[Music] hello everyone welcome to sas with servicenow this video is about users groups and roles in servicenow platform what you will learn in this video you will learn user table and fields group table and fields role table and fields how to create a user in servicenow platform how to create a group how to create a role activate or deactivate a user how to add a user to a group how to add and remove a role to a user how to add or remove a role to a group group parent and child relationship impersonate user and inherited roles let's start with the users now what is a user in the platform user is an individual who logs into the service now and has a user record stored in user table every user has different access in the platform as per the roles they have overall any person who has to work in servicenow platform should have a record in the system in users table now this user can be identified with its information like username first name last name password email address and some other details some details are also unique like username email that means it will be unique for each individual user now servicenow also has a table for user which stores all different users data the table name is user and the backend name of this table is says underscore user now this is the user's form which also have some fields like user id first name last name title department email time zone date format it also have details you can put for mobile phone and you can see the user id and the email they will always be unique you cannot have duplicate user id or you cannot also have duplicate email addresses now this is users module which is available out of the box in servicenow instance under user administration now this particular module will show you the list of user records in the platform all the records available in your servicenow instance let's explore this in my personal developer instance when you will open service now url in your browser then you will first see login screen now in this login screen you will see username and password in order to login to the system you need to have username and password which is unique for every user available in the system if you are not aware of the password or username then you need to contact servicenow administrators in your organization but if i talk about will you really see this screen in production in your organization there's a high chance that they will you will not see this kind of screen which is out of the box from servicenow and the reason is because organizations implement different types of authentications basically their own authentications like single sign-on so if you will have single sign-on where you log in for other applications as well and if your organization has implemented single sign-on in service now as well then when you will open this url you will automatically be routed to sso and if your account will be existed in that particular instance then you will be able to login to service now automatically overall you need to remember one thing that even if you have implemented single sign-on in the instance but let's say your account details are not available in user table then you cannot login to servicenow instance for now i will login with my admin details admin credentials which i have got directly from servicenow while registering this personal developer instance so i will just enter the username which is admin and then i will provide password which i generated myself so i will put the password and then i will click on login so if i click on login you will see that that i can now login to servicenow instance my personal developer instance now the in left hand side you can see a lot of different applications now whatever access when user logged into the system whatever access that user would have that will be decided on the basis of roles that particular user has that means the kind of access that user has that's how all the applications in the left-hand side or whatever features whatever elements you have in the platform will be accessible on the basis of the access that particular user has now i will directly go to the user's module so if you will type in application navigator basically filter navigator if you will type user and if you go little bit bottom so you will see system and security system security here you will also see users module but if i go little bit bottom you will see this module called user administration under this module you will also find this module that is users and if i will click on this module i can see the list of users available in this instance now these are all basically demo data you can say because service now when they uh provide you any personal developer instance so they give you demo data so they give you demo data for different kind of access but let's say if i talk about the real organization that they will definitely not have this demo data they will have actual users of that organization be it employees of that organization or any user associated with that organization you will see that data into that instance so let's open this first record if i open this record you can see the user id is able dot tutor it's a first name last name title now every employee every user will definitely have some title in the organization so you can put title here then you have department now this department is a reference field that means it is there is a different table for department which you have to create as well not table basically the records in this particular table then we have email which we already mentioned that this would be unique email address for individual users then we have language you have calendar integration if you want to integrate the calendar you can also do that then you have time zone now it's it's kind of obvious that every user in in the organization will be located somewhere located in part of the in any part of the world be it india be it america be it uk be it singapore uh or or other part of the world so in that case you can select the time zone that what kind of time zone user wants to select so that he or she can see the dates accordingly date date and time accordingly so you also have date format because every every country follows different type of date format like india follows differently uk or u.s they follow different date format so you can basically it's kind of a user preference system has provided then you have business phone you have mobile phone so you can also put your mobile phone and business phone numbers as well and then there are some other configuration fields like password needs reset you have this logged out you have this active so what exactly these fields are so if i talk about password needs reset so let's say you are setting up the password for this user new password in that case that user or if i talk about even by the policy you definitely want don't want an admin to know the password of any user in that case you can generate the password you can provide that part generated password to the user and then if you will check this check box then while logging into the system user will see password reset screen as well during login here she will see the password reset that means he can provide the new password uh basically which is not known to the admin so that's something password needs reset then you have logged out now there are some some cases let's say when a user is keep on trying to login with incorrect username or password or with the password in that case after trying basically multiple times this checkbox will be checked in that case even if user will be aware of the password then he will not be able to log in and the reason is because account is logged out and in that case servicenow admins they have to perform this action they have to uncheck this box so that that user can log in then we have this active now active inactive is definitely important because if i talk up if i talk about a user or an employee who has worked in the organization let's say for three years that means his account will be there in the system but let's say that that employee left the organization in that case this checkbox should become unchecked that means that particular employee or user is not active anymore in the system so that's that's a active and active checkbox which is very important and then you have some other configurations like web service access only that if you want to provide this user that this user should not be able to log in via this ui in that case you can just check this check box that means this will only uh be used for web service uh users which so that for integration accounts and this is also says internal integration user so if you have this user because if i talk about the the any functionality which has been used in service now can be accessed by actual users or api uh or api accounts those api accounts you will create in this table only because in this table you will create those records so that you can provide those details to the third party system so that they can log into this instance and they can fetch the data as per the access provided to that particular user not the actual user but you can say that user can be an integration user you can also set the password by using this button at the top so if you click on this button set the password it will pop up basically provide a pop-up which is set password you can generate the password it will generate a random password and it will be a strong password which you can provide to your user and then as i said once you close this you can check that check this checkbox password needs reset so whenever that user will log in with that provided password system will ask to reset the password to provide a new password so you will provide the new password that means that user will provide the news password and once user will logged in then this checkbox will automatically be unchecked because password can can be reached only once we don't want that user to see this screen every time they log in we just want this particular screen once after setting up the password and providing that password to the user users form also has different views so this is basically the default view if i go to here and i go to view you can see this is the default view let's say i want to see the self service view if i click on self service and any user who will just have self-service access in that case he or she will only see these data not any other fields like first name last name business phone mobile phone title email date format and time zone let's change another view if i change it to let's say service portal because in service portal as well you can show the user record and here this is how you will see the record in service portal and if i see let's say it'll one because even idle users who work in service now in order to complete the task of other users let's see if they want to see the details of a user in that case they will see this particular form view where you have first name last name title email business phone and mobile phone and you can also it also has reset a password because i have admin access i don't think itel user will be able to reset the password and then you can see in the related list you also have incidents and then you also have this configuration item now why we have this configuration item the reason behind it because this user has this macbook pro 15 it means from our it department that means if you have your it department then they must have given macbook pro 15 inch laptop to this user and they have updated the record in the system that means this asset has been provided to this user so as an i.t user as an idle user i can see the record that what kind of details are associated with that particular user user creation now you can also create users in service now and there are two ways to create them one is manually which you can directly create in the instance by going to the form of service now you can just click on the new button you will see the new form of user form and then you can just create the record and another way is import importing from external systems that means if you have external systems like hr system or whatever system you have where you have user data is stored then you can connect that system with servers now and import all the users data into your instance now let's create this user in our personal developer instance so let's go to users module here is the list of users then you have this button new when i will click on this new button it will open up the form but as of now the view is idle but i will change the view maybe or i will just go here and i will change the view so view should be uh default so i have made it default and now i'm going back to users and i will click on new button again this time it will show me the default view so here's the default new form so i can provide any user id so let's say i will do demo dot user now this is the user id i'm providing so i will mention demo and last name user i'm not going to provide any title or maybe it's i can provide it's a demo user and email address it's up to you whether you want to provide email address or not you can select the time zone as well or even the date format or mobile phone and if i i can select the department as well let's see what kind of departments we have we do have a lot of departments so let's see i will select development department we have this password reset logged out active now i definitely want this user to log in so in that case this active should be definitely be checked what i will do first i will basically save this so i have saved this is the user id demo dot user now what i will do i will set the password so if i click on the set password here i can set the password so i will do one thing i will click on generate so i have generated the password now what i can do i can just copy this it will be copied and now i can provide this password to the user if i have created it manually now i can click on save password now you can see that's a magic that password needs reset automatically gets checked and i can now click on close and if i click on close you can see it is automatically checked now i will log out from this instance and i will re-login with this username and the password so i will click on logout so i have logged out now and here i will provide so if you remember our account was demo dot user this was the user id we basically created and then we have this password and i can provide here let's say the password i had and i can just paste it i hope it works and i can just log in yes it worked so it's saying current password i can provide this one and now it is asking me to provide new password so i can change the password and here i can let's say provide any password i want and i can provide that password retype again so i'm done so for this demo.user i can just click on submit so let's see if i will be able to login and yes so i have logged in successfully to this service now instance and i can close this yes i have logged in this is the new account which we just created and that is demo user now how system will decide that what kind of access that user has so let's say i have logged in with this demo user now what kind of access this demo user would have so in that case i can see that if i click on this all it will show me that you can see i can only access self service and maybe some other some other modules that's it it is not showing me incident change problem and the reason behind it because i don't have access we did not add any role to this to this user we just created it and we just logged into the instance so how exactly system will decide with the roles what kind of role that user has but we will talk about roles little bit later let's talk about groups in servicenow platform group is a set of users who share a common purpose groups may perform tasks such as approving change requests resolving incidents receiving email notifications or performing work order tasks for example let's say you are part of a database team and in your database team you have about five to six members in that case your team name will become a database group in servicenow instance that means same name can be created in the instance and that means that particular group which we have created for database team and all those members and if all those members their data is available that means their records are available in servicenow system that means in user stable that means all those user records can be added to this group which we have created in servicenow system for database team so that's how you can add into that particular group now a group can be identified with its information like name manager type group email and its members group also has a table in servicenow platform that is group and the backend name of group is sys underscore user underscore group now this is the group form which has fields like name manager description group email and parent now parent in something where you can select the parent group now we also have out of the box modules for group which is under user administration and in some other modules as well like system security now this module shows list of groups available in your service now instance now let's explore this in my personal developer instance so go to users administration so if i type users administration i think it's user administration so if i type user admin you will automatically see this user administration under user administration you will see this group module groups module if i click on this it will show you all the groups available in your instance now these are all out of the box groups that means the demo data created by servicenow you can also see the details here let's say i open this record which is application development now in this application development the name of the group is this application development this is the manager that means the manager of group this group is this person bushra and we also have description it says team develops itsm application in london and then we also have group email and then we have this parent this is also this is a reference field and if i click on this search lookup icon you will see i can select the data from groups table only that means same table because as i said you can make that relationship between two groups parent and child relationship so i can add this like this and i can also save the record so i will just reload this because i don't want to save the record i will just leave this and now you can see we also have related list like roles group members now this shows the group members we have available in this particular group which we have created and we also have groups that means if any child group we have for this particular group maybe this can be a parent then all those groups will be visible here and this is subscription but overall the important related list we have in group is roles group members and groups now you can also see other fields as well so if i let's say go to groups list and i can just click on this personalize list so you have default assignee you have exclude manager you have a group email which which was already on that particular form we have include members we have roles we have uh source and we have type now type is also very important field so we have roles we have source as well and if i click on ok so you can see we don't have any data in source but we do have data in type type is something is basically to identify that what kind of group it is is it a group to assign uh incident or all the itsm tasks it is something related to service catalog is it something related to security because you also manage because the scripts is not only just for assignment and service now you also manage access with groups that means you need to manage roles with the help of groups we will talk about that as well a little bit later but as of now as you can see we have all these data including types and and source as well so it's totally up to you that what kind of details you want it's it's sometimes like a lot of organizations they do customize as well they add new fields as per as per the requirement in their organization so it's totally up to you these are all out of the box fields if you want to use out of the box that's totally up to you but if you want to create new fields and you want to change some functionality you can also do that in this particular section that means in groups table you can also create a group manually or you can also import it from external systems now let's create a group in my personal developer instance in order to create a group you can go to the list of groups and just click on new button it will show you the form the new form of group in that case you can provide demo group um if you want to provide any manager you can do that like apple i have this user able and i can just mention demo group and i will not provide any email and if you want to provide parent you can also do that but i'm not giving that detail as of now and i will just click on save and i am done that means you are done with creation of group record and here in the related list you have roles that means you can add roles you have group members you can add group members now and here you have groups as well which i mentioned that you can have parent and child relationship and here it will show you all the child groups for this parent group let's see what are roles in servicenow platform role control access to the features and capabilities in the applications and modules in the platform the admin role provides access to all features and capabilities roles can be added to user and group roles play an important role in the platform because you can control different types of access for different types of users in a platform servicenow also has a separate table for roles which is role and the backend name of that table is says underscore user underscore role this is the form of role and you can see feels like name application required subscription description and elevated privilege elevated privilege field is basically used if you want to enable this role for elevated access you can also find roles module in the platform under system security or user administration this module shows the list of all the roles available in your instance let's explore roles in my personal developer instance in order to access roles go to user administration under user administration you will see roles module click on roles module you will see list of roles created in your instance now these are all out of the box roles but we cannot say them demo data the reason behind it because these roles are basically required for accessing different modules and applications and that means these are called as baseline roles these are created from servers now but like you can delete data from users table which are coming out of the box all those demo data in groups and users table but you cannot delete in this table you have to keep all these roles in this table because you have to use them so that you can provide access to different users let's open this role which is admin role so i have logged in as an admin and i have admin role as well and i can show you my name over here that means this user's account which is system administrator so here we have name description it shows that what kind of access uh this what kind of role this is and then you have application and then you have elevated privilege now if i talk about users and groups when you create a user it doesn't gets captured in update set when you create a group it doesn't gets captured in update set but when you create a role it gets captured in update set that's a difference so a role is definitely captured in update set so you have all these roles and this is the role basically parent role and this is contraind rules then you have contains roles then you have application with role that means this role is assigned to what different applications then you have these modules with this role then you have custom tables and subscribed users as well it is not showing the data for users and groups those has this particular role for that what you can do you can right click here you can just configure related list and if i go here we have this users and we should also have group yes we do have here and i can just click on save this will basically show me all the users who have this role and all the groups so none of the group basically has this role and if i talk about users all these users have admin role this admin role in this instance so this is how you can basically add users but we will learn about this later you also have this elevated privilege check box you can definitely check this check box if you want that role to be treated as elevated role for example you have security admin role if you are aware that in service now apart from admin you also have security admin role as well how can you how you can basically select elevated privilege so i will show you that you click on here you have this elevate role option so you have to click on the profile click on this elevate role if you will click on that it will show you what roles you have in elevated privilege access in that case you can check this check box and if i will update it in that case my profile will also have security admin role as of now i cannot like it is this role is definitely added but in order to use this role like there are some applications there are some data which you can edit for example if i give you the example of access control list acls so if you have to edit acls in service now then you should have security admin session that role will definitely be added to your profile your account but in order to use that role to edit the records in acl table you need to elevate the role select the security admin and then you have to click on update in that case you can edit acls as well let me show you that quickly so if i go to let's say acl so we have this access control here we do have all the access controls let's say i open this one you will see that it's all read-only i cannot edit these basically acls even i cannot create any new acl how can i do that for that i can just click on elevate role select this click on update and if i will do that then i can create new acl and i can also edit the acls so it will reload the list so you can see now i have new button to create a new acl and if i click on any of these basically acls you will see that now the form will be editable you can see here i can edit this access control and the reason behind it because now this session has elevated access even you can see it has this icon as well so this role is elevated and i can also end this this basically it is totally based on session you can also end this so i can uncheck this and i click on this it's gone now i cannot edit and even you can see i don't have that elevated icon small icon on my profile and now i cannot edit this particular page this particular form so if you want to have any if you want to use any particular role as a privileged role elevated privileged role in that case you can definitely check that check box of elevated privilege role creation as i mentioned you that you can only create role manually in service now you cannot import them or you also get out of the box roles which you definitely should not delete them from the system you can create new roles but you should not delete any kind of out of the box rows now you can also basically observe that if you will enable some new applications some new plugins in that case you might see new rules as well created automatically from servicenow when you enable those applications modules and plugins now let's create a new role in the instance in order to create a new role you have to go to user administration then click on rules you will see this list of roles and then you will click on this new button and then you will see roles new form and then you can provide any name you want like roles underscore demo underscore role and then i can just click on save and you are done this role creation is done and then you can add this role to any user and group now the important point here is that do you really think that creating a role will now just provide the access or control the access actually not because overall access is controlled by acls in servers now or you can also do some scripting for example that which role should be able to access or do query in incident table what kind of role can write or edit fields on incident table or what kind of roles can access let's say this one these modules and applications so after creation of a role that just a single record but you have to configure that role somewhere in the system where roles are basically i would say wherever you configuration of role is specified like here you have role section so this will only access roles table so you can select any role you want so let's say i add that new role here and after adding that role and i remove this users under user underscore admin i provide that role demo underscore role just to let's say one user then in that case only that user can access this user's module otherwise nobody will be able to access this module that's how role works that's how access management works in service now as per the roles let's understand the relationship between users groups and roles and how they are connected with each other now servicenow has a table which maps users and groups and the table name is group member and the backend name of this table is sys underscore user underscore gr member now this table stores the mapping of user record and group record which means if any user is a member of any particular group that's something you create in this particular table that means that record has to be created that will become a single record where you will select the group and user that means there will be mapping between a user and a group and that user will become the member of that particular group selected in that particular record of group members table let's see how to add a user to a group so if i go to my personal developer instance and i have to add a user to a group in that case what i can do i can just directly go to users i can pick uh let's say our user demo user we have this demo dot user i will open this and i will go little bit bottom here we have groups related list i can click on edit because i want to add this user to an existing group so i will just maybe select demo group this is the group which we created today so i will just click on save now this is done so you can see this user has been added to this group now i will show you one more thing if i click on this group that's how this relationship works that that user which we added it is also visible on group form as well in related list of group where we have group members and we have this user record now this is the table which stores the relationship so if i open this in a new tab this is the table says user group member and here it stores and i will show you the data as well the record if i open this it only has two uh basically two fee two fields user and group that's it symbol so basic overall let's say if i come here i can also create a relationship directly from here so i can click on new and i can just add any other user to this to this group or any group from just from this particular form that's what you can basically do and add a user to a group how to remove a user from a group now for that you can just directly go to your group record or you can go to user record as well in that case what you can do we have those group members you select this edit you have this user select that user and basically send it in the left hand side and slash bucket and just click on save gone that particular user is no more member of this demo group even mapping of user record and role record is managed in a different table in the platform and that table is user role and the backend name of this table is cis underscore user underscore has underscore role you can see the list of records we have in this table where we have user and role and we also have a field which is state whether that particular mapping or this record is active or not another field you can also see that is inherited which shows whether that's this particular role is inherited from any another record or this is the basically role directly added to any particular user that you can basically identify with this inherited field and it shows false or true where you see false that means it is not inherited it is directly added to the user or if you see true that means it is basically coming it is inherited from a different record it could be a group it could be a role as well how to add a role to a user so let's go to my personal developer instance and we will directly go to the users table and uh basically open the same demo user record which we created today and here if i go at the bottom we have this roles uh related list in this list you will find this edit button you select this edit button and now i can just add a role to a user i can just let's say add admin and i can just click on save now when you will add a role to a user you will also see these kind of messages pop up here because it shows what all different roles have been added those are basically inherited roles you can say as part of admin and if i go at the bottom after adding admin you cannot you you just see you see not just admin role you also see all other roles as well which are available in the system not all of them but at least the roles which are associated with admin maybe these are the roles which are basically child roles of admin role admin role is a parent role and maybe all these roles are child roles of this admin role and that's the reason you can see the difference that here it says false because we have added directly this role is added directly to a user and if you will see other records those are all true the inherited basically are all true the reason is because these roles are inherited from admin role when admin role was added you got all other roles as well how to remove a role from a user so you can go to the instance and you can directly go to the user so you already have this user record and i can just click on edit you will see only one role i can select this and i can just click on save that means now it says removing so it has removed all the roles so you can see i don't have any role in this particular user anymore now but what there's one more thing how can i do it from roll record that is also possible so let's say click on this edit button and i will wait for the list and i just add this admin again and this time i go to this admin rule record so we have this record and you have this users because this role is added to these 19 users and we should have that demo user as well yes right here what i can do i can just select this edit and now i can just uh search for our demo user it's right here deselect it and i can just click on save it's gone that means we have removed the role from that user and if i go to that user again you will see that that it will not have any role yeah that's it see here it doesn't have any role or that's how you can add remove a role from a user in our servicenow platform we also have a table which stores mapping of a group record and role record and the name of the table is group role and the backend name is sys underscore group underscore has underscore role you can see the list of records available in the instance in this table and you will see the mapping between a role and a group that means there are two fields major two fields one is the group record so you select the group record and the role record so you have that mapping that means that role is added to that particular group how to add a role to a group so if i go to my personal developer instance i go to groups and i directly open the record we created that is demo group i will go to roles related list so if you want to add a role to a group you can just click on edit and select any role you want so let's say i add admin and i click on save and i am done so basically we have added a role to a group how to remove a role from a group so let's go to our instance so we already have added this role so you have to click on edit select this role send it to the left hand side and just click on save it is gone now we do not have this role available in this group that means you have not any role assigned to this particular group now how exactly user get access so if i talk about membership so let's say i add a user here i will add basically that demo user so we'll search for a demo i have this demo user and i will just add it and now i have this role so here i will add a roll as well but before that i will just quickly show you you can see i don't have any role but i do have a group so i will go here and i will now add a roll so i just add admin and if i click on save it will add the role to the group but will it add to the member answer is yes so if i come here and if i refresh this yes you can see here and this is basically called inheritance because user is part of that particular group and we added a role to that group so all the roles associated with that group are basically inherited and added to the user as well and we will learn about inheritance as well now how exactly access is managed with the groups users and roles so users are basically added to a group then roles are added to a group and once you add the roles to a group then you will see that same role will be added to those users available in that group which we just saw and you will also see that inherited field will also be highlighted as true for all other roles which are basically inherited or the role which is directly added to the user if it is coming directly from a group then it will be called as inherited because that is basically inheriting the roles from a group now this is this overall called inheritance because you are basically uh inheriting the role so role is basically getting inherited from a group to a user automatically so let's see what exactly inherited roles are so let's say you have a parent group and how you make a group as a parent when you select the group in a parent field of a group record so let's say you have a parent group and you have two groups and that means that parent group has two child groups group 1 and group 2 and those groups have different users that means they have members in those groups group one also has some users and group two also has some users now let's say there is a role which is assigned or added to the parent group i'm talking about parent group now now what do you think will user added to child groups will also get that role so answer is yes this is called inheritance this is how roles are inherited in service now because when you add a role to a parent group then both the groups will also have that role and the users will also get the same role in the system now let's say you also add another role to a role and that's basically parent and child relationship of a role so let's say you have this parent group which has this role and there is a role too which is part of role 1 and when you will add that role 2 to role 1 then all groups which are associated with parent group on all the users will also get rolled to as well so this is how roles are inherited in the platform well let's see all these roles inheritance practically in servicenow instance so i will start with creating parent group so what i will do i will go to groups and i will click on new and i will type demo parent group i will not provide any parent here and i will just click on save now here we have groups how would i define child so what i will do maybe i will just create another child group as well so i will create demo uh demo group 2. and i will just insert and stay basically that will create another group and in that case if i go to parent group i will add uh okay it's asking me to create groups but i will not do that what i will do i will just go to groups i will open these two records here a new tab and here i will provide demo parent group i will save this and and here i will provide demo parent group again save so that means this demo parent group now has two child groups demo group and demo group 2. now what i will do i will basically remove the role from this group which is the child group so i will remove the admin i will click on save and now i will go to members as well i will go to members and i will see if it has any role no it doesn't have any role what i will do now i will basically create another user because i want i will add to a demo group maybe one group uh what i will do i will just create it demo 2 user 2 and i will just insert and state so i have added basically i have created second user so i will just go to demo group 2 and i will click on edit because we are just replicating same hierarchy which we just saw so i will just add this user and i will just see demo where is our parent group demo demo i will just go to grips now and if i click on demo parent and i will just reload this so overall it doesn't have any member that means the parent one but it has two child groups and these two child groups they basically have uh one member each each group has one member as you can see demo user and here we have demo user two so what i will do and you can see this demo user doesn't have any role and even i will talk about this one which is demo user it also doesn't have any role what i will do now i will add a role to this particular parent group if i will add a role let's see what happens if i add this admin role and you can see it says role granted to demo dot user as well so let me show you the magic i come here if i refresh this absolutely this is how roles are inherited see i did not add any role directly to this child groups i basically added them in parent group and what exactly it did it basically inherited all the roles to uh basically users which are part of those child groups and those child groups are part of parent group but that's how inheritance works but i can also do one thing let me show you that as well so let's say as of now if i click here i just have this admin role um what i will do i will just you can see it says uh 22 records i will add one more role in this contains rules and which one are roles um which we just created so i will just mention demo and i will click on save and you will see another magic and what's that magic i will come here and as of now it is showing me 22 rolls and if i just refresh it you can see now we have 23 rolls and the reason behind it because that contains roles also added to this user as well as part of inheritance because that role is added to the admin role and that role is inherited to user as well that's how inherited roles work in servicenow platform and you can also manage access in the platform with the help of group overall if i talk about the best practice you should not add roles directly to the user you should always manage your access and roles add roles directly to the group not to the user you can also impersonate a user in the platform in order to perform testing with the same access of that particular user and if you want to provide this access that means for impersonation by default all the admins basically they have access to impersonate other users but if you want to provide access this impersonation access to other users then you can assign this role called impersonator so this is the role so if let's say you want to basically give access to a user to impersonate any other user then you can just add this role to that particular user's account let's see how it works so impersonation is basically something that you can impersonate replicate others users account in the same screen and this is basically done for testing because there are times let's say you have performed some development or you have done some changes in the platform and you tested it properly and everything worked well or even for testing let's say let's say you did some changes for itel users so you can impersonate one of the itel user and check whether you're getting the expected results as per the itel user or not so how you will impersonate so you go to your profile click on this you have this option called impersonate user you also have an i here icon i if i click on this it will give me a pop-up where i can select the user which basically i need to impersonate so let's say i impersonate a able tutor i can select this able tutor if i click on this and i click on impersonate user basically now my screen will show able tutors account here not just account that's whole instance the view of that user and it also shows this small icon that means it's it means that you are impersonating someone now how can you end this impersonation you can just click here and you have this option called end impersonation or if you want to impersonate another user you can click click here and then it will show you the same pop-up and then you can impersonate or you click on end impersonation then impersonation will be ended that means now you're no more impersonating any user now we talked about that role so if i go to that in role section let's go to the roles module first so i will go to a role so i will directly go to user admin okay i will go to directly users admin i will go to roles and if i search for emperor yeah we do have impersonator and if i see here it is not assigned to any user but by default admin can definitely impersonate any user they want but if i want to give this access to any user what i will do i will just maybe go here and i will just mention here demo user and i will click on save so i have given impersonation access to this user now i can do also do one thing i will just log out because i will login with this user so if i do demo dot user and i just log in with the username and the password and i will show you that this user now also has access to impersonate so if i click here yeah you can see here this user i think uh if i remember i added admin access to this user but overall this user already had kind of admin access if i because i already added admin but if you will add this role then this user will be will be able to impersonate other users as well so let's say you have some idle users you want to give them access so that they can perform testing in that case you can provide this impersonator role to those users so it will not give any kind of admin um admin privilege one more thing i just want to highlight that let's say if you provide this role to a user that user cannot impersonate another admin you are admin you can impersonate admin but if that user is basically has impersonator rule then that user can only impersonate non-admin users that's a feature i would say you have in service now because servicenow has given this role so that people can utilize this to perform testing but if you will if they will allow people to impersonate and do any changes they want with the help of admin role then they shouldn't do that so that's the reason you cannot impersonate an admin user you can only impersonate non-admin user thanks for watching this video and have a great day [Music]