When someone leaves your organization, you need to cut off their access immediately without losing their work history or breaking audit trails. This guide walks you through properly deactivating a user account and handling the session management piece that trips up most admins.
Why deactivation beats deletion
Before user deactivation workflows, admins either deleted user records (breaking assignment history and audit trails) or manually removed users from groups and roles (error-prone and incomplete). Deleting users cascades through the system unpredictably — incident assignments disappear, approval records lose context, and reports break. The people who maintain ServiceNow instances — platform admins and HR teams — need a clean way to revoke access while preserving the data integrity that auditors and managers depend on.
How user deactivation works
User deactivation is a two-step process: flipping the Active flag (which prevents future logins) and invalidating existing sessions (which kicks them out immediately). The Active checkbox controls authentication — unchecked users can't log in, but they can stay logged in if they already have sessions. ServiceNow preserves all assignment history, group memberships, and role assignments on deactivated users, so reports and audit trails stay intact. Most admins handle the Active flag but forget about session invalidation, leaving a security gap.
Managing deactivated users long-term
Once basic deactivation works, the improvements worth making are: adding VIP flags or manager notes for context during access reviews, setting up automated deactivation workflows triggered by HR systems, and building reports that track deactivated users with active assignments. Production-quality user management includes regular cleanup of group memberships (for license optimization) and documentation of deactivation reasons for compliance teams.
Before you start
- •user_admin or admin role
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Step by step
Open the user record
Navigate to User Administration > Users and search for the user by name or email. Click their name to open the record. You'll see the User form with their profile details and access information.
Use the search bar at the top of the Users list — it searches across name, email, and username fields simultaneously.
Uncheck the Active field
Locate the Active checkbox in the main form section and uncheck it. This prevents the user from logging in going forward. The checkbox is usually in the first section of the form, near other basic profile fields like Name and Email.
Add deactivation context
Check the VIP checkbox if this user might need priority handling during access reviews or reactivation requests. Add a note in the Comments field explaining why they were deactivated and when — this helps during compliance audits. Include the departure date and requesting manager if available.
Save the user record
Click Update to save your changes. The user can no longer authenticate to ServiceNow, but any existing browser sessions remain active until they expire or you invalidate them manually.
Check for active sessions
Navigate to System Security > Active Sessions and filter by the user's name or sys_id. Look for any sessions showing their username — these represent browser sessions or API connections that are still live.
Invalidate active sessions
For each active session, click the session ID to open it, then click the Invalidate Session button. This immediately terminates their access. If you see multiple sessions, invalidate each one individually — there's no bulk action option.
Verify group memberships
Go back to the user record and click the Groups related list tab. Review their group memberships for any that grant elevated access or consume licenses. You can remove them from groups now or leave them for audit trail purposes — deactivated users don't consume licenses regardless of group membership.
Best practices
Always check active sessions after deactivation — the Active checkbox only prevents new logins, existing sessions stay live until manually invalidated.
Don't delete group memberships immediately after deactivation — keep them for 30-90 days so access review reports show what the user had when they left.
Use the VIP flag for users who might return as contractors or rehires — it signals to other admins that reactivation requests need verification, not rejection.
Set up a saved filter in Active Sessions for recently deactivated users — checking sessions should be part of your standard deactivation workflow, not an afterthought.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue