Users can't access ServiceNow modules or features without the right roles. This guide shows you how to assign roles directly to a user record and get them the access they need.
Why manual role assignment creates problems at scale
Before ServiceNow, your team was managing application access through manual processes — emailing admins, tracking permissions in spreadsheets, and hoping nothing fell through the cracks. Even with ServiceNow, many teams still assign roles one user at a time directly to user records. This works for small teams or one-off situations, but it creates a maintenance nightmare as you grow. Platform administrators inherit hundreds of users with individual role assignments, no clear pattern for who should have what access, and no easy way to audit or bulk-change permissions when business needs shift.
How ServiceNow role assignment works
ServiceNow roles control access to applications, modules, tables, and records. You can assign roles two ways: directly to user records (immediate but hard to maintain) or through groups (scalable but requires more setup). Most implementations need both — groups for standard access patterns and direct assignment for exceptions. Start with direct assignment to get users working, then migrate common patterns to groups as your instance matures. The itil role is your baseline for most end users — it provides read access to core ITSM tables without administrative privileges.
Building a sustainable access management approach
Once you've got users working with basic roles, the path to maintainable access management runs through groups and role inheritance. Document your role strategy — which roles are for daily users versus administrators, how specialized access gets granted, and when to create custom roles versus using out-of-box ones. Set up groups for common role combinations so you can assign many users at once and change access patterns globally. This shifts you from managing individual permissions to managing role patterns, which scales much better as your instance grows.
Before you start
- •user_admin or admin role
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Step by step
Navigate to the user record
Go to User Administration > Users, then search for and open the user record you want to modify. You can search by name, user ID, or email address. The search will show active users by default — if you need to modify an inactive user, clear the Active filter first.
Use the global search (magnifying glass icon) if you know the user's name — it's faster than navigating to the Users table.
Open the Roles tab
Click the Roles tab at the bottom of the user record. This shows all roles currently assigned to this user, both directly and inherited from groups. Direct assignments show in the list without a group name, while group-inherited roles show the source group in parentheses.
Add the itil base role first
If the user doesn't already have the itil role, click Edit and add it before other roles. The itil role provides baseline access to ITSM tables and is required for most ServiceNow functionality. Without it, users can log in but can't see incidents, requests, or other core records.
The itil role appears as 'itil' in the role list — don't confuse it with other ITSM-related roles like incident_manager.
Add the specific role needed
Click Edit, then use the dropdown or search field to find and select the role that grants access to the module or feature the user needs. Common roles include incident_manager (for incident management), catalog_admin (for service catalog administration), or approver_user (for approval workflows). Click Submit to save the role assignment.
Verify the role assignment
Refresh the user record and confirm the new role appears in the Roles tab. The role should be listed without a group name, indicating it's directly assigned to the user.
Clear the user's cache
Right-click on the user record header and select 'Impersonate user', then immediately end the impersonation, or have the user log out and back in. Role changes don't take effect until the user's session cache refreshes, so they won't see new access until this happens.
Best practices
Always assign the itil role first — most other roles assume users have basic ITSM table access and won't work properly without it.
Document why you assigned roles directly instead of through groups — this helps future administrators understand exceptions to standard access patterns.
Use groups for any role assignment that applies to more than 2-3 users — direct assignment should be the exception, not the rule.
Test role assignments in a sub-production instance first if you're unsure about what access a role grants — some roles provide more access than their names suggest.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue