--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-xanadu-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zx bundleId : - delta3zx --- # Combined Incident Management release notes for upgrades from Xanadu to Zurich # Combined Incident Management release notes for upgrades from Xanadu to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 9 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Incident Management Release Notes: Upgrades from Xanadu to Zurich This consolidated guide covers all Incident Management updates from the Xanadu through Zurich releases, enabling ServiceNow customers to prepare effectively for their upgrade. It outlines new features, significant changes, and important upgrade tasks. The focus is on improving operational efficiency, security, user experience, and workflow enhancements within Incident Management. Show full answer Show less ## Key Features * **Yokohama Release:** * **Service Desk Agent Role:** Introduction of `snservicedeskagent` role designed for tier 1 agents to streamline incident handling. It bundles several write roles and integrates AI and knowledge roles when the appropriate plugins are installed. * **Enhanced Security Model:** Automatic activation of Deny-Unless ACLs restricts unauthorized access to incident-related tables, improving data security. This applies to multiple incident tables and requires installation and testing of the ITSM Enhanced Security Features plugin. * **Email Notification Link Redirection:** Email links to incident and major incident records can now open in Service Operations Workspace (SOW) instead of the classic UI16 interface, controlled by system properties and user roles, supported by the ITSM Notifications Redirection plugin. * **Incident and Problem Workflow:** Fixes shared from problems are added as private work notes in incidents to improve communication clarity; requires enabling a system property for upgrades. * **Incident Reopening Behavior:** Agents, callers, and requesters can reopen resolved incidents via classic UI16 form and portals, with role-based visibility controls. * **CI Sorting Improvement:** Configuration Items (CIs) in incident forms are now sorted alphabetically by CI name, enhancing search performance and UI responsiveness. * **Zurich Release:** * **Coral Theme:** Introduction of the Coral theme as the default for portals and mobile/web experiences with Next Experience or Core UI enabled, including a dark mode option for better readability and reduced eye strain. * **Incident Task Record Behavior:** Closed incident tasks are locked from further editing to maintain data integrity and reduce audit risk. * **Enhanced Incident and Problem Workflow:** Sharing fixes, workarounds, and linking Known Error articles automatically generates activity stream events on associated incident records, improving traceability and collaboration. ## Important Upgrade Considerations * **Pre- and Post-Upgrade Tasks:** Customers should review and complete specified tasks before and after upgrading to Zurich to ensure smooth transition, especially related to security plugin installation and testing. * **Plugin Dependencies:** Several features depend on plugins such as ITSM Roles, ITSM Gen AI, ITSM Enhanced Security Features, and ITSM Notifications Redirection, which must be installed and activated as needed. * **Role and Permission Management:** Proper assignment of roles like `snservicedeskagent` and `snsowuser` is essential to leverage new capabilities such as email link redirection and reopening incidents. * **System Properties Configuration:** System properties control behaviors like email redirection and communication of problem workarounds; admins should configure these according to organizational policies. ## Activation and Compatibility * Incident Management remains an AI Platform feature active by default across all releases. * Coral theme and dark mode enhance accessibility and user experience with no additional activation steps specified. * There are no new browser or localization requirements noted from Xanadu through Zurich. ## Key Outcomes for ServiceNow Customers * Improved operational efficiency for service desk agents through dedicated roles and streamlined workflows. * Enhanced data security by preventing unauthorized access to sensitive incident-related tables. * Greater flexibility and user experience improvements with customizable email notification link targets and a modernized UI theme. * Stronger data integrity and auditability by locking closed incident tasks from further edits. * Better communication and traceability between incidents and problems, aiding faster issue resolution. * More intuitive CI selection and incident reopening capabilities facilitating smoother incident lifecycle management. Consolidated page of all release notes for Incident Management from Xanadu to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Incident Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Incident Management to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-incidentmanagement-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Incident Management. {#dfrn3-incidentmanagement-summary__entry__10} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [User role for service desk agents](https://www.servicenow.com/docs/access?context=inci-roles-instld-itsm-roles&family=yokohama&ft:locale=en-US) : With the sn_service_desk_agent user role, increase the operational efficiency by streamlining the process of asking about, gathering, and verifying information, as well as delivering quick resolutions. This role is designed for tier 1 service desk agents and is accessible when the ITSM Roles plugin (com.snc.itsm.roles) installed. The sn_service_desk_agent role includes the following user roles: * sn_incident_write * sn_problem_write * sn_change_write * sn_request_write * tracked_file_reader Additionally, with the installation of the ITSM Gen AI (com.sn.itsm.gen.ai) plugin, the knowledge_user, and now_assist_panel_user roles are integrated within the sn_service_desk_agent role. The sn_service_desk_agent role can be used starting with SOW version 6.1. [Enhanced security model adoption for incident tables](https://www.servicenow.com/docs/access?context=activate-itsm-enhanced-security-inci-mangmnt&family=yokohama&ft:locale=en-US) : Help prevent unauthorized access to incident-related tables using Deny-Unless ACLs. A Deny-Unless authentication ACL restricts access for a non-authenticated user, such as a public role user. Without access, the user can't perform any actions on incident-related tables, including reading, writing, deleting, creating, or accessing the report view. This feature is activated automatically and applicable on the following incident-related tables: * kb_template_incident_kcs_articl * kb_template_incident_kcs_template Additionally, this feature is available on the following incident-related tables of new or zBoot instances after installing the ITSM Enhanced Security Features (com.snc.itsm.enhanced_security) plugin: * incident * incident_task * task_ci * task outage The ITSM Enhanced Security Features (com.snc.itsm.enhanced_security) plugin can be installed and activated by an admin via a support request. Existing or upgrade users must test and evaluate the results in their non-production instance, and then install the plugin and implement the security change in their production instance. For more information, see [Deny-Unless ACL](https://www.servicenow.com/docs/access?context=acl-denial-behavior&family=yokohama&ft:locale=en-US). | | Zurich | No updates for this release. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Incident Management features. {#dfrn3-incidentmanagement-summary__entry__18} | Release | Release notes | |-|-| | Xanadu | [Email notification link redirection behavior](https://www.servicenow.com/docs/access?context=t_ViewIncidentNotification&family=xanadu&ft:locale=en-US) : In email notifications, you can now decide where the links to an incident record are redirected. Instead of an incident record automatically opening in the classic UI16 interface in Incident Management, the incident record can be opened in SOW. The incident record link in an email notification opens in SOW only if the following conditions are met: * The Redirect SOW Email notification (sow_email_notification_redirect) system property is set to true. * The user selecting the incident record link has the sn_sow.sow_user role. The ITSM Notifications Redirection (com.snc.itsm.notifications_redirection) plugin is installed and activated automatically to support this behavior. To ensure consistency, the email notification template is updated to send the notification from SOW in the same format as sent from classic UI16 interface. Also, the template theme is updated to match the Next Experience theme. | | Yokohama | [Email redirection behavior for major incident email notification links](https://www.servicenow.com/docs/access?context=email-notif-redirt-inci-major-inci&family=yokohama&ft:locale=en-US) : In major incident email notifications, you can now decide where the links to a major incident record are redirected. Instead of a major incident record automatically opening in the classic UI16 interface in Major Incident Management, the record can be opened in SOW. The major incident record link in an email notification opens in SOW only if the following conditions are met: * The Redirect SOW Email notification (sow_email_notification_redirect) property is set to true. Setting this property to true enables the email redirection behavior for all tables including major incident. * The Redirect SOW Email notification for Major Incident Management (sn_major_inc_mgmt.sow_email_notification_redirect.mim) property is set to true. * You have the sn_sow_user role. The ITSM Notifications Redirection (com.snc.itsm.notifications_redirection) plugin is installed and activated automatically to support this behavior. [Email redirection behavior for incident email notification links](https://www.servicenow.com/docs/access?context=email-notif-redirt-inci-major-inci&family=yokohama&ft:locale=en-US) : In incident email notifications, you can now decide where the links to an incident record are redirected. Instead of an incident record automatically opening in the classic UI16 interface in Incident Management, the record can be opened in SOW. The incident record link in an email notification opens in SOW only if you have the sn_sow_user role and any of the following conditions are met: * The Redirect SOW Email notification (sow_email_notification_redirect) property is set to true. Setting this property to true enables the email redirection behavior for all tables including incident. * The Redirect SOW Email notification for Incident Management (sow_email_notification_redirect.incident) property is set to true. You can create this property if you want to enable or restrict the email redirection behavior specifically for the incident table. This property, if created and set, overrides the Redirect SOW Email notification (sow_email_notification_redirect) base system property. The ITSM Notifications Redirection (com.snc.itsm.notifications_redirection) plugin is installed and activated automatically to support this behavior. To ensure consistency, the email notification templates for incident tasks are also updated to send the notification from Service Operations Workspace (SOW) in the same format as sent from classic UI16 interface similar to incident. Also, the template theme is updated to match the Next Experience theme. [Incident and problem workflow changes](https://www.servicenow.com/docs/access?context=incident-management-properties&family=yokohama&ft:locale=en-US) : When a problem is fixed and the Share fix option is triggered, the event is added to the Work notes (Private) field instead of the Additional comments (Customer visible) field for the incident associated with the problem record. This feature is available in the base system for the new customers. For existing or upgrade customers, admin must set the Communicate problem workaround to incident worknotes (com.snc.incident.communicate_prb_workaround_to_inc_worknotes) system property to true to enable the feature. [Changes in the reopening incident behavior](https://www.servicenow.com/docs/access?context=reopening-incident&family=yokohama&ft:locale=en-US) : Enable the agents with incident write access, callers, requesters, or Opened by end users to reopen a resolved incident. Both the caller and the requester can view and use the Reopen option on the incident classic UI16 form and the Portal UIs, such as Service Portal and Employee Service Center (ESC) portal. An agent can view and use the Reopen option on the incident classic UI16 form to reopen any incident that is assigned to them or to other agents. However, on the Portal UI, an agent can only view and use the Reopen option to reopen an incident if it's assigned to them. [Sorting CIs in incident forms](https://www.servicenow.com/docs/access?context=create-an-incident&family=yokohama&ft:locale=en-US) : The search performance of the available CIs for the Configuration item field on an incident form is enhanced to promote a clean UI and quick loading and sorting of the CIs. The search results that list the CIs are sorted alphabetically by CI name instead of by CI class and then CI name. The ref_ac_order_by=sys_class_name attribute is removed from the default attributes on the cmdb_ci field of the Task \[task\] table, which increases the performance of the field. This change is applicable to new and existing users using the default attributes. You can use the Override attributes option to restrict this change for any required child tables that extend to the cmdb_ci field of the Task \[task\] table. | | Zurich | Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Incident task record behavior changes](https://www.servicenow.com/docs/access?context=create-incident-task&family=zurich&ft:locale=en-US) : When an incident task is closed, you can no longer edit the field values in the incident task form. Disabling the fields helps prevent any further updates or modifications to closed incident tasks, reducing audit risks. [Incident and problem workflow changes](https://www.servicenow.com/docs/access?context=working-incident-record-form&family=zurich&ft:locale=en-US) : When a problem record is linked to an incident or multiple incidents, the incident and problem workflow has the following enhancements: * When a fix or workaround is shared from the problem record, an event is added in the activity stream of the incident record as work notes. The event includes a brief description of the provided fix or workaround and a link to the problem record. * When a Known Error (KE) article is linked to the problem record, an event is added in the activity stream of the incident record as work notes. The event includes the links to the problem record and the KE article. | [ ] ## Removed Between your current release family and Zurich, some Incident Management features or functionality were removed. {#dfrn3-incidentmanagement-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Incident Management features or functionality were deprecated. {#dfrn3-incidentmanagement-summary__entry__34} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate Incident Management. {#dfrn3-incidentmanagement-summary__entry__42} | Release | Release notes | |-|-| | Xanadu | Incident Management is a ServiceNow AI Platform feature that is active by default. | | Yokohama | Activation information : Incident Management is a ServiceNow AI Platform feature that is active by default. | | Zurich | Activation information : Incident Management is a ServiceNow AI Platform feature that is active by default. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Incident Management we have noted them here. {#dfrn3-incidentmanagement-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Incident Management we have noted them here. {#dfrn3-incidentmanagement-summary__entry__58} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Incident Management, such as specific requirements or compliance levels. {#dfrn3-incidentmanagement-summary__entry__66} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | [ ] ## Localization information If there are specific localization considerations for Incident Management we have noted them here. {#dfrn3-incidentmanagement-summary__entry__74} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Incident Management we have noted them here. {#dfrn3-incidentmanagement-summary__entry__82} | Release | Release notes | |-|-| | Xanadu | Control when an incident record link in the email notifications redirects to the incident record in Service Operations Workspace (SOW). See [Incident Management](https://www.servicenow.com/docs/access?context=c_IncidentManagement&family=xanadu&ft:locale=en-US) for more information. | | Yokohama | * Increase the operational efficiency of the tier 1 service desk agents with the dedicated sn_service_desk_agent role. * Control whether an incident or major incident record link in an email notification redirects you to the record in the classic UI16 interface or Service Operations Workspace (SOW). * Enable agents with incident write access, callers, requesters, and Opened by end users to reopen a resolved incident from the Incident Management classic UI16 form, SOW, or Portal UIs. * Restrict unauthorized access to incident-related tables using deny ACLs. * Search for a configuration item (CI) in a list alphabetized by the CI name with an improved search performance. See [Incident Management](https://www.servicenow.com/docs/access?context=c_IncidentManagement&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * Help prevent changes to closed incident tasks to promote data integrity and to maintain a clear audit. * Manage and resolve incidents effectively with the incident and problem workflow enhancements. * Coral is the new default theme for Next Experience and Core UI, offering a more user-friendly experience. See [Incident Management](https://www.servicenow.com/docs/access?context=c_IncidentManagement&family=zurich&ft:locale=en-US) for more information. | [ ]