Domain separation and Software Asset Management

  • Release version: Australia
  • Updated March 12, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Domain separation and Software Asset Management

    Domain separation in Software Asset Management (SAM) allows you to segregate data, processes, and administrative tasks into distinct logical groupings called domains. This capability supports multi-tenant environments by enabling complete data and process separation between tenants, ensuring that each tenant's configurations and data remain isolated and secure. It is particularly beneficial for service providers managing assets for multiple customers within a shared ServiceNow instance and for large organizations managing subsidiaries independently.

    Show full answer Show less

    Key Features

    • Enhanced support level: Includes all features from Basic and Standard support levels and enables UI-based, fail-safe configurations that prevent cross-tenant impact.
    • Multi-tenant management: Manage the full SAM lifecycle for multiple customers in a shared environment with tenant-specific administrative controls.
    • Data and process separation: Both data and business processes are domain-separated, ensuring tenant isolation.
    • Role management: The samintegrator role grants access to SaaS integration profile management but should be assigned cautiously due to access to all domain records in the Oauth application registry.
    • Logging and monitoring: Domain separation logs can be enabled and customized via the asset.loglevel system property to debug, trace, or info levels for scheduled jobs related to asset management.
    • Preconfigured data population: The Content Data Service (CDS) populates data with the global domain setting in domain-separated instances.

    Required and Supported Plugins

    To enable domain separation and SAM functionality, certain plugins must be activated:

    • Domain separation extension
    • Performance Analytics – Domain Support
    • Software Asset Management Professional

    Additional supported plugins enhance integration with Service Catalog, Procurement, Cost Management, and Contract Management modules.

    Benefits for Service Providers and Customers

    • Service providers: Can expand their service portfolio by offering managed SAM services, including contract and entitlement management, discovery, software reconciliation, audit response, and license management.
    • Customers: Gain access to professional SAM services without needing to manage the platform or processes themselves, benefiting from domain expertise and secure data separation.

    Best Practices and Considerations

    • Avoid customizing the base system domain configuration record to maintain system integrity and upgrade compatibility.
    • Assign sensitive roles like samintegrator only to trusted users within the service provider organization with appropriate permissions.
    • Be aware of domain separation implications when running software lifecycle reports to ensure data consistency and accuracy.

    Domain separation is supported in Software Asset Management. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

    Support level: Enhanced

    • Includes all aspects of Basic and Standard levels of support.
    • Data-driven process enables service provider customers to modify business logic that is based on defined use cases. These configurations are UI-based and fail-safe so that configurations by one customer cannot affect another.
    • Tenants of the instance must be able to configure minimum viable product (MVP) business logic and data parameters for themselves. This logic and parameters would be expected for the application's normal function.

    Sample use case: Tenant-customers of a shared environment must be able to modify the impact, urgency, or priority matrix to set priority within their domain.

    For more information on support levels, see Application support for domain separation.

    Domain separation support

    Domain separation in Software Asset Management enables service providers to offer managed Software Asset Management services to their customers. It also enables large organizations to manage their subsidiaries as independent domains.

    With multi-tenant support for Software Asset Management, you can manage the entire Software Asset Management lifecycle for your customers in a shared ServiceNow instance. This model provides complete data and process separation between tenants, along with tenant admin support.

    Service provider benefits

    Multi-tenant support for Software Asset Management offers the following benefits to service providers:
    • Expand the service portfolio to include Software Asset Management.
    • Offer Software Asset Management as a service to your users that includes:
      • Contract and entitlement management
      • Discovery and normalization reporting
      • Software reconciliation, optimization, and licensing expertise
      • Audit response
      • Software lifecycle and vulnerability reporting
      • SaaS license management
      • Engineering license management

    Customer benefits

    Customers gain the following benefits when a service provider manages their assets on the shared ServiceNow instance:
    • Access to established Software Asset Management services and processes delivered by domain experts
    • No platform or process ownership required from the customer

    How domain separation works in Software Asset Management

    In Software Asset Management, domain separation occurs in two stages: data separation and process separation. From the Paris release, both data and process are domain-separated.

    Any user with sam_integrator role has access to create and modify the SaaS integration profiles. Since users with this role can also access the Oauth application registry (currently not domain-separated, so records across all domains are visible), this sam_integrator role should be assigned with caution. The user should be in the service provider organization and satisfy high permissions criteria.

    To view logs for domain separation, create a system property named asset.log_level and set its value to debug, trace or info. The level you set determines which logs appear when any scheduled job that extends the AssetManagementBaseJob scheduled job runs.

    In a domain-separated instance, the content data service (CDS) should populate data in the instance with domain set as global.

    Note:

    Avoid customizing the base system domain configuration record. For more information, see Recommended practice.

    Diagram showing how a service provider manages the IT Asset Management lifecycle for multiple tenant customers in a shared ServiceNow instance, with complete data and process separation between tenants

    Required plugins

    • Domain separation extension (com.glide.domain.msp_extensions.installer)
    • Performance Analytics – Domain Support (com.snc.pa.domain_support)
    • Software Asset Management Professional (com.sn_samp_master)

    Other supported plugins

    • Service Catalog – Domain Separation (com.glideapp.servicecatalog.domain_separation)
    • Procurement (com.snc.procurement)
    • Cost Management (com.snc.cost_management)
    • Contract Management (com.snc.contract_management)

    To learn more, see Domain separation explained, Contains queries and domain access, and Importance of Default domain.