In ServiceNow, the best practice for managing users, groups, and roles is based on role-based access control (RBAC). Best Practices for Users, Groups, and Roles: Assign Roles to Groups (Correct ✅) Instead of assigning roles directly to users, it is a best practice to assign roles to groups. This ensures better role management, easier administration, and scalability.
Example: The "IT Support" group has the "itil" role. All users in this group automatically get the itil role. Add Users to Groups (Correct ✅) Users should be assigned to groups rather than roles directly. Groups inherit roles, so when a user is added to a group, they automatically receive the appropriate access.
Example: A new Service Desk agent joins the "Service Desk" group and immediately gets the associated roles (itil, incident_manager, etc.). Why Other Options Are Incorrect?
A . You should never assign roles to groups ❌ (Incorrect) Incorrect: Assigning roles to groups is the recommended best practice. Managing roles at the group level makes access control more efficient and scalable.
B . You should assign roles to users ❌ (Incorrect) Incorrect: Assigning roles directly to users is not a best practice because it becomes difficult to manage as the organization grows. Instead, users should be added to groups that have the necessary roles. Reference from ServiceNow CSA Documentation: Managing Users, Groups, and Roles ServiceNow Best Practices for Roles & Groups Role-Based Access Control (RBAC) User Administration