Granular admin roles
Granular admin roles enables you to verify proper access management by assigning roles that define user permissions and responsibilities. By doing so, organizations can maintain security, enforce conformance, and optimize their operations effectively.
Roles are a fundamental part of managing access and maintaining security within your instance. They define what you can see and do, verifying that you have the appropriate level of access based on your responsibilities. By assigning the correct roles to the users, organizations can safeguard sensitive data, enforce conformance, and streamline operations.
To optimize access management within the ServiceNow AI Platform, consider adopting granular admin roles. This approach enables you to assign specific permissions to developers or users who perform minor administrative tasks, without granting them unrestricted access to the full admin role.
Note:
- Users who are assigned with admin role previously will have its granular admin roles assigned based on the product or module that they had access to earlier.
- Each product within the ServiceNow AI Platform has its own set of granular admin roles. To determine the appropriate roles for your administrators or developers, refer to the specific product documentation.
- You can assign the Instance operator (
instance_operator) role for users who handle day-to-day operations without elevated system configuration privileges. Assign this role to users who need to:- Check logs and diagnose problems
- Perform routine maintenance
- Keep workflows running smoothly
- Granular admin roles are separate from the existing admin role and must be assigned independently.
By adopting granular admin roles, you can create a more secure and efficient access management system that aligns with your organization's needs.
| Product | Role Name | Description |
|---|---|---|
| Access Analyzer | access\_analyzer\_admin | Role required to use access-analyzer application. |
| AE - StreamConnect | message\_replication\_admin | Role required to access all IntegrationHub stream replication features, enable setup and connection to message brokers, and configure message stream replications. |
| AE - StreamConnect | stream\_connect\_admin | Role required to manage Stream Connect-related settings for subscriptions, topics, and other configurations. |
| Agent Chat | awa\_admin | Role required to access granular AWA capabilities. |
| Agent Chat | interaction\_admin | Role required to access granular interaction configuration capabilities. |
| AI Agents | sn\_aia.admin | Role required to access and update Agentic AI tables. |
| AI Search | ais\_admin | Role required to manage and view AI Search and NowAssist for Search tables, properties, and configurations. |
| AI Virtual Agent | sn\_nowassist\_admin.nsa\_admin | Role required to enable your requesters to have a streamlined, conversational experience that is based on generative AI as they submit a catalog item request in Virtual Agent. |
| App Governance | sn\_aemc.aemc\_admin | Role required to have feature admin access for App Engine Management Center and includes scan\_user. |
| App Governance | sn\_app\_summary.app\_summary\_admin | Role required to have feature admin access for App Summary. |
| App Governance | sn\_deploy\_pipeline.deployment\_pipeline\_admin | Role required to have feature admin access for Deployment Pipeline. |
| App Governance | sn\_pipeline.pipeline\_admin | Role required to have feature admin access for Pipeline. |
| Application Vulnerability Response | sn\_vul.app\_sec\_manager | Role required for security managers. It is also required for application owners who manage penetration test assessment requests. By default, this role contains granular roles for third-party integration configuration and is required for full read, write, and delete permission on all AVR records and rules. |
| Alumni Center | sn\_asc.admin | Role required to create and manage profiles and features related to an alumni. |
| Audit, History and Journal | audit\_admin | Provides write and delete access to sys\_audit. Manual record modifications should be avoided. For bulk deletions, use system jobs rather than direct deletion. |
| Authentication | adaptive\_auth\_policy\_admin | Role required to configure adaptive authentication policies and filters, as well as update or delete those created by the role. Additionally, policies and filters created by other users and default configurations are available in read-only mode. |
| Authentication | adpative\_auth\_admin | Role required to access and modify Adaptive Authentication configurations, including creating and adjusting policies, managing policy contexts, and configuring filter criteria. Additionally, users can enable or disable adaptive authentication policies as needed. The role also grants access to modify Multi-Factor Authentication \(MFA\) settings, enabling users to enforce MFA and adjust MFA factor policies. |
| Authentication | custom\_url\_admin | Role required to configure new custom URLs for the instance, as well as to delete or modify existing custom URL configurations. |
| Authentication | password\_policy\_admin | Role required to configure and manage the password policies in the instance. Users with this role can create, manage, and enable or disable existing and new password policies. |
| Authentication | sso\_config\_admin | Role required to access all configurations related to Single Sign-On authentication within the instance. Grants the capability to create and modify feature configurations for SSO SAML, OIDC, Digest, and Certificate-Based Authentication in the instance. |
| Authentication | user\_authn\_admin | Role required to access and modify all user login-specific configurations, such as Single Sign-On \(SSO\), Account Recovery, Adaptive Authentication, MFA, and Password Policy. |
| Authentication Factors | auth\_factors\_admin | Role required to configure authentication for voice agent environments, with the factors that first identify the caller, then authenticate them before granting access. |
| Career Conversations | sn\_egd\_act.admin | Role required to configured all Career Conversations features, including auto closure of conversations and setting up integrations with Microsoft Outlook. |
| CMDB Admin | sn\_cmdb\_admin | Role required to configure the application and to create, read, write, and delete records in tables. Provides the highest level of access to tools and UIs within CMDB Workspace and other store apps such as CMDB Coverage, including full access to the Configuration item \[cmdb\_ci\] table. A CMDB Admin, for example, can set policies in the CI Class Manager and application service requirements. CMDB Admin can also modify default config records under the default identifier or the default identifier itself. |
| Code Assist Experience | background\_script\_admin | Role required to manage background scripts. |
| Code Assist Experience | now\_assist\_code\_admin | Role required to manage the Now Assist for code generation settings in system\_properties. |
| Code Assist Experience | now\_assist\_code\_rag\_admin | Role required to manage the Retrieval for code generation app. |
| Collaborative Work Management | sn\_cwm.cwm\_admin | Role required to update Collaborative Work Management \(cwm\) properties and reports. |
| Configuration Compliance | sn\_vulc.admin | Role required for full read, write, and delete permission on all Configuration Compliance records and rules. |
| Container Vulnerability Response | sn\_vul\_container.vulnerability\_admin | Role required for complete access to the Container Vulnerability Response \(CVR\) application and its records. Role required to configure third-party integrations and rules in Container Vulnerability Response. |
| Contract Management Pro | sn\_cm\_core.contract\_admin | Role required for administrative access to Contracts Core and underlying data. |
| Contract Management Pro - Contract Workspace | sn\_cm\_workspace.admin | Role required to change the Contract Workspace for Contract Management Pro to fit into the business or user requirements. |
| Contract Management Pro - Contracts Dashboard | sn\_cm\_pa.pa\_admin | Role required to activate and configure the Analytics Pack for Contract Management Pro application. |
| Contract Management Pro - Now Assist in Contract Management | sn\_cm\_gen\_ai.ai\_contract\_admin | Role required for administrative access to the Now Assist in Contract Management application. |
| Cloud Accelerate-Cloud Workspace | sn\_itom\_cam.cw\_admin | Role required to provision cloud accounts, add an unmanaged cloud account and update cloud account details. |
| Cloud Accelerate-CSC | sn\_cmp.cloud\_service\_user.root\_admin | Role required to manage stacks and resource filters. |
| Cloud Accelerate - CSC | sn\_cmp.cloud\_admin | Role required to setup Google Cloud Platform and Microsoft Azure Cloud on Cloud Services Catalog, setup cloud accounts for VMware, Specify the credentials that CSC Terraform Connector, work with stacks, view Cloud Service Requests in Cloud Admin Portal, view and utilize the Cloud Root Cause Analysis reports, debug and troubleshoot Cloud API Trail, create custom tags for cloud resources, Store the Azure service principal credentials in the instance. |
| Cloud Accelerate - CPG | sn\_cmp.cmp\_root\_admin | Role required to create scan schedules, CI finder mapping, policies by using condition builder, flows, or script, a policy set, resource collectors and view the dashboard and audit issue reports to run remediation and scan configurations. |
| Creator Studio | sn\_creatorstudio.configuration\_admin | Role required to provide admin privileges for the Creator Studio. The roles contains the following Creator Studio granular admin roles:- sn\_creatorstudio.task\_admin - sn\_creatorstudio.app\_configurator - sn\_creatorstudio.reports\_viewer |
| Creator Studio | sn\_creatorstudio.task\_admin | Role required to grant users access to change several fields on the Request Task table or a table that extends Request Task.This role contains the following:- Table-level access for sn\_creatorstudio\_task: Create, Write, Delete - Field-level access for: - sn\_creatorstudio\_task.request\_type, which enables you to change the associated form - sn\_creatorstudio\_child\_task.parent, which enables you to change the parent table for any subtask tables created from a task activity added to an app's playbook. |
| CSM - CRM Foundation | entitlement\_admin | Role required to access the entitlement table. |
| CSM - Case Management | sn\_csm\_case\_type.config\_admin | Role required to create, view, update and delete records in the Case type \[`sn_case_type`\] table. |
| CSM - Case Management | sn\_customerservice.case\_admin | Role required to create, view, update and delete records in the Customer Service Case \[`sn_customerservice_case`\] table. |
| CSM - Case Management | sn\_case\_line.admin | Role required to create, view, update and delete records in the Case Line \[`sn_case_line`\] table. |
| CSM - Case Management | sn\_csm\_case\_digest.admin | Role required to delete record in the Case Digest \[`sn_csm_case_digest_task`\] table. Also, can create, view, update and delete records in the Case Digest Configuration \[`sn_csm_case_digest_config`\] table. |
| CSM - Case Management | sn\_task\_plan.admin | Role required to create, view, update and delete records in the Task Plan tables. |
| CSM - Case Management | sn\_complaint.admin | Role required to create, view, update and delete records in the Complaint tables. |
| CSM - Case Management | sn\_onboarding.admin | Role required to create, view, update and delete records in the Onboarding tables. |
| CSM - Case Management | sn\_csm\_ppm.admin | Role required to create, view, update and delete records in the Project Portfolio Management tables. |
| CSM - Case Management | sn\_action\_status.admin | Role required to create, view, update and delete records in the Action Status tables. |
| CSM - Case Management | sn\_uib\_dyn\_rel\_rec.admin | Role required to create, view, update and delete records in the UIB Dynamic Related Records tables. |
| CSM - Case Management | sn\_cs\_sm.admin | Role required to create, view, update and delete records in the Customer Service with Service Management tables. |
| CSM - CRM Foundation | sales\_agreement\_admin | Role required to have full access to all sales agreement tables. |
| CSM - CRM Foundation | service\_contract\_admin | Role required to have full access to all contract tables. |
| CSM - CRM Foundation | sn\_crm\_customer\_access\_management\_admin | Role required to have admin access to customer access management configuration tables, including related party configurations, responsibility definitions, and responsibility access configurations. |
| CSM - CRM Foundation | sn\_crm\_escalation\_admin | Role required to have admin access to all escalations and related configuration tables. |
| CSM - CRM Foundation | sn\_crm\_foundation\_admin | Role required to have admin access to CRM configurations, including escalations, query rules, and customer access management. It also contains sn\_crm\_foundation\_data\_manager role. |
| CSM - CRM Foundation | sn\_cs\_queryrules.admin | Role required to have admin access to all query rules. |
| CSM - CRM Foundation | sn\_install\_base.install\_base\_admin | Role required to have granular admin access for Install base and related features. |
| CSM - CRM Foundation | sn\_l2c\_core.admin | Role required to have full access to Lead to Cash Core metadata tables, modules, and application. |
| CSM - CRM Foundation | sn\_prm.enterprise\_partner\_admin | Role required to have admin access for partner relationship management. |
| CSM - CRM Foundation | sn\_crm\_sequence.admin | Role required to give full access to sequence records and its related data. |
| CSM - CRM Foundation | sn\_l2c\_core.admin | Role required to have full access to Lead to Cash Core metadata tables, modules, and application. |
| CSM - CRM Foundation | sn\_tmt\_core.admin | Role required to have full access to Sales and Service Core API tables. |
| CSM - Omni | sn\_openframe.admin | Role required to have granular admin access to Open frame tables and properties. |
| CSM - Self Service | actsub\_admin | Role required to access Subscription and Activity Feed Framework related tables and modules. |
| CSM - Self Service | sn\_communities.admin | Role required to access Communities related tables and modules. |
| CSM - Self Service | sn\_csm\_ec.ec\_admin | Role required to have granular admin access for engagement messenger tables and Rest APIs. |
| CSM - Self Service | sn\_csm\_walkup.walkup\_admin | Role required to access CSM Walkup Experience tables and modules. |
| CSM - Self Service | sn\_embeddable\_core.emb\_admin | Role required to have granular admin access for web embeddables admin experience. |
| CSM - Self Service | sn\_ext\_usr\_reg\_admin | Role required to have granular admin access for External user registration. |
| CSM - Self Service | sn\_gamification.admin | Role required to access Gamification related tables and modules. |
| CSM - Self Service | sn\_otp\_support\_util\_admin | Role required to have granular admin access for OTP Support Util. |
| CSM - Base Entities | csm\_admin | Role required to access to all CSM features and data. |
| CSM - Base Entities | sn\_res\_shaper.admin | Role required to perform create, update, and delete operations for the Resolution Shaper Config table \(sys\_resolutionshaper\_config\). |
| CSM - Customer Central | sn\_customer\_central\_admin | Role required to access all Customer Central features and data. |
| Customer Success Management | sn\_acct\_lc.customer\_success\_application\_admin | Role required to have granular admin access for customer success management tables and server-side access. |
| Data Streaming | hermes\_admin | Role required to have access for all Hermes related configuration and maintenance. |
| Data Streaming | idr\_admin | Role required to have access for all IDR related configuration and maintenance. |
| Data Streaming | data\_mgmt\_tools\_admin | Role required to enable administrators to perform basic Data Management tasks. |
| Digital End-User Experience | sn\_dex.admin | Role required to manage user access to DEX, manage the applications that are being monitored, and handle onboarding or offboarding-related tasks. Used also to troubleshoot any issues that arise within the application. |
| Document Intelligence | platform\_ml\_di.admin, sn\_docintel.admin | Role required to have granular admin access for Document Intelligence \(docintel\) capabilities. |
| Document Management | document\_admin | Role required to manage system properties, security ACLs, and security ACL roles. Manage PDF generation, document conversion and document viewer BASE SYSTEM plugins. |
| Document Management | platform\_document\_management\_admin | Provides access to perform Create, Read, Update and Delete operations to the Documents, references, versions, lists and list entry tables. |
| Employee Center Outlook Add-in | sn\_outlook\_addin.outlook\_addin\_setup | Role required to set up and manage the Employee Center Outlook Add-in, including access to the sn\_outlook\_addin.portal.suffix system property, modules, UI actions, and app application files. |
| Employee Center Pro | sn\_hr\_sp.esc\_admin | Role required to have read and write access to the feedback task table, Employee Center version 37 onwards. |
| Employee Profile | sn\_employee.admin | Role required to create and manage employee profiles. |
| Encryption | security\_admin | Role required to perform security operations as an admin. |
| Encryption | sn\_kmf.admin | Role required to have admin and security admin access to be sn\_kmf.admin. Can assign sn\_kmf.cryptographic\_manager or sn\_kmf.cryptographic\_auditor role to other users and has read, write, and execution permissions for key operations. |
| Enterprise Architecture | sn\_apm.apm\_admin | Role required to administer Enterprise Architecture features and configurations |
| Event Management | evt\_mgmt\_admin | Role required to have full access to configure Event Management, including event rules, field mapping, alert management rules, and more. |
| External Content Connectors | sn\_ext\_conn.xcc\_admin | Role required for management of external content connector configuration settings. Can create, read, update, and delete connectors, schedule and run connector crawls, and view crawl logs and analytics. |
| Flow Designer UI | flow\_admin | Role required to have admin access for all flow designer tables. |
| Flow Engines | flow\_admin | Role required to work with backend tables of flow\_designer. |
| FSC-Accounts Payable Invoice Processing | sn\_ap\_apm.admin | Role required to have admin access for Accounts Payable Invoice Processing. |
| FSC-Accounts Payable Invoice Processing | sn\_ap\_apm.invoice\_tolerance\_admin | Role required to configure tolerances in Accounts Payable Invoice Processing. |
| FSC-Accounts Payable Invoice Processing | sn\_ap\_cm.admin | Role required to have admin access for Invoice case management. |
| FSC - Finance Case Management | sn\_fin\_ops.admin | Role required to access all the features and capabilities of Finance Case Management, including Finance Operations workspace. |
| FSC - Integrations | sn\_fcms\_intg.admin | Role required to have administrative access for the ERP Integration Framework, inheriting sn\_fcms\_intg.integration\_user and granting admin-level access to manage integration configurations, data, and operations. |
| FSC - Purchase Order Management | sn\_poem\_core.admin | Role required to have admin access for Purchase Order Management. |
| FSC - SLO | sn\_slm.admin | This role provides full administrative access to manage supplier-related processes and includes elevated permissions such as`sn_slm.manager`, `decision_table_admin`,`sn_fin.supplier_payment_info_write`,`sn_vdr_risk_asmt.vendor_assessor`, and`sn_shop.shopper`. Users who need complete control over supplier management, vendor assessments, payment information, and related workflows across the SLM application. |
| FSC - SLO | sn\_kpi.admin | Provides full administrative access to manage and configure all aspects of the KPI Framework, including creating, editing, deleting KPIs, and configuring KPI definitions. |
| FSC - SPO | sn\_fin.finance\_admin | Role required to generate fiscal and accounting periods. |
| FSC - SPO | sn\_shop.procurement\_administrator | Role required to access the primary data and administration sections of the Purchase Automation module. |
| FSC - SPO | sn\_shop.shopping\_hub\_admin | Role required to access all modules of the Source-to-Pay Common Architecture application. |
| FSC - SPO | sn\_spend\_psd.psd\_admin | Role required to configure and make changes to system properties, such as creating request types and categories. |
| FSC - SPO | sn\_spend\_sdc.admin | Role required to access Service Task and Service Request tables, which extends to Procurement Case Management, as well as other infrastructure that forms the foundation of Finance and Supply Chain Workflows products. |
| FSM - Plan Schedule | dynamic\_scheduling\_admin | Role required to perform administration configuration for Dynamic Scheduling Application. |
| FSM - Plan Schedule | sn\_task\_recommend.task\_rec\_admin | Role required to have granular admin access for Intelligent Task Recommendations \(sn\_task\_recommend\) plugin. |
| FSM - Plan Schedule | timecard\_admin | Role required to have write access to all time cards, otherwise users only have access to their own timecards. |
| FSM - Plan Schedule | sn\_task\_grouping.admin | Role required to have admin access for Task Grouping Feature. |
| FSM - Plan Schedule | wm\_admin | Role required to have admin access for Work Order Management users. |
| Gen AI Controller | global\_genai\_admin | Role required to have access to certain GenAI tables that are hosted in the global domain. |
| Grants Management | sn\_gsm\_grnt\_mgmt.grant\_admin | Role required to provide delegated admin access to the Grants Management application. |
| GRC | sn\_rec\_pg\_vertical.admin | Role required to have admin access for Record - vertical. |
| GRC - AI Risk and Compliance Management | sn\_ai\_case\_mgmt.ai\_case\_admin | Role required to have admin access for AI Case Management. |
| GRC - AI Risk and Compliance Management | sn\_grc\_ai\_gov.ai\_risk\_and\_compliance\_admin | Role required to have admin access for AI Risk and Compliance Management. |
| GRC - AI Risk and Compliance Management | sn\_privacy.admin | Role required to be responsible for configuring privacy management solution as a Privacy Admin. |
| GRC - Corp Compliance | sn\_audit.admin | Role required to have admin access for Audit related plugins. |
| GRC - Corp Compliance | sn\_compliance.admin | Role required to have admin access for GRC Compliance related plugins. |
| GRC - Corp Compliance | sn\_grc.admin | Role required to have admin access for GRC core-related plugins. |
| GRC - Corp Compliance | sn\_grc\_advanced.evidence\_admin | Role required to access Evidence-related objects as a feature role. |
| GRC - Corp Compliance | sn\_grc\_reg\_change.it\_admin | Role required to have IT admin access for GRC: reg change management plugin and set up integrations with third-party regulatory intelligence providers. |
| GRC - Corp Compliance | sn\_grc\_taxonomy.taxonomy\_admin | Role required to have admin access for GRC: Taxonomy. |
| GRC - Formula builder | sn\_fb\_connected.admin | Role required to have admin access for formula builder application. |
| GRC - Operational resilience | sn\_oper\_res.admin | Role required to create and delete some operational resilience activities. |
| GRC - Operational resilience | sn\_oper\_res.irm\_opres\_admin | Role required to create and delete both operational resilience activities and IRM activities. |
| HRSD - Case and Knowledge Management | sn\_hr\_core.admin | Role required to have full HR administrator access — can configure all HR settings, assign roles, and access all HR data. |
| HRSD - Case and Knowledge Management | sn\_hr\_er.admin | Role required tohave full administrator access to ER module configuration, case management, and setup. |
| HRSD - Case and Knowledge Management | sn\_em.admin | Role required to access and configure all areas within Evidence Management. |
| HRSD - Case and Knowledge Management | sn\_interview\_temp.admin | Role required to access, read, create, and edit interview question templates, template tags, and Employee Relations properties. |
| HRSD - Case and Knowledge Management | sn\_hr\_ef.admin | Role required to assign EDM roles, search, read, create, or update employee documents, and manage administration including retention periods, retention policies, security policies, and document types |
| HRSD - Case and Knowledge Management | sn\_sp\_admin\_ws.admin | Role required to access workspace and see a consolidated view of the demand and consumption of services offered to customers. |
| HRSD - Case and Knowledge Management | sn\_hr\_ra.admin | Role required to configure HR related Recommended Context tables to show different recommendations in HR Agent |
| HRSD - Employee Journey Management | sn\_ja.admin | Role required to create and manage all Journey Accelerator components, tables, and data. |
| HRSD - Employee Journey Management | sn\_hr\_le.admin | Role required to create, manage, and add users to groups within Lifecycle Events. Can access: - Guided Setup - Manage Owner Groups - Manage Roles - LE UI Configuration - Onboarding Executive Dashboard - Onboarding Executive View |
| HRSD - Employee Journey Management | sn\_hr\_le\_pa.admin | Lifecycle Events Performance Analytics Admin role for the scoped application. - Access and modify the Lifecycle Events PA content packs. - Edits Performance Analytics properties. - Accesses Admin Console. - Launch Dependency Assessment. |
| HRSD - Employee Journey Management | sn\_jny.admin | Role required to create and manage all Journey designer and Journey Accelerator configurations and features. |
| HRSD-Employee Journey Management | sn\_ja.admin | Role required to create and manage all Journey Accelerator components, tables, and data. |
| HRSD-Employee Journey Management | sn\_hr\_le.admin | Role required to create, manage, and add users to groups within Lifecycle Events. Can access: - Guided Setup - Manage Owner Groups - Manage Roles - LE UI Configuration - Onboarding Executive Dashboard - Onboarding Executive View |
| HRSD-Employee Journey Management | sn\_hr\_le\_pa.admin | Lifecycle Events Performance Analytics Admin role for the scoped application. - Access and modify the Lifecycle Events PA content packs. - Edits Performance Analytics properties. - Accesses Admin Console. - Launch Dependency Assessment. |
| HRSD-Employee Journey Management | sn\_jny.admin | Role required to create and manage all Journey designer and Journey Accelerator configurations and features. |
| HRSD - Hiring Experiences | sn\_ta\_hiring\_core.admin | Role required to have super admin access to the Hiring Experiences environment. |
| HRSD - Hiring Experiences | sn\_ta\_tp.talent\_profile\_admin | Role required to have admin access to set up Talent Profile. |
| HRSD - Talent Experience | sn\_egd\_core.admin | Role required to have admin access for talent development core. |
| HRSD - Talent Experience | sn\_egd\_shared\_lib.admin | Role required to have admin access for the shared library across HR. |
| HRSD - Talent Experience | sn\_hr\_lm.admin | Role required to track HR license usage by customer as an admin. |
| HRSD - Talent Experience | sn\_td\_na.admin | Role required to have admin access for Now Assist for talent. |
| Health and Safety | sn\_ohs\_im.admin | Role required to have admin access for Health and Safety applications. |
| Identity | agent\_role\_config\_admin | Role required to access and modify Agent role configurations \(role masking\). |
| Identity | mi\_admin | Role required to have admin access for Machine Identity Console. It's a high privilege as it contains other admin roles, assign carefully. |
| Identity | privileged\_role\_config\_admin | Role required to configure which roles are designated as privileged in the system. |
| Identity | role\_delegator\_admin | Role required to have admin access for Role delegation feature. |
| Identity | scim\_client\_config\_admin | Role required to access and modify SCIM client configurations. |
| Identity | scim\_config\_admin | Role required to access and modify SCIM provider-related configurations such as SCIM extension schema and SCIM system properties. |
| IH Core | connection\_admin | Role required to have access to Connections \[sys\_connection\] and Credentials \[discovery\_credentials\] table. |
| IH Core | credential\_admin | Role required to have access to Credentials \[discovery\_credentials\] table. |
| IH Core | ih\_process\_sync\_admin | Role required to create, edit, or delete Process Sync related tables. |
| Industrial Connected Workforce | sn\_icw.application\_admin | Role required to have application admin access for Industrial Connected Workforce. |
| Inbound web services | web\_service\_admin | Role required for administrative access to create Scripted REST and GraphQL operations. |
| Inbound web services | web\_service\_configuration\_admin | Role required to manage Web Service configurations for REST, GraphQL, and SOAP services, including behavior and security settings. To learn more, see Web Service configurations. |
| Industry Banking | sn\_appss.admin | Role required to create, update, delete, and read request types, inputs, outputs, and definitions. |
| Industry Banking | sn\_bom.admin | Role required to have access to all the banking data entities, plus admin privileges as the banking admin. |
| Industry Banking | sn\_bom.service\_definition\_admin | Role required to have full access to the service definition records as the FSO service definition admin. |
| Industry Banking | sn\_bom\_clo\_b2b.admin | Role required to have access to all Business customers' life-cycle operations data and admin privileges. |
| Industry Banking | sn\_bom\_clo\_b2c.admin | Role required to have access to all personal customers life-cycle operations data and admin privileges related to personal customers life-cycle operations. |
| Industry Banking | sn\_bom\_compl.admin | Role required to have access to all complaint operations data and admin privileges as the Financial Services Complaint Admin. |
| Industry Banking | sn\_bom\_credit\_asmt.admin | Role required to have access to all credit assessment data and admin privileges. |
| Industry Banking | sn\_bom\_credit\_card.admin | Role required to have access to all credit card service tasks and admin privileges. |
| Industry Banking | sn\_bom\_deposit\_b2b.admin | Role required to have access to all Business Deposit Operations data and admin privileges. |
| Industry Banking | sn\_bom\_deposit\_b2c.admin | Role required to have access to all personal deposit operations data and admin privileges. |
| Industry Banking | sn\_bom\_fraud.admin | Role required to have access to all Fraud Operations data and admin privileges. |
| Industry Banking | sn\_bom\_kyc.admin | Role required to have access to all Business KYC operations data and admin privileges. |
| Industry Banking | sn\_bom\_loan.b2c\_admin | Role required to have access to all loan operations data and admin privileges. |
| Industry Banking | sn\_bom\_loan\_b2b.admin | Role required to have access to all Business loan operations data and admin privileges. |
| Industry Banking | sn\_bom\_pa.admin | Role required to have access to all the banking data entities as the performance analytics admin, plus admin privileges. |
| Industry Banking | sn\_bom\_payment.admin | Role required to have access to all payment operations data and admin privileges. |
| Industry Banking | sn\_bom\_po.admin | Role required to have admin privileges. |
| Industry Banking | sn\_bom\_remote.admin | Role required to have access to all remote data and admin privileges as the FSO Remote Tables and Lookup Admin. |
| Industry Banking | sn\_bom\_treasury.admin | Role required to have access to all treasury operations data and admin privileges related to treasury operations. |
| Industry Banking | sn\_data\_sec.admin | Role required to have access to the Tokenizer Resource Configuration table and admin privileges. |
| Industry Banking | sn\_doc\_processor.admin | Role required to have access to all document entities and admin privileges. |
| Industry Banking | sn\_evnt\_inq.admin | Role required to have admin access for Event Inquiry. |
| Industry Banking | sn\_fso\_intg\_friss.admin | Role required to manage the flows for FRISS integration. |
| Industry Banking | sn\_fso\_intg\_jha.admin | Role required to manage the flows for JHA integration. |
| Industry Banking | sn\_ins\_claim.admin | Role required to have access to all Insurance Claims Core tables and admin privileges. |
| Industry Banking | sn\_ins\_claim\_cml.admin | Role required to have access to all Commercial claim operations data and admin privileges. |
| Industry Banking | sn\_ins\_claim\_indl.admin | Role required to have access to all Individual Life claim operations data and admin privileges. |
| Industry Banking | sn\_ins\_claim\_pers.admin | Role required to have access to all Personal claim operations data and admin privileges. |
| Industry Banking | sn\_ins\_gen\_claim.admin | Role required to have access to all Insurance claims operations data and admin privileges. |
| Industry Banking | sn\_ins\_group\_life.admin | Role required to have access to all Group Life and Disability Servicing data and admin privileges. |
| Industry Banking | sn\_ins\_group\_uw.admin | Role required to have access to all Group Life and Disability Underwriting operations data and admin privileges. |
| Industry Banking | sn\_ins\_indiv\_life.admin | Role required to have access to all Individual Life Servicing operations data and admin privileges. |
| Industry Banking | sn\_ins\_indiv\_uw.admin | Role required to have access to all individual life insurance underwriting operations data and admin privileges. |
| Industry Banking | sn\_ins\_policy\_b2b.admin | Role required to have access to all Commercial policy operations data and admin privileges. |
| Industry Banking | sn\_ins\_policy\_b2c.admin | Role required to have admin access for Personal lines policy cases. |
| Industry Banking | sn\_ins\_siu.admin | Role required to have access to all SIU data and admin privileges. |
| Industry Banking | sn\_ins\_underwrite.admin | Role required to have access to all insurance underwriting operations data and admin privileges. |
| Industry Banking | sn\_ins\_uw\_b2b.admin | Role required to have access to all Insurance commercial underwriting operations data and admin privileges. |
| Industry Banking | sn\_jha\_spoke.admin | Role required to have admin access for JHA. |
| Industry Banking | sn\_payment\_card.admin | Role required to create, read, write, and delete Payment Card records. |
| Industry Banking | sn\_req\_criteria.admin | Role required to have access to all the service request criteria data entities as the admin. |
| Information Request Playbook | sn\_gsm\_info\_req.admin | Role required to provide delegated admin access to the Information Request Playbook application. |
| IntegrationHub - Finance and Operations Spoke | sn\_ms\_fin\_ops\_spk.admin | Role required to have admin access for the Microsoft Dynamics 365 for Finance and Operations Spoke. |
| IntegrationHub - Finance and Operations Spoke | sn\_onedrive\_spoke.Microsoft\_OneDrive\_Admin | Role required to have admin access for the Microsoft Dynamics 365 for Finance and Operations Spoke. |
| IntegrationHub - Finance and Operations Spoke | sn\_uipath\_spoke.uipath\_admin | Role required to have admin access for UiPath spoke tables. |
| ITAM | asset\_licensing\_admin | Role required to have granular admin access for ITAM licensing capabilities. |
| ITAM | asset\_recommendation\_admin | Role required to have granular admin access for Recommendations capabilities. |
| ITAM | asset\_system\_admin | Role required to have granular admin access for Asset management capabilities. |
| ITAM | asset\_task\_admin | Role required to have access to create and delete for asset task table. |
| ITAM | contract\_system\_admin | Role required to have granular admin access for Contract capabilities. |
| ITAM | procurement\_system\_admin | Role required to have granular admin access for Procurement capabilities. |
| ITAM - CCM | sn\_cld\_intg\_core.cloud\_integrations\_admin | Role required to configure Billing Download jobs and Price Sheet Download jobs. |
| ITAM - CCM | sn\_cld\_intg\_core.read | Role required to give access to all the persons for a specific table \(this is strictly for internal purpose and won’t be exposed to the customer\). |
| ITAM - CCM | sn\_cld\_spend\_core.spend\_admin | Role required to have access to spend dashboards and tables. |
| ITAM - CCM | sn\_clin\_core.insights\_admin | Role required to have complete access to whole application as a super user and access to modify scripts and flows. |
| ITAM - EAM | sn\_eam.enterprise\_admin | Role required to have access to entire enterprise application. |
| ITAM - EAM | asset\_aia\_admin | Role required to have access to ITAM agents capabilities. |
| ITAM - EAM | asset\_integration\_admin | Role required to have access to integration capabilities. |
| ITAM - HAM | asset\_aia\_admin | Role required to have access to ITAM agents capabilities. |
| ITAM - HAM | asset\_integration\_admin | Role required to have access to integration capabilities. |
| ITAM - HAM | sn\_hamp.ham\_system\_admin | Role required to have granular admin access for Advanced Shipment Notification \(ASN\). |
| ITAM - SAM | sam\_admin | Role required to have access to the entire Software Asset Management application. |
| ITAM - SAM | sam\_integrator | Role required to create and manage SaaS integration profiles. |
| ITOM - Agent Framework | agent\_client\_collector\_admin | Role required to have admin privileges for management of the agent client collector store application. |
| ITOM - CA | sn\_\_itom\_ccg.admin | Role required to have admin access for Cloud Configuration Governance set of apps. |
| ITOM - Cloud Configuration Governance | sn\_cmp.cloud\_root\_admin | Role required to have admin access for Cloud Provisioning and Governance set of Apps. |
| ITOM - Cloud Configuration Governance | sn\_itom\_cam.cw\_admin | Role required to have admin access for Cloud Workspace Application. |
| ITOM - Certificate Inventory and Management | sn\_disco\_certmgmt.pki\_admin | Role required to have granular admin access for Certificate Inventory and Management. |
| ITOM - Certificate Inventory and Management | sn\_disco\_firewall.firewall\_admin | Role required to change non-standard attributes \(not present in the original firewall\) for a firewall record like, status, purpose, etc. The attributes present in the firewall are immutable. |
| ITOM - Certificate Inventory and Management | sn\_itom\_licensing.admin | Role required to configuration access for ITOM/OT SU Licensing. |
| ITOM - Tag Governance | sn\_itom\_tag.tag\_governance\_admin | Role required to have granular configuration access for Tag Governance. |
| ITOM - Discovery | discovery\_admin | Role required to access the "Discovery" and "Discovery Definition" applications to configure, monitor, and run Discovery operations. |
| ITOM - Leap | sn\_itom\_leap.leap\_admin | Role required to have admin access to leap application, enabling users to activate skills and create artifacts. |
| ITOM - Leap Agent | sn\_itom\_leap.leap\_agent | Role required to access the LEAP menu from the Service Operations Workspace and trigger LEAP executions. |
| ITOM - Leap Ansible Agent Worker | sn\_itom\_leap.leap\_ansible\_agent\_worker | Role required for Ansible Discovery Agent and Execution Agent to access Ansible Automation Platform integration features. |
| ITOM - Leap Ansible Mapping Read | sn\_itom\_leap.ansible\_mapping\_read | Role required to read step-to-job mappings for Ansible automation integration. |
| ITOM - Leap Ansible Mapping Write | sn\_itom\_leap.ansible\_mapping\_write | Role required to create and update step-to-job mappings for Ansible automation integration \(LEAP Admin only\). |
| ITSM - FE | sn\_sow\_admin.sn\_sow\_admin | Role required to oversee service operations workspace-related configurations as `sn_sow_admin` and help customer admin to configure product features and maintain organizational policies. |
| ITSM - Incident Management | sn\_incident\_admin | Role required to configure all Incident Management features including incident management properties. |
| ITSM - Major Incident Management | sn\_mim\_admin | Role required to configure all Major Incident Management features including major incident properties and trigger rules. |
| ITSM - Incident Communications Management | sn\_iam\_admin | Role required to configure all Incident Communications Management features including creating, editing, or canceling incident communication plan, communication task, and managing contact information. Additionally, this role can administrate all Incident Communications Management capabilities. |
| ITSM - Contact Management | sn\_contact\_admin | Role required to configure all Contact Management features including creating and editing contact definitions, contact responsibilities, configuration of MI users, recipient lists, and groups. |
| ITSM - Task Communications Management | sn\_tcm\_admin | Role required to configure all Task Communications Management features including communication plans and tasks. |
| ITSM - Task Outage | sn\_task\_outage\_admin | Role required to configure all Task Outage features including the mapping between the Task \[task\] table and the Outage \[cmdb\_ci\_outage\] table. |
| ITSM - Change Management | sn\_change\_admin | Role required to configure Change Management features and system properties. |
| Journey Accelerator | sn\_ja.admin | Role required to create and manage all Journey Accelerator components, tables, and data. |
| Journey Designer | sn\_jny.admin | Role required to create and manage all Journey designer and Journey Accelerator configurations and features. |
| Key Management Framework | sn\_kmf.admin | Role required to assigns roles to other users to perform operations around the ServiceNow Key Management Framework. |
| Knowledge management | knowledge\_Admin | Role required to have admin access for Knowledge management. |
| Lifecycle Events | sn\_hr\_le.admin | Role required to create, manage, and add users to groups within Lifecycle Events. |
| Localization Framework | localization\_admin | Role that manages the Localization Framework application. This role is also used in Localization Workspace. |
| LSD - Legal Request Management | sn\_lg\_ops.legal\_admin | Role required for administrative access to all legal apps and the underlying data. |
| LSD - Legal Request Management | sn\_lg\_ops.request\_admin | Role required for administrative access to the Legal Request module with full access to data. |
| LSD - Legal Request Management | sn\_lg\_ops.legal\_assignment\_rules\_admin | Role required for administrative access to the Assignment Rules module in legal apps. |
| LSD - Legal Request Management | sn\_lg\_ops.legal\_catalog\_admin | Role required for administrative access to the Catalog administration module in legal apps. |
| LSD - Legal Request Management | sn\_lg\_ops.legal\_notification\_admin | Role required for administrative access to the Notifications module in legal apps to configure email notifications. |
| LSD - Legal Matter Management | sn\_lg\_matter.matter\_admin | Role required for the administrative access to legal matters and the underlying data. |
| LSD - Legal Content Review | sn\_lg\_cont\_review.admin | Role required for administrative access to the Legal Content Review feature and its underlying data. |
| LSD - Legal Digital Forensics | sn\_lg\_forensics.forensics\_admin | Role required for administrative access to the Legal Digital Forensics app and full access to the underlying data. |
| LSD - Legal Investigations | sn\_lg\_investigate.admin | Role required for administrative access to the Legal Investigations app and full access to the underlying data. |
| LSD - Legal Simple Privacy | sn\_lg\_simple\_priva.privacy\_admin | Role required for administrative access to the Legal Simple Privacy app and full access to the underlying data. |
| LSD - Gifts and Entertainment Compliance | sn\_lg\_gifts.gifts\_admin | Role required for administrative access to the Gifts & Entertainment app and full access to the underlying data. |
| LSD - Legal Conflict of Interest | sn\_lg\_coi.coi\_admin | Role required for administrative access to the Legal Conflict of Interest app and full access to the underlying data. |
| LSD - Legal Hold Notification | sn\_Ig\_hold.legal\_hold\_admin | Role required for administrative access to the Legal Hold Notification app and full access to the underlying data. |
| LSD - Now Assist for Legal Service Delivery | sn\_lg\_gen\_ai.admin | Role required for administrative access to the Now Assist for Legal Service Delivery application. |
| LSD - Contract Management Pro for Legal Service Delivery | sn\_lg\_cnt.contract\_admin | Role required for administrative access to the Contract Management Pro for Legal Service Delivery app and full access to the underlying data. |
| LSD - Advanced Work Assignment for Legal Service Delivery | sn\_lg\_awa.admin | Role required for administrative access to the Advanced Work Assignment for for Legal Service Delivery applications. |
| LSD - Legal Counsel Center | sn\_lg\_cf\_workspace.admin | Role required to change the Legal Counsel Center Workspace for Legal Request Management to fit into the business or user requirements. |
| LSD - External Legal Service Center | sn\_lg\_ext\_portal.ext\_admin | Role required for administrative access to the External Legal Service Centre application and full access to underlying data. |
| LSD - Legal and Contracts Common Utilities | sn\_lco\_cmn.admin | Role required for administrative access to Legal and Contracts Common Utilities records. |
| Mobile | mobile\_admin | Role required to configure mobile applications. |
| Notification | email\_admin | Role required to perform resend email and reprocess inbound email functionality. |
| Notification | email\_bounce\_admin | Role required to administer email bounce functionality. |
| Notification | email\_digest\_admin | Role required to monitor email digest. |
| Notification | notification\_admin | Role required to configure notifications. |
| Notification | notification\_category\_admin | Role required to configure notification category. |
| Notification | notification\_classification\_admin | Role required to configure notification classification. |
| Notification | portal\_notification\_pref\_admin | Role required to configure sys\_recipient\_user\_mapping table. |
| Notification | push\_admin | Role required to manage push notifications. |
| Notification | smime\_certificate\_admin | Role required to administer SMIME public certificate. |
| Notify | notify\_setup\_admin | Role required to configure Notify features and system properties. |
| Now Assist - CSM | sn\_customerservice\_agent | Role required to enable Now Assist for CSM Gen AI skills for customer service agents. It grants access to all Now Assist for CSM skills such as Generate Resolution Notes, Case Summarization, and Chat Summarization. |
| Now Assist - CSM | sn\_customerservice.consumer\_agent | Role required to enable Now Assist for CSM Gen AI skills for customer service agents. It grants access to all Now Assist for CSM skills such as Generate Resolution Notes, Case Summarization, and Chat Summarization. |
| Now Assist for HR Service Delivery | sn\_hr\_gen\_ai.admin | Role required to configure and manage Now Assist for HR Service Delivery. |
| Now Assist for HR Service Delivery | sn\_hr\_ai\_agents.admin | Role required to configure and manage the HR Service Delivery AI Agent collection. |
| Now Assist for HR Service Delivery | sn\_hr\_aia\_voice.admin | Role required to configure and manage voice agents in the HR Service Delivery AI Agent collection. |
| Now Assist - TMT | sn\_tmt\_agentic\_ai.app\_admin | Role required to manage the Telecommunications Media and Technology AI agent collection. |
| Now Assist for Vulnerability Response | aia-admin | Role required for administrative access to Now Assist for Vulnerability Response. |
| On-Call Scheduling | sn\_on\_call\_admin | Role required to configure On-Call Scheduling features and system properties. |
| Operational Technology - CMDB | cmdb\_ot\_admin | Role required to manage all OT CMDB tables and records as an admin. |
| Operational Technology - ISA | cmdb\_ot\_isa\_admin | Role required to manage all ISA Equipment Model records and Equipment Model Template records as an admin. |
| Operational Technology - Industrial Process Health | ot\_health\_admin | Role required to have admin access to Industrial process health application and related functions. |
| Operational Technology - Subnet Mapping | sn\_ot\_amazing\_admin | Role required to manage OT Subnet Mapping records in 'ot\_subnet\_mapping' table and OT Subnet Mapping properties as an admin. |
| Operational Technology - Change Management | sn\_ot\_change\_admin | Role required to have admin access to the OT Change Management Application and related functions. |
| Operational Technology - Incident Management | sn\_ot\_incident\_admin | Role required to have admin access to the OT Incident Management Application and related functions. |
| Operational Technology - Vulnerability Integration | sn\_otvr.integration\_admin | Role required to have admin access for OT Vulnerability Integration application. |
| Operational Technology - Risk Score Calculator application | sn\_risk\_score\_calc.admin | Role required to have admin access to Risk Score Calculator application and related functions. |
| Outlook Actionable Messages integration | oam\_admin | Role required to access and manage Outlook Actionable Messages configurations, including system properties and OAM definitions. |
| Password policy | password\_policy\_admin | Role required to configure password policy-related items. |
| Password Reset | password\_reset\_admin | Role required to configure Password Reset features and system properties. |
| Platform | source\_control\_admin | Role required to perform all source control functionality. |
| Platform | update\_set\_admin | Role required to create, delete, and manage Update Sets. |
| Platform | cds\_client\_admin | Role required to have admin access for client-side framework of Canonical Data Services \(CDS\). |
| Platform | cluster\_node\_admin | Role required to have admin access for instance node and cluster configuration \(VNCC\) related tables. |
| Platform | nds\_admin | Role required to have admin access for Normalization Data Services. |
| Platform | normalizer | Role required to have admin access for Field Normalization feature. |
| Platform Server - Side Scripting | script\_include\_admin | Role required to have granular access to sys\_script\_include. |
| Platform Server - Side Scripting | sys\_es\_latest\_script\_admin | Role required to have granular access to sys\_es\_latest\_script. |
| Platform Server - Side Scripting | sysevent\_script\_action\_admin | Role required to have granular access to sysevent\_script\_action\_admin. |
| Platform Data Fabric | df\_connection\_admin | Role required to establish connection to available data sources as a connection admin, and manage access to these connections for data steward users. |
| Platform Deployment Analyzer | deployment\_analyzer\_admin | Role required to access Deployment Analyzer tables to set up and see results for Deployment Analyzer. Doesn’t have access to create script includes. |
| Platform Dev Sandbox | sandbox\_manager | Role required to manage the life-cycle of all developer sandboxes as a Sandbox Manager. |
| Platform Event Processing | events\_admin | Role required to be a System Events administrator involved in the events processing feature of the system. |
| Platform ISM | response\_header\_admin | Role required to have read, write, create, delete, and list\_edit access for records in HTTP Response Header table \(sys\_response\_header\). |
| Platform Scheduler | app\_resource\_quota\_admin | Role required to configure and manage Application Resource Quotas plugin. |
| Platform Scheduler | business\_calendar\_admin | Role required to configure and manage plugins and features related to business calendars \(com.glide.business\_calendars, com.glide.business\_calendars.scheduled\_jobs\). |
| Platform Scheduler | system\_scheduler\_admin | Role required to configure and manage scheduler-related plugins and features \(com.glide.system\_scheduler, com.snc.automation, com.snc.automation\_time\_zone, com.glide.stats.scheduler\) and access Scheduled Jobs dashboard in System Events and Jobs Dashboard plugin \(com.sn\_async\_dashboard\). |
| Plato Predictive Intelligence | ml\_admin | Role required to have access to create and retrain classification, similarity, and clustering models. |
| Playbook | playbook.admin | Role required to have Playbook Admin access. Contains pd\_content\_author, pd\_operator, pd\_trigger\_author, pd\_author, playbook.localization, and pd\_cancel. |
| Proactive Prompts | sn\_pp.admin | Role required to create and manage all Proactive Prompts configurations and features. |
| Process Mining | sn\_process\_mining\_admin | Role required to have admin access only for Process Mining workspace and can do certain actions limited to process mining only. |
| Public Sector Digital Services | sn\_gsm.admin | Role required to provide delegated admin access to scoped applications built on the Public Sector Digital Services platform. |
| Role delegation | role\_delegator\_admin | Role required for role delegation. |
| Roles | user\_role\_history\_admin | Role required to manage perform specific role related operations. |
| Retail | sn\_retail.ro\_admin | Role required to create retail organization and add members to the organization. |
| SBOM | sn\_sbom\_core.admin | Role required to create, read, edit data, and upload Software Bill of Materials \[SBOMs\]. This role is required for access to the SBOM Core modules in your instance. It inherits the roles from the Data Model for SBOM application. |
| Search | ais\_admin | Role required to administrate and configure AI Search functionality. Includes Search Applications, Search Profiles, Search Sources, Indexed Sources, and Properties necessary for administrating and configuring AI Search. |
| Search | ts\_admin | Role required to administrate and configure text search on an instance, enabling adjusting of ts\_weights and viewing or changing properties necessary for Text Search Administration. |
| Search UX | ais\_admin | Role required to migrate admin ACLs to a more granular role for ai-search-admin, semantic\_search, com.glide.search.analytics, com.glide.search.signal\_data, and com.glide.signals. |
| Security Center | sn\_vsc.security\_center\_admin | Role required to have admin access for Security center store application. |
| Security Operations - Data Loss Prevention | sn\_dlir.admin | Role required for administrative access to the Data Loss Prevention application. |
| Security Operations - Security Incident Response integrations | sn\_si.ingestion\_profile\_admin | Role required to configure the plugin and to create, edit, delete, and maintain ingestion profiles. - Microsoft Azure Sentinel integration - Splunk Enterprise Security Event Ingestion integration - Splunk Enterprise Event Ingestion integration - Cortex XSIAM by Palo Alto Networks - Microsoft Defender integration - CrowdStrike Next-Gen SIEM integration |
| Security Operations - Security Incident Response | sn\_si.admin | Role required for administrative access to the Security Incident Response application. |
| Security Operations - Now Assist for Security Incident Response | sn\_si.admin | Role required for administrative access to the Now Assist for Security Incident Response application. |
| Security Operations - Threat Intelligence Security Center | sn\_sec\_tisc.admin | Role required for administrative access to the Threat Intelligence Security Center application. |
| Security Posture Control | SPC Admin Group | Group required for full read and write access to all the records for Security Posture Control, including licensing information. Granular roles for this group include: \[sn\_sec\_caasm.analyst, sn\_sec\_caasm.caasm\_security\_admin, and sn\_sec\_spc\_core.configure\]. |
| Service Applicant Information | sn\_svc\_appl\_info.admin | Role required to provide delegated admin access to the Service Applicant Information application. |
| Service Applicant Program Management | sn\_svc\_appl\_pgm\_mg.admin | Role required to provide delegated admin access to the Service Applicant Program Management application. |
| Service Catalog | catalog\_admin | Role required to manage the Service Catalog application, including catalogs, categories, and items, but not including scripting functions available to administrators. |
| Service Graph Connectors | admin | Role required to install and upgrade Service Graph Connectors, including API Service Graph Connectors. Admin users can create a connection, configure connection properties, monitor connections and data imports, run background scripts, and provide access to tables in the global scope. |
| Service Graph Connectors | sn\_cmdb\_int\_util.sgc\_admin | Role required to create, update, and delete connections, configure connectors using the guided setup, and read and write system properties. |
| Service Graph Connectors | cmdb\_inst\_admin | Role required to read all Service Graph Connector application modules, read and write system properties, and read records that are owned by other applications and are related to the functionality of Service Graph Connectors. Users with this role can create, update, and delete custom tables, scheduled imports, and data sources. |
| Service Level Management | sla\_admin | Role required to configure Service Level Management features and system properties. |
| ServiceNow Studio | sn\_udc.admin | Role required to - Manage all ServiceNow Studio system properties, settings, and configurations. - Manage roles and permissions specific to ServiceNow Studio. - Configure the experience switcher roles across Creator Studio, ServiceNow Studio, and ServiceNow IDE. |
| ServiceNow Studio | sn\_prfrd\_tables.admin | Role required to configure preferred tables in your instance for Table Builder. |
| ServiceNow Vault | sn\_vault\_console.vault\_console\_admin | Role required to have a collection of Data Classification admin, Data Privacy admin, and CA Admin roles to execute a template flow and monitor sensitive data. To learn more, see Configuring ServiceNow Vault |
| ServiceNow Vault | sn\_vault\_console.vault\_console\_auditor | Role required to have a collection of Data Discovery Auditor, Data Classification Auditor, Data Privacy Auditor, and Continuous Auth Auditor roles to view the policies and metrics related to ServiceNow Vault. |
| ServiceNow for Teams – Core | sn\_now\_teams.admin | Role required to manage ServiceNow for Teams configurations, including system properties, Virtual Agent configuration, manifest settings, UI actions, and table-level ACLs. |
| Skills Foundation | sn\_skills\_int.admin | Role required to configure system settings with complete access to all the Skills Foundation features and functionality related to the employee. |
| Skills Foundation | sn\_skills\_int.job\_arch\_admin | Role required to view, create, update, remove, and configure the job architecture data. |
| Smart Operations | sn\_smartops.admin | Role required to serve as the Super Admin for Smart Operations. Has full privileges to perform all CRUD \(Create, Read, Update, Delete\) operations across Smart Operations tables, APIs, and data brokers. |
| Social Benefits Playbook | sn\_gsm\_soc\_bnfts.admin | Role required to provide delegated admin access to the License and Permit Playbook application. |
| System Engineering Core | openstack\_admin | Role required to have full administrative access to OpenStack compute, storage, and network. |
| System Engineering Core | vcenter\_admin | Role required to have full administrative access to vCenter: VMs, clusters, storage, and hosts. |
| System Logs \(Log Entry\) | syslog\_admin | Provides create/write access to Log Entry \(syslog\) records. The previous admin role ACL bindings on the syslog table are deleted and replaced with these new granular roles. |
| Talent Feedback | sn\_tf.admin | Role require to manage and configure all Talent Feedback modules. |
| Task Mining | sn\_tm\_core.admin | Role required to have admin access for Process mining application. |
| Third-party risk management | sn\_vdr\_risk\_asmt.vendor\_risk\_admin | Role required to have admin access for third-party risk management. |
| Transaction Part Metrics Logs | txn\_part\_metrics\_admin | Provides create, write, and delete access to the syslog\_transaction\_part\_metrics table. The previous admin role ACL bindings on this table are deleted and replaced with these new granular roles. New ACLs for all five operations \(read, create, write, delete, report\_view\) are introduced, each gated by the appropriate new role. |
| TSOM Visibility | tsom\_visibility\_admin | Role required to manage the operational tasks for the TSOM Visibility application. |
| TSOM Assurance | tsom\_assurance\_admin | Role required to manage the operation tasks \(includes administration\) for the TSOM Assurance. |
| UI Builder | ui\_builder\_admin | Role required to have admin access for UI Builder. |
| Usage Analytics | usage\_admin | Role required to have admin access for usage analytics. |
| Universal Request | sn\_uni\_req.ur\_admin | Role required to setup and configure Universal Request. |
| Universal Task | sn\_uni\_task.admin | Role required to have full administrator access to Universal Task — configure task types, templates, and settings. |
| Universal Task | sn\_uni\_task.emp\_form\_admin | Role required to manage employee forms. |
| Usage Insights | analytics\_admin | Role required to have admin access for Usage Insights. |
| User Experience-Scope | sn\_cda.analytics\_admin | Role required to have access to User Experience resources as Scope app admin. |
| Vulnerability Response | sn\_vul.vulnerability\_admin | Role required for complete access to the Vulnerability Response \(VR\) application and its records. Users with this role configure all VR applications and rules and can install third-party integrations. |
- Platform security granular admin roles
Use granular admin roles to verify access management by assigning roles that define user permissions and responsibilities.