--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Domain separation explained # Domain separation explained {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Domain Separation Explained Domain separation allows for the segregation of application data, user interface (UI), and business logic within a single ServiceNow instance. This capability enhances efficiency, security, and performance for various customer tenants while supporting specific hierarchical structures. However, it also introduces management complexities and cannot separate certain global standards. Show full answer Show less ## Key Features * **Data Separation:** Ensures that tenants can only access data they are authorized to view, enhancing data security. * **UI Separation:** Creates a tailored tenant-specific user experience by customizing UI elements like menus and dashboards, while retaining core process logic. * **Business Logic Separation:** Allows for the creation of tenant-specific policies, such as notifications and business rules. * **Hierarchical Modeling:** Supports nested tenant structures, enabling parent tenants to manage child tenants and their resources. * **Cross-Tenant Intelligence:** Facilitates automatic handling of data and business logic across tenants with shared access. ## Key Outcomes Implementing domain separation enables service providers to efficiently and securely manage a multitenant architecture. This leads to improved governance, centralized administration, and the ability to customize services for individual clients. By adhering to best practices, organizations can maximize the benefits of domain separation while ensuring robust process standards and data integrity. With domain separation, you can segregate application data, UI, and business logic, such as rules or workflows, in a single customer instance. Separating these elements into logically defined domains supports specific hierarchies for all customers using your applications. ## Domain basics {#bp-what-is-domain-separation__section_wwv_myf_khb} Domain separation, also known as ServiceNow multitenant platform architecture, adds considerable overhead to the management of an instance. If you use domain separation correctly though, it can improve efficiency, add greater security, and increase the performance of your customers' instances. You can't separate some global standards and properties, such as system properties and table schema, per tenant. Before you start separating domains, read the following guidelines. ## What you can do with domain separation {#bp-what-is-domain-separation__section_hpq_2kt_phb} * Data separation: Enables tenants of the domain to see only data that they have permissions to see. Tenants can be granted access to other tenant data but can't query tenant data that they don't have access to. * When you update data records, they do not generate Update Set records. * Users, including the customer accounts that are used for integrations, see only the data in the domains they have permission to access. * Customers, agents, and fulfillers see data that pertains to the customers and organizations that they support. {#bp-what-is-domain-separation__ul_xfb_dhc_qhb} * UI separation: Supports a tenant-specific experience for UI elements such as views, lists, labels, and so on. * You can override the browser-based user interface, including application menus, lists, forms, and dashboards. You can also customize them for a specific domain or set of domains while preserving your basic process logic. * Service providers can alter the displayed branding and UI elements to meet individual customer needs. {#bp-what-is-domain-separation__ul_lvj_xgc_qhb} * Business logic separation: Creates tenant-specific system policies such as email notifications, business rules, client scripts, UI policy, and UI actions. * Hierarchical modeling: Nests your multiple tenants so that parent tenants can access child tenant resources. Business logic for parent tenants runs automatically for child tenants, which you can override at any level. * Cross-tenant intelligence: Automatically handles data, metadata, business logic, and processing context for tenants with access to additional tenant data. {#bp-what-is-domain-separation__ul_wpw_qkt_phb} ## Domain separation at a glance {#bp-what-is-domain-separation__section_gzh_dy5_phb} The following graphic shows the division of data, process, and UI separation. These concepts are discussed in depth in the Recommended Practices section. ## Domain architecture {#bp-what-is-domain-separation__section_sjc_zyx_slb} User records are assigned a domain value that represents the user's home domain. Users have no access to data in parent domains, peer domains, or domains in other branches of the hierarchy. See [Contains queries and domain access](https://www.servicenow.com/docs/LPE1HDlwwx5n8HfVnHEblg "Use a \"contains\" query only in special cases, such as when users or groups need to see data from a domain that they don't have access to, but you don't want to move those users to a domain. Creating domain \"contains\" and user or group access for a domain should be an exception, only when absolutely needed.") for advanced options to grant additional domain visibility. The following diagram shows how the architecture process flows down to the child domains. * **[Domain separation value proposition](https://www.servicenow.com/docs/M3MhR17d_RyOcthdYwpYIw)** With domain separation, service providers can have a multitenant instance architecture that delivers offerings efficiently and securely to their clients. Strong universal process standards, data-driven process design, strict governance, and centralized administration help to maximize these benefits. * **[Definition of domain separation](https://www.servicenow.com/docs/XN_qTmDXBXzhc_VXPazQcQ)** With domain separation (also known as the ServiceNow® Multitenant Platform Architecture), you can segregate application data, UI, and business logic in a single customer instance that supports hierarchical modeling with cross-tenant (customer) intelligence. **Related concepts** * [Context and domain separation](https://www.servicenow.com/docs/8IdT7poOPSjnH1a7RWtNnA "The context of a user's session determines the processes, data, and user interface (UI) as the user browses through list views, home pages, reports, and knowledge articles. The context is determined by the processes that you create, the business rules that you set, your workflows, and other factors.") * [How a database query works with domain separation](https://www.servicenow.com/docs/wZpwN~p06UgwfrHUiMZGrQ "Using database queries with domain separation in your customers' applications help them protect their data. These queries then speed up the configuration and build processes.") * [Domain-separate a custom table](https://www.servicenow.com/docs/8i4ubVyBwq~cirV5_p74Ag "You may need to create custom tables in separate domains. This topic covers both the procedure and the concept behind domain-separating a custom table.") * [Customizing domain properties and themes](https://www.servicenow.com/docs/MM8ZllpSOahvC2ZqWOp4Eg "You can customize your customers' company properties and themes within the domains that you have configured. Customization makes their instances fit in with their companies' overall look and feel.") * [Managing domain separation for specific uses](https://www.servicenow.com/docs/5dayGwYX9kWTu2g~XZauHA "You can set up separate domains for email notifications and customize the properties of catalog, tables, users, groups, and views. This enables you to provide more specific behavior in each domain, giving your customers more flexibility.") * [Configuring domain separation with the domain picker](https://www.servicenow.com/docs/0XZatCCIrKdtYhhZ3iSj7A "Use the domain picker wisely, and remember the 80/15/5 approach so that you do not customize too much and impact the performance of your instance.") * [Domain separation performance considerations](https://www.servicenow.com/docs/Ke077acfchULVvyDKucu_w "As you configure domain separation in your application and services, make sure that you consider the number and properties of domains you create. Too many property-heavy domains can impact the performance of your instance.") * [Setting up domain hierarchies](https://www.servicenow.com/docs/5q6CmctVfMioSVRBvRN9~w "You can avoid slowdowns and performance impacts in your instance by knowing how domain hierarchies work and by setting them up properly.") * [Checking domain logs for errors and warnings](https://www.servicenow.com/docs/GO5JiDK9eqY~p5C_YHCwjg "Check the domain logs to find errors or warnings in your domain path processes and hierarchy configurations.") * [Importance of the Default domain](https://www.servicenow.com/docs/uycoUdfydm~RAk7SKTh3FQ "Organizing your domains is a crucial part of the domain separation process. If you don't set a default domain, new tasks and user records go to the global domain. Anyone can see the records in the global domain, which means that data can be seen when it is not supposed to.") * [Contains queries and domain access](https://www.servicenow.com/docs/LPE1HDlwwx5n8HfVnHEblg "Use a \"contains\" query only in special cases, such as when users or groups need to see data from a domain that they don't have access to, but you don't want to move those users to a domain. Creating domain \"contains\" and user or group access for a domain should be an exception, only when absolutely needed.") * [Domain paths query method](https://www.servicenow.com/docs/IzgRztDfA8u4Se~i_8aLxA "You can create effective queries with domain paths.") * [Slow queries and SQL debugging](https://www.servicenow.com/docs/blwsgcOvxbvM~Mbt_HRk7g "Debugging SQL and slow queries can help you resolve slowness issues in an instance.") * [Before Query business rules](https://www.servicenow.com/docs/k2rw1vg2aT0OOqtVVHOatA "You can use a Before Query business rule to help support data segregation on an instance. ServiceNow applications that support domain separation may support the separation of data and data routing only, have advanced business logic separation, or support tenant (customer) level administration of the application.") * [Avoiding domain path in scripts](https://www.servicenow.com/docs/Ji30fuBJKa9pfhcwR8S6Ow "Domain paths can cause the values of your script to change or even break, so don't use them in scripts.") * [Domain separation and the Customer Service Management (CSM) plugin](https://www.servicenow.com/docs/47CXqpn8bf4Xkam_3F~Ojg "For the best outcome, be aware of how the properties in the CSM plugin work. When the plugin is enabled, you can see the status of your records in your domains.") **Related reference** * [Domain separation hierarchies](https://www.servicenow.com/docs/FU4uSx72vTBxmUxHdwvOlA "Create a hierarchy when defining a domain architecture to track your processes and workflows.") * [Segregating and securing data with domain separation](https://www.servicenow.com/docs/_1CQOcHGJjC~8iuCSqhiiw "You can segregate and secure data on the ServiceNow platform in multiple ways, depending on your customer's needs. ") * [Alternatives to domain separation](https://www.servicenow.com/docs/np_ANNI0FUhEvTbx9og~_A "You can use a separate instance as an alternative to domain separation for your customers. A separate instance allows you the flexibility to meet the requirements for data separation within the groups and departments in an organization with little to no impact on others.") * [Evaluating the need for domain separation](https://www.servicenow.com/docs/D74iFr6TvK9eyF4G4QSW~g "You may find that domain separation doesn't always work for your customers' organizations. It's best that you base your decision to go with domain separation by looking at your customers' needs.") * [Benefits of domain separation](https://www.servicenow.com/docs/3Z3Y9SP25BZos649SgoB3Q "Domain separation may work better for your customers' organizations than any other method for separating the data between groups and departments.") * [Domain separation levels of support](https://www.servicenow.com/docs/kCr1qyHJb8QJKMSBfbyy5g "Choose from three categories for domain separation of an application for your customers' organizations.") * [Service provider reference architecture](https://www.servicenow.com/docs/MvcyHWTaBjVLRJuydkn~GQ "Your customers can access service provider (SP) services by using a portal that is designed for them to reach their domain-separated instance.") * [Domain separation terms](https://www.servicenow.com/docs/SEK7gvUWMv3ud2X6QlefjA "With a ServiceNow instance, you can improve efficiency, add greater security, and increase performance for your customer organizations. It's helpful to understand some of the most common terms as you create your configurations.") * [Domain assignments](https://www.servicenow.com/docs/C_kaQILPl_gTEggAHs4M6A "How you assign a domain impacts the value of the sys_domain field. The assignments contain designs and business properties that affect how the application functions in each domain.")