sys_user_grmember Table

Table Reference/sys_user_grmember

The sys_user_grmember table stores the many-to-many relationship between users and groups in ServiceNow. It's owned by the Platform module and serves as the junction table for all group membership across the platform. Always filter by the active field when checking current memberships to avoid performance issues and stale data.

What This Table Is

The sys_user_grmember table is the junction table that establishes many-to-many relationships between users (sys_user) and groups (sys_user_group). Every group membership in ServiceNow—whether it's ITIL roles, assignment groups, or custom groups—creates a record here. This table is the authoritative source for determining what groups a user belongs to and which users are in a specific group.

This table is owned by the Platform module and supports virtually every security and workflow process in ServiceNow. Access controls, assignment rules, approval workflows, and notification schemes all depend on group membership data stored here. The table doesn't extend any parent table—it's a straightforward data table with foreign key relationships to users and groups.

Record volume scales dramatically with organization size. A 10,000-user enterprise typically has 50,000-100,000 group membership records. Users often belong to 5-15 groups on average (department, location, ITIL roles, project teams), while some power users or service accounts can have 50+ group memberships. The platform maintains historical records even after users leave groups, so the table grows continuously.

Performance characteristics matter because this table gets hit constantly. User login processes, every assignment group query, and ACL evaluations all touch this table. ServiceNow maintains indexes on user, group, and state fields, but queries without these filters can still be expensive on large datasets.

When You'll Script Against This Table

You'll script against sys_user_grmember primarily in Business Rules for assignment logic, Script Includes for user utility functions, and UI Actions for bulk group operations. Security scripts and ACL evaluations query this table constantly, though often indirectly through gs.getUser().isMemberOf() methods that hit this table behind the scenes.

Access to this table is controlled by the user_admin role for write operations, but most users can read their own memberships. Scripts running in global scope can query freely, while scoped applications may have restricted access depending on their access controls.

Common scripting patterns:

Check if a user belongs to a specific group before assignment or notification
Get all active members of a group for bulk operations or reporting
Find users who belong to multiple specific groups (intersection queries)
Add or remove users from groups programmatically during onboarding/offboarding
Audit group membership changes for compliance reporting
Build custom group hierarchy navigation or membership trees
Validate group membership before executing privileged operations

Table Gotchas

⚠️

The state field is critical—always filter by state='active' when checking current memberships. Inactive records remain in the table for audit purposes, and queries without this filter return stale memberships.

The user and group fields are reference fields, but they store sys_ids as strings. Use .toString() when comparing to avoid type coercion issues.

⚠️

Bulk queries without proper indexing can timeout. Always include user or group sys_id in your queries—never scan the entire table with just business logic filters.

Creating duplicate memberships doesn't fail gracefully—the platform allows multiple active records for the same user-group combination. Use getUserGroupMember() API instead of direct inserts.

⚠️

ACL inheritance can be confusing—users gain permissions through group membership, but removing a user from a group doesn't immediately revoke active sessions or cached permissions until next login.

The table has no built-in approval workflow for membership changes. If you need approval for sensitive group additions, implement custom Business Rules or use the User Group Membership approval process.
Cross-scope queries can fail silently if the calling application doesn't have access to user or group tables. Always test group membership scripts across application scopes.

Free Newsletter

Enjoying this? Get one deep-dive per week.

Join 1,000+ ServiceNow pros — scripts, GlideRecord patterns, Flow Designer techniques, and career moves. Free.

The two primary related tables are sys_user and sys_user_group, which this table connects in a many-to-many relationship. You'll frequently join across all three tables to get user details alongside group information, or to find users with specific attributes who belong to certain groups. The sys_user_group_type table categorizes groups, which becomes relevant when filtering memberships by group type (ITIL vs. custom vs. approval groups).

You'll commonly join with task and its child tables when building assignment queries—checking if potential assignees belong to the right groups. The sys_user_role table works alongside group membership for comprehensive authorization queries, since users can have both direct role assignments and roles inherited through group membership.

For audit purposes, the sys_audit table tracks changes to group memberships when audit policies are enabled. Integration scenarios often involve ldap_ou_config and related LDAP tables when group memberships sync from external directory services.

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Key Fields

Column	Type	Label	Notes
user	reference	User	Reference to sys_user table. Stores sys_id as string - use .toString() when comparing to avoid type coercion issues in scripts.
group	reference	Group	Reference to sys_user_group table. Combined with user field creates the many-to-many relationship. Always indexed for performance.
state	choice	State	Active/Inactive status of the membership. Critical field - inactive records persist for audit but queries must filter for 'active' to get current memberships.
sys_created_on	glide_date_time	Created	When the group membership was established. Useful for audit trails and determining membership duration for compliance reporting.

Common Queries

Get all active group memberships for a specific user

// Most basic query - check what groups a user belongs to
var gr = new GlideRecord('sys_user_grmember');
gr.addQuery('user', user_sys_id);
gr.addQuery('state', 'active');
gr.query();

while (gr.next()) {
    var groupName = gr.group.getDisplayValue();
    gs.info('User belongs to group: ' + groupName);
}

Find active users in a specific group with additional user criteria

// Get active users from ITIL group who are also active employees
var gr = new GlideRecord('sys_user_grmember');
gr.addQuery('group.name', 'itil');
gr.addQuery('state', 'active');
gr.addQuery('user.active', true);
gr.addQuery('user.locked_out', false);
gr.query();

while (gr.next()) {
    gs.info('Active ITIL user: ' + gr.user.getDisplayValue());
}

Check if user belongs to multiple specific groups (intersection)

// Business scenario: verify user has both manager approval rights and finance access
function userHasRequiredGroups(userId, requiredGroups) {
    var foundGroups = [];
    var gr = new GlideRecord('sys_user_grmember');
    gr.addQuery('user', userId);
    gr.addQuery('state', 'active');
    gr.addQuery('group.name', 'IN', requiredGroups.join(','));
    gr.query();
    
    while (gr.next()) {
        foundGroups.push(gr.group.name.toString());
    }
    
    return foundGroups.length === requiredGroups.length;
}

Count active members per group using GlideAggregate

// Generate membership report for all assignment groups
var ga = new GlideAggregate('sys_user_grmember');
ga.addQuery('state', 'active');
ga.addQuery('group.type', 'assignment_group');
ga.addQuery('user.active', true);
ga.groupBy('group');
ga.addAggregate('COUNT');
ga.query();

while (ga.next()) {
    var groupName = ga.group.getDisplayValue();
    var memberCount = ga.getAggregate('COUNT');
    gs.info(groupName + ': ' + memberCount + ' active members');
}

Wrong way vs right way - avoiding duplicate membership creation

// WRONG: Direct insert can create duplicates
// var gr = new GlideRecord('sys_user_grmember');
// gr.user = userId; gr.group = groupId; gr.insert();

// RIGHT: Check for existing membership first
var gr = new GlideRecord('sys_user_grmember');
gr.addQuery('user', userId);
gr.addQuery('group', groupId);
gr.addQuery('state', 'active');
gr.query();

if (!gr.hasNext()) {
    // Safe to create new membership
    gr.initialize();
    gr.user = userId;
    gr.group = groupId;
    gr.state = 'active';
    gr.insert();
}

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue

sys_user_grmember