--- sourceDocument: Brazil Sales Customer Relationship Management sourceDocumentLink: https://www.servicenow.com/docs/r/order-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Sales Customer Relationship Management ft:clusterId : - omgmt bundleId : - omgmt workflow : - Customer and Industry --- # CPQ: User Access Control # CPQ: User Access Control {#ariaid-title1} Release version: Brazil Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of CPQ: User Access Control The User Access Control feature in ServiceNow CPQ allows administrators to precisely manage user permissions across various CPQ areas. This feature must be enabled via a support request through the ServiceNow Support portal. It is designed to control access to CPQ Admin functions and restrict or enable capabilities such as reading, editing, deploying, and managing tables and utilities. Show full answer Show less ## Access Levels and Areas Access levels range from **NONE** , **READ** , **EDIT** , to **ADMIN**, progressively granting more permissions. These levels apply to different access areas, including: * **ENDUSER:** Basic runtime user permission. * **CONFIG:** Configuration access including the Matrix Loader and catalog enrichment scripts. * **TRANSACTION:** Ability to manage transactions and use the Matrix Loader. * **MANAGEDTABLES:** Permissions for specific tables, allowing granular control beyond general managed tables access. * **DEPLOY:** Controls deployment of blueprints, product catalogs, filters, and enrichment scripts. * **UTILITIES:** Access to logs, runtime clients, admin API keys, external connections, and settings. Table-level permissions can be customized individually and combined with overall managed tables permissions for fine-grained access control. ## User Roles and Endpoint Access User roles correspond to access areas and levels, mapping to specific API endpoint permissions: * **READ** allows GET requests. * **EDIT** includes POST, PUT, PATCH, DELETE requests. * **ADMIN** adds access to Matrix Loader endpoints or full deployment capabilities. Some roles, like DEPLOYADMIN and UTILITIESADMIN, have exclusive administrative rights without intermediate EDIT or READ levels. ## Modifying Access Controls Administrators can update user access through CSV imports in the User Access utility (Admin \> Utilities \> User Access). The utility provides a list of current users and their access levels, with tooltips for quick review. CSV files can be used to add, modify, or delete user permissions. Sample CSV formats are provided for: * Default full-access admin users * Complex multi-area access configurations * Table-specific permissions additions or removals Successful imports are confirmed by system messages, ensuring administrators can efficiently control user access at scale. ## Practical Benefits for ServiceNow Customers * Enables granular control over who can view, edit, deploy, or administer CPQ components. * Supports compliance and security policies by restricting access areas and actions. * Facilitates bulk user permission management via CSV import, saving administrative effort. * Allows tailored permissions per user, including table-specific access, enhancing operational flexibility. View access types, access areas, and user roles that can be managed via the User Access utility. Note: This feature must be enabled by support request. Create a support case by using the [ServiceNow Support portal](https://support.servicenow.com). For step-by-step instructions, see [Create a case on Now Support for CPQ Customers](https://support.servicenow.com/kb?sys_kb_id=d67d3e71475d7a90f64de825126d4326&id=kb_article_view). Use the User Access utility to manage access to CPQ Admin. Admin users have full admin access unless their access level is modified via CSV import. For basic user access in CPQ, see [User access](https://www.servicenow.com/docs/GF2UmtSYsXRFSVIvIg1Ixg "Learn how to grant or revoke admin access for a user. Existing users have admin access by default, while new users have only end-user access."). ## Access levels {#logik_admin_user_access_control__access_types} * NONE * READ * EDIT * ADMIN {#logik_admin_user_access_control__ul_srj_f1l_fhc} ## Access areas {#logik_admin_user_access_control__areas} * END_USER * CONFIGUsers with ADMIN can use the Matrix Loader, including product filters and the catalog enrichment script MANAGED_TABLES. * TRANSACTIONUsers with ADMIN can use the Matrix Loader. * MANAGED_TABLES * TABLE Applies permissions for an individual table listed in addition to any MANAGED_TABLES access level. Examples: * EX: MANAGED_TABLES: NONE + TABLE "myTable" Edit = ability to edit "myTable" only * EX: MANAGED_TABLES: READ + TABLE "myTable" Edit = ability to read all tables and edit "myTable" {#logik_admin_user_access_control__ul_pg5_y1l_fhc} * DEPLOY * Applies all blueprint, transaction, product catalog enrichment, and product filter deploys * Roles are either NONE or ADMIN UTILITIES {#logik_admin_user_access_control__ul_yjl_1bl_fhc} * UTILITIES * Logs, user access, runtime clients, admin API keys, external connections, settings, webhooks, connections * Products (for Ecommerce tenants) {#logik_admin_user_access_control__ul_ppz_fbl_fhc} {#logik_admin_user_access_control__ul_fgn_h1l_fhc} ## Tables {#logik_admin_user_access_control__section_dsj_yxq_qhc} User access can be limited to specific tables via CSV or API. Note: These are additive permissions with the overall tables permission set, so if the user has read access for all tables, the individual permission of NONE would have no effect. ## User roles {#logik_admin_user_access_control__section_gqq_mcl_fhc} * END_USER: This is the only permission for the runtime * CONFIG_NONE / CONFIG_READ / CONFIG_EDIT / CONFIG_ADMIN * READ correlates to GET endpoints * EDIT additionally correlates to POST PUT PATCH DELETE endpoints * ADMIN additionally correlates to Matrix Loader endpoints {#logik_admin_user_access_control__ul_xhw_tcl_fhc} * TRANSACTION_NONE / TRANSACTION_READ / TRANSACTION_EDIT / TRANSACTION_ADMIN * READ correlates to GET endpoints * EDIT additionally correlates to POST PUT PATCH DELETE endpoints * ADMIN additionally correlates to Matrix Loader endpoints {#logik_admin_user_access_control__ul_cjw_xcl_fhc} * MANAGED_TABLES_NONE / MANAGED_TABLES_READ / MANAGED_TABLES_EDIT / MANAGED_TABLES_ADMIN * READ correlates to GET endpoints * EDIT additionally correlates to POST PUT PATCH DELETE endpoints * ADMIN additionally correlates to Matrix Loader endpoints {#logik_admin_user_access_control__ul_odh_ycl_fhc} * DEPLOY_NONE / DEPLOY_ADMIN (no EDIT or READ): ADMIN everything deployment related, including Product Filter Rules and Product Catalog Enrichment Deployments * UTILITIES_NONE / UTILITIES_READ / UTILITIES_ADMIN (no EDIT) * READ correlates to GET endpoints * ADMIN correlates to everything else {#logik_admin_user_access_control__ul_jd1_bdl_fhc} {#logik_admin_user_access_control__ul_jmt_ncl_fhc} ## Modifying access controls {#logik_admin_user_access_control__modifying_access_controls} Admin users can modify access via CSV upload (Admin \> Utilities \> User Access). The User Access list shows existing users. Steps: 1. Hover a tooltip to view a userʼs access. 2. Create a CSV file to add users, make changes to users, or delete users. (See below for sample CSV files.) 3. Import the CSV file. You will receive a message confirming success or failure. {#logik_admin_user_access_control__ol_qmk_fdl_fhc} Changes to user list are now made. ## Sample CSVs {#logik_admin_user_access_control__section_mtl_zxq_qhc} Default all-access admin CSV: name,userName,area,access,action User,email@example.com,DEPLOY,ADMIN, User,email@example.com,UTILITIES,ADMIN, User,email@example.com,CONFIG,ADMIN, User,email@example.com,TRANSACTION,ADMIN, User,email@example.com,MANAGED_TABLES,ADMIN, Example complex-access CSV: name,userName,area,access,action User 1,user.one@example.com,DEPLOY,ADMIN User 2,user.two@example.com,UTILITIES,ADMIN User 2,user.two@example.com,CONFIG,ADMIN User 2,user.two@example.com,TRANSACTION,ADMIN User 3,user.three@example.com,END_USER,END_USER User 4,user.four@example.com,END_USER,END_USER,DELETE User 5,user.five@example.com,CONFIG,ADMIN User 5,user.five@example.com,TRANSACTIONS,ADMIN User 5,user.five@example.com,MANAGED_TABLES,READ User 5,user.five@example.com,UTILITIES,ADMIN User 5,user.five@example.com,DEPLOY,ADMIN User 6,user.six@example.com,CONFIG,ADMIN CSV adding user to the table "sampleTable": name,userName,area,access,variableName,action John Smith,john.smith@example.com,CONFIG,ADMIN,,UPSERT John Smith,john.smith@example.com,TRANSACTIONS,ADMIN,,UPSERT John Smith,john.smith@example.com,TABLE,ADMIN,sampleTableName,UPSERT Jane Doe,jane.doe@example.com,MANAGED_TABLES,READ,,DELETE Jane Doe,jane.doe@example.com,UTILITIES,,NONE