ACL rules control who can read, write, create, and delete records in ServiceNow, but even admins can't modify them without the security_admin elevation. This guide walks you through the elevation process and explains how the temporary security role system works.
Why security_admin requires elevation
Before role elevation, ServiceNow treated security_admin like any other role — you either had it permanently or you didn't. This created audit problems because security changes couldn't be traced to specific sessions, and it violated separation of duties principles. Platform admins who needed occasional ACL access had to carry security privileges full-time, and organizations couldn't easily track when someone was acting in a security capacity versus normal administration. The people this affects most are platform admins who need to modify ACLs occasionally, and security teams who need detailed audit trails of security configuration changes.
How security role elevation works
Security Admin elevation is a temporary privilege escalation that lasts only for your current session or until timeout (typically 2 hours). You request it through the user menu, ServiceNow logs the elevation, and you get access to ACL records and other security configuration. The system treats this as a separate role context — you're not permanently a security admin, you're temporarily elevated to one. Once elevated, you can create and modify ACL rules, debug security issues, and access security-related tables that are otherwise blocked. The elevation expires automatically, and you'll need to elevate again in future sessions.
Working effectively with elevation
After you understand the basics, the key improvements are batching your security work to minimize elevation requests and understanding which tasks actually require security_admin versus regular admin privileges. Most day-to-day platform work doesn't need security elevation — only direct ACL modifications, security rule debugging, and certain advanced configuration tasks require it. Learn to recognize when you're hitting a security boundary versus other permission issues, and plan ACL changes in focused sessions rather than elevating repeatedly throughout the day.
Before you start
- •User account with admin role or explicit security_admin grant
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Step by step
Open the user menu
Click your user avatar in the top-right corner of the ServiceNow header. This opens your user context menu with profile options and role management. Look for 'Elevate Roles' — if you don't see it, your account doesn't have security_admin privileges available.
The Elevate Roles option only appears if you have roles that support elevation.
Select Elevate Roles
Click 'Elevate Roles' from the user menu dropdown. This opens the role elevation dialog where you can see all available elevated roles for your account. You'll see security_admin listed here if it's available to you.
Choose Security Admin elevation
Check the box next to 'Security Admin' in the elevation dialog. ServiceNow may show other elevated roles here depending on your account configuration. You can elevate to multiple roles simultaneously if needed.
Confirm the elevation
Click 'OK' or 'Elevate' to confirm your role elevation request. ServiceNow processes the elevation immediately and logs it in the system audit trail. You'll see a notification confirming the elevation was successful.
Verify security access
Navigate to System Security > Access Control (ACL) to confirm you now have security_admin privileges. You should be able to see ACL records that were previously hidden. The elevation indicator may appear in your user menu or header to show your current elevated status.
Complete your security work
Make your ACL changes or perform the security configuration you needed. Remember that elevation is temporary — typically 2 hours or until your session ends. ServiceNow will automatically revoke the elevation when the timeout period expires.
Best practices
Batch your ACL work into focused sessions rather than elevating repeatedly throughout the day — elevations are logged and frequent elevation looks suspicious in audit reports.
Never leave an elevated session unattended — the temporary security_admin privileges create audit liability until they expire.
Test ACL changes in a development instance first — you can't easily undo security rule modifications once they're saved.
Document why you elevated in change records or work notes — auditors will ask about security elevations during compliance reviews.
Learn which tasks actually require security_admin versus admin privileges — many platform tasks don't need security elevation and requesting it unnecessarily creates audit noise.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue