ServiceNow CPQ: User Access Control
Summarize
Summary of ServiceNow CPQ: User Access Control
The User Access Control feature in ServiceNow CPQ allows administrators to manage and customize user roles and permissions efficiently. This feature governs access to various CPQ components including transaction, configuration, deployment, and utilities. Access management is performed through the User Access utility, which supports role modifications via CSV imports or API. Note that this feature requires activation through a ServiceNow support request.
Show less
Access Levels and Areas
Access levels define the extent of permissions and include NONE, READ, EDIT, and ADMIN, with ADMIN granting the highest level of control. Access areas specify functional segments of CPQ that can be controlled:
- ENDUSER: Basic runtime user permissions.
- CONFIG: Configuration access including Matrix Loader and catalog enrichment scripts.
- TRANSACTION: Permissions related to transactional operations and Matrix Loader usage.
- MANAGEDTABLES: Granular table-level permissions allowing read or edit access on specific tables beyond general managed tables access.
- DEPLOY: Controls deployment-related actions including blueprint, product catalog enrichment, and product filter deployments.
- UTILITIES: Access to administrative utilities such as logs, API keys, external connections, and settings.
User Roles and Permissions
Roles are structured with specific permission levels that correspond to HTTP endpoint types and utility capabilities:
- READ: Allows GET operations.
- EDIT: Includes POST, PUT, PATCH, and DELETE operations in addition to READ.
- ADMIN: Grants full administrative privileges, including matrix loader and deployment controls.
- Some roles such as DEPLOY and UTILITIES have only NONE or ADMIN levels, reflecting their sensitive nature.
Modifying Access Controls
Administrators can modify user access through CSV uploads in the User Access utility (Admin > Utilities > User Access). This approach supports bulk management actions such as adding, updating, or deleting user permissions. The User Access list provides visibility into existing user roles and their access levels. Key points for CSV usage include:
- Ability to assign access by area and level (e.g., CONFIGADMIN).
- Support for table-specific permissions via the TABLE area with variableName specifying the table.
- Actions include UPSERT for additions/updates and DELETE for removals.
Practical Benefits for ServiceNow Customers
This access control framework enables precise delegation of CPQ administrative and user privileges, enhancing security and operational efficiency. Customers can:
- Limit user actions to only relevant CPQ areas or tables, reducing risk.
- Streamline role management through CSV imports and API operations.
- Ensure compliance with organizational policies by controlling deployment and utility access.
- Maintain full control over product configurations and transactional operations with tailored permissions.
Overall, this utility supports scalable and secure administration of ServiceNow CPQ environments.
View access types, access areas, and user roles that can be managed via the User Access utility.
Use the User Access utility to manage access to ServiceNow CPQ Admin. Admin users have full admin access unless their access level is modified via CSV import.
For basic user access in ServiceNow CPQ, see User access.
Access levels
- NONE
- READ
- EDIT
- ADMIN
Access areas
- END_USER
- CONFIG
Users with ADMIN can use the Matrix Loader, including product filters and the catalog enrichment script MANAGED_TABLES.
- TRANSACTION
Users with ADMIN can use the Matrix Loader.
- MANAGED_TABLES
- TABLEApplies permissions for an individual table listed in addition to any MANAGED_TABLES access level. Examples:
- EX: MANAGED_TABLES: NONE + TABLE “myTable” Edit = ability to edit “myTable” only
- EX: MANAGED_TABLES: READ + TABLE “myTable” Edit = ability to read all tables and edit "myTable"
- DEPLOY
- Applies all blueprint, transaction, product catalog enrichment, and product filter deploys
- Roles are either NONE or ADMIN UTILITIES
- UTILITIES
- Logs, user access, runtime clients, admin API keys, external connections, settings, webhooks, connections
- Products (for Ecommerce tenants)
Tables
User access can be limited to specific tables via CSV or API.
User roles
- END_USER: This is the only permission for the runtime
- CONFIG_NONE / CONFIG_READ / CONFIG_EDIT / CONFIG_ADMIN
- READ correlates to GET endpoints
- EDIT additionally correlates to POST PUT PATCH DELETE endpoints
- ADMIN additionally correlates to Matrix Loader endpoints
- TRANSACTION_NONE / TRANSACTION_READ / TRANSACTION_EDIT / TRANSACTION_ADMIN
- READ correlates to GET endpoints
- EDIT additionally correlates to POST PUT PATCH DELETE endpoints
- ADMIN additionally correlates to Matrix Loader endpoints
- MANAGED_TABLES_NONE / MANAGED_TABLES_READ / MANAGED_TABLES_EDIT / MANAGED_TABLES_ADMIN
- READ correlates to GET endpoints
- EDIT additionally correlates to POST PUT PATCH DELETE endpoints
- ADMIN additionally correlates to Matrix Loader endpoints
- DEPLOY_NONE / DEPLOY_ADMIN (no EDIT or READ): ADMIN everything deployment related, including Product Filter Rules and Product Catalog Enrichment Deployments
- UTILITIES_NONE / UTILITIES_READ / UTILITIES_ADMIN (no EDIT)
- READ correlates to GET endpoints
- ADMIN correlates to everything else
Modifying access controls
Admin users can modify access via CSV upload (Admin > Utilities > User Access). The User Access list shows existing users.
Steps:
- Hover a tooltip to view a userʼs access.
- Create a CSV file to add users, make changes to users, or delete users. (See below for sample CSV files.)
- Import the CSV file.
You will receive a message confirming success or failure.
Changes to user list are now made.
Sample CSVs
Default all-access admin CSV:
name,userName,area,access,action
User,email@example.com,DEPLOY,ADMIN,
User,email@example.com,UTILITIES,ADMIN,
User,email@example.com,CONFIG,ADMIN,
User,email@example.com,TRANSACTION,ADMIN,
User,email@example.com,MANAGED_TABLES,ADMIN, Example complex-access CSV:
name,userName,area,access,action
User 1,user.one@example.com,DEPLOY,ADMIN
User 2,user.two@example.com,UTILITIES,ADMIN
User 2,user.two@example.com,CONFIG,ADMIN
User 2,user.two@example.com,TRANSACTION,ADMIN
User 3,user.three@example.com,END_USER,END_USER
User 4,user.four@example.com,END_USER,END_USER,DELETE
User 5,user.five@example.com,CONFIG,ADMIN
User 5,user.five@example.com,TRANSACTIONS,ADMIN
User 5,user.five@example.com,MANAGED_TABLES,READ
User 5,user.five@example.com,UTILITIES,ADMIN
User 5,user.five@example.com,DEPLOY,ADMIN
User 6,user.six@example.com,CONFIG,ADMIN CSV adding user to the table "sampleTable":
name,userName,area,access,variableName,action
John Smith,john.smith@example.com,CONFIG,ADMIN,,UPSERT
John Smith,john.smith@example.com,TRANSACTIONS,ADMIN,,UPSERT
John Smith,john.smith@example.com,TABLE,ADMIN,sampleTableName,UPSERT
Jane Doe,jane.doe@example.com,MANAGED_TABLES,READ,,DELETE
Jane Doe,jane.doe@example.com,UTILITIES,,NONE