| Starting with the Quebec release, Subscription Management provides you with the ability to monitor your user-based subscriptions by leveraging common user groups. Using these groups, you can manage your subscription consumption as part of your normal user management processes without having to manage security and entitlement separately. Therefore, it is a leading practice to assign roles to a group and add users to groups, so they can inherit the roles by the group. Avoid directly assigning roles to users whenever possible, as you have no control over subscription consumption that way. To be make sure that users are not assigned directly to roles which consume a license, this article introduces a proactive and a reactive approach. | | |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | |

What are licensable roles?

In your ServiceNow instance exists a little-known but all the more exciting table license_role, which contains all ServiceNow roles with their associated license type:

After grouping column "Role Type" the follow types remain:

• Admin
• Approver
• Business Stakeholder
• Fulfiller
• Requester
• Time Card User

Except for the license type "Requester" all others are licensable.

Proactive approach

Using this knowledge and a small Business Rule, a block can now be established to prevent a role that is not of type "Requester" from being assigned to a user. The script of the following Business Rule also takes into account the fact that roles may in turn contain roles requiring a license:

Table	sys_user_has_role
Advanced	true
When	before
Insert	true
Filter Conditions
Script	(function executeRule(current, previous /*null when async*/) { function _getContainedRoles(strRole, arrRoles) { var _arrRoles = arrRoles \

Now, each try to assign a role which is not of type "Request" will result in abort:

Reactive approach

As it is possible to import data without running Business Rules, you need an audit option for checking such direct role assignments on a regular basis. For this purpose, an Instance Scan check is the perfect solution.

You can create a Table Check with the following properties:

Table	sys_user_has_role
Conditions
Advanced	true
Script	(function (engine) { var grLicenseRole = new GlideRecord('license_role'); grLicenseRole.addQuery('sys_user_role', engine.current.getDisplayValue('role')); grLicenseRole.setLimit(1); grLicenseRole.query(); if (grLicenseRole.next()) { if (!grLicenseRole.license_role_type.nil() && grLicenseRole.license_role_type.id != 'requester') { engine.finding.setCurrentSource(engine.current.user.getRefRecord()); engine.finding.increment(); } } })(engine);

Further information

Subscription Management

Subscription Management is an application that allows you to manage subscription usage and make decisions on the number of subscriptions needed for your organization. It is critical to understand your subscription usage and adoption of your ServiceNow applications, as well as view your ServiceNow licenses across the organization.

Business Rules

A business rule is a server-side script that runs when a record is displayed, inserted, updated, or deleted, or when a table is queried. Use business rules to accomplish tasks like automatically changing values in form fields when certain conditions are met, or to create events for email notifications and script actions.

Instance Scans

The Instance Scan feature can help you find potential issues related to security, upgradability, manageability, user experience, and performance. You can use Instance Scans to enforce best practice implementations in your development cycle, release management, pre- and post-upgrades. The Instance Scan application is based on checks and a check is a rule that runs on tables, records, and metadata to detect issues.