Domain separation and Skills Management
Summarize
Summary of Domain separation and Skills Management
Domain separation is fully supported in the ServiceNow Skills Management application, applying to all features without explicit setup. It enables you to logically separate data, processes, and administrative tasks into distinct domains, controlling user access and visibility based on domain membership. This separation extends across user interface elements, caching, reporting, and data aggregations to ensure proper multi-tenant operation.
Show less
The application supports domain separation at runtime, allowing data segregation for service provider use cases, such as ensuring tenant customers see responses from their respective service providers. Instance owners must configure domain separation appropriately to support multiple tenants within the application.
Key Features
- Domain-specific data management: Skills, skill categories, and skill levels can be created and viewed only within assigned domains, including the global domain.
- Role-based access: Users with Skills Management roles can only view and manage skill information in their assigned domain or its child domains.
- Domain columns in skill tables: Tables related to skills include Domain and Domain Path columns to identify the domain context of each record, enhancing filtering and data organization.
- Support for hierarchical domains: Users in parent domains can access skill records in child domains, facilitating management across domain hierarchies.
- Integrated application support: Skill records associated with integrated applications require users to belong to the corresponding domain for access and modification.
Practical Use Cases
- A Skill Manager in a specific domain (e.g., Acme) can create and associate skills only for users in that domain or its parent/global domains.
- Parent domain users can view and manage skills across all child domains but must be in the same domain as the user when creating or associating skills on their behalf.
- Skill Managers with access to multiple domains can update records within specific domains, with the domain context driving the record’s behavior and references.
Key Outcomes
By leveraging domain separation in Skills Management, ServiceNow customers can securely and efficiently manage skill data across multiple tenants or organizational units. This ensures data confidentiality, proper access controls, and streamlined administration aligned with your organizational structure. It also supports complex multi-tenant scenarios common in service provider environments, improving operational clarity and compliance.
Domain separation is supported in the Skills Management app, and configured to apply to all features of the application. Separation of data is configured along with separation of logic and process.
Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.
Support level: Basic
- Business logic: Ensure that data goes into the proper domain for the application’s service provider use cases.
- The application supports domain separation at run time. The domain separation includes separation from the user interface, cache keys, reporting, rollups, and aggregations.
- The owner of the instance must set up the application to function across multiple tenants.
Sample use case: When a service provider (SP) uses chat to respond to a tenant-customer’s message, the customer must be able to see the SP's response.
For more information on support levels, see Application support for domain separation.
How domain separation works in Skills Management
Domain separation is supported in Skill Management with no explicit setup or configuration requirements. Skills, skill categories, skills levels can be created in separate domains, including the global domain. When domain separation is implemented, people with skill app roles can view skill information only in the domain assigned. Domain and Domain Path columns are available for all Skill tables provided with the base system. The Domain column contains the name of the domain to which the event or alert belongs, and the Domain Path column contains the unique domain identifier.
| Table name | Description |
|---|---|
| sys_user_has_skill | User skill information |
| cmn_skill | Main skill table |
| cmn_skill_category | Define skill categories |
| cmn_skill_level_type | Define skill level type |
| cmn_skill_level | Define skill level |
| sys_group_has_skill | Group skills |
| cmn_skill_contains | Define skills contained within skills |
| task_m2m_skill | Task skill information |
- A Skill Manager that belongs to the Acme domain creates a skill and wants to view and associate it to user in the Acme domain. A user must belong to the Acme domain, its parent domain, or the global domain to view the skill record.
- A Skill Manager that belongs to a parent domain tries to view a skill in a child domain. The user of a parent domain can view a skill record of the parent as well as all child domains of that parent.
- A Skill Manager that belongs to a parent domain wants to create/associate a skill on behalf of another user in the Acme domain. A user must belong to the same domain as the user for which the skill record is created.
- A Skill Manager wants to associate a record for an integrated application in the Acme domain. A user must belong to the domain of the integrated application from which a record is associated.
- A Skill Manager has access to multiple domains but wants to update a record with content within a specific domain. The domain specified for the current record drives the functionality of that record and reference fields.