been added to workspace OT device lists. The Primary Equipment Model (mapped_isa_entity) field displays which equipment model entity has an Automates relationship with Operational Technology (OT) device. This field is associated with a specific site. For more information see, .

{#migrating-site-user-access-to-user-criteria-and-groups__ul_x4d_nls_tkc}

For more information, see

## Upgrading to ISA Equipment Model version 1.0.12 {#migrating-site-user-access-to-user-criteria-and-groups__section_qgh_l3s_tkc}

The following changes occur when you upgrade to version 1.0.12 of the ISA Equipment Model.

* Improved site level access control that uses user criteria to define read or write level user access to equipment model entity sites. Assign the OT viewer (cmdb_ot_viewer) or OT Editor (cmdb_ot_editor) role to have view or edit access to OT devices in the assigned sites.
* When you upgrade to version 1.0.12 of ISA Equipment Model, existing site user records are migrated to an improved access control model using user criteria to preserve the same access permissions. For each site with ISA Entity Site User records, the following changes occur.
  * For users with viewer access:
    * A new user criteria record is created and named Read User Criteria for \<site name\> Site \[System Generated\]
    * A new user group with all site users from this site is created and named Read Group for \<site name\> Site \[System Generated\]
    * A new record in the new Equipment Model Entity View Access table (isa_entity_m2m_user_criteria_can_view) is created with the new user criteria and user group.
    {#migrating-site-user-access-to-user-criteria-and-groups__ul_pgq_vlf_d1c}
  * For users with editor access:
    * A new user criteria record is created and named Edit User Criteria for \<site name\> Site \[System Generated\]
    * A new user group with all site users from this site is created and named Edit Group for \<site name\> Site \[System Generated\]
    * A new record in the new Equipment Model Entity Edit Access table (isa_entity_m2m_user_criteria_can_edit) is created with the new user criteria and user group.
    {#migrating-site-user-access-to-user-criteria-and-groups__ul_o5d_ylf_d1c}
  {#migrating-site-user-access-to-user-criteria-and-groups__ul_spm_vlf_d1c}
* The Site User application menu and Site Users related list on the Equipment Model Entity record for a site is removed.
* All site user (isa_entity_site_user) records are set to inactive.
* The Site User -- Can Read and Site User -- Can Edit application menu items are added to the ServiceNow AI Platform.
* The Can Read Equipment Models and Can Edit Equipment Models related lists are added to the Equipment Model Entity record for a site.
{#migrating-site-user-access-to-user-criteria-and-groups__ul_az1_tlf_d1c}