sys_user_group Table — ServiceNow Reference

Table Reference/sys_user_group

The sys_user_group table stores all groups in ServiceNow, including assignment groups for tasks, approval groups for workflows, and security groups for access control. Owned by the Platform module, it's the foundation of ServiceNow's role-based assignment and approval processes. Groups can be hierarchical with manager relationships, and a single user can belong to multiple groups through the sys_user_grmember table.

What This Table Is

The sys_user_group table is the master registry for all groups in ServiceNow. Groups serve three primary functions: task assignment (referenced via assignment_group on task records), approval routing in workflows, and access control through role assignments. Every group that can receive work, approve requests, or control access lives in this table.

Owned by the Platform module, this table supports the entire ITSM process flow from incident assignment to change approval. When an incident gets assigned to "Network Team" or a change request needs approval from "CAB," both scenarios rely on records in sys_user_group. The table integrates tightly with user management, workflow engines, and access control systems.

The sys_user_group table doesn't extend another table but serves as a parent for specialized group types like sys_user_group_type categorization. Groups can have hierarchical relationships through the manager field, which references another group record, enabling organizational structures and escalation paths.

In large enterprises, expect 500-5,000 group records with high read volume from task assignments and approval processes. The table performs well for basic queries but can bottleneck when doing complex membership calculations across nested groups. Most performance issues arise from poorly written queries that traverse group hierarchies without proper indexing.

When You'll Script Against This Table

You'll hit sys_user_group most often in Business Rules on task tables (incident, request, change) for assignment routing logic. Script Includes that handle user access checks, approval workflows, and custom assignment engines constantly query this table. Client Scripts validate group selections in reference fields, while Scheduled Jobs sync group memberships with external systems.

Access requires user_admin role for write operations, though most developers encounter read access through assignment and approval processes. Group records have their own ACLs that can restrict visibility based on group type and organizational hierarchy.

Assignment routing: Business Rules that set assignment_group based on category, location, or impact
Approval workflows: Script activities that determine approver groups for changes and requests
Escalation logic: Script Includes that find manager groups when SLAs breach
User access validation: Checking if current user belongs to specific groups for custom UIs
Group membership sync: Scheduled Jobs that update group rosters from LDAP or HR systems
On-call rotation: Custom applications that manage group schedules and availability
Reference field qualification: Dynamic filters that show only groups of specific types

Table Gotchas

⚠️

The active field controls visibility in reference fields. Setting active=false doesn't prevent existing assignments but hides the group from new selections. Always check both active status AND existing references before deactivating.

⚠️

Group membership queries through sys_user_grmember can be expensive. The getRoles() and isMemberOf() API methods are optimized and cached—use them instead of manual joins.

The type field has no enforced referential integrity—invalid type values don't throw errors but break UI filters
Email notifications inherit from group email field if individual member emails fail—empty group email = no notifications
Circular manager relationships are possible and will cause infinite loops in escalation scripts—always check hierarchy depth

⚠️

The name field has a unique constraint that's case-insensitive. Attempting to create 'Service Desk' when 'SERVICE DESK' exists will fail with a cryptic duplicate key error.

Assignment group queries on large task tables should include additional filters—querying all records for one group can timeout

Free Newsletter

Enjoying this? Get one deep-dive per week.

Join 1,000+ ServiceNow pros — scripts, GlideRecord patterns, Flow Designer techniques, and career moves. Free.

The sys_user_grmember table creates the many-to-many relationship between users and groups, storing individual membership records. Every group membership, role assignment, and approval delegation creates entries here. The sys_user table connects through this relationship for all user-to-group operations.

All task-based tables (incident, sc_request, change_request) reference sys_user_group through their assignment_group field. Approval processes connect through sysapproval_approver records that reference both the source task and the approving group. The sys_user_role table intersects with groups through role-based access control, where groups inherit roles that define what their members can access.

The cmn_location and cmn_department tables often appear in queries alongside groups for organizational reporting and assignment routing. Developers frequently join these tables to build assignment rules like "Network issues in Building A go to Network-Boston group."

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Key Fields

Column	Type	Label	Notes
name	string	Name	Unique group identifier displayed in assignment and approval UIs. Case-insensitive uniqueness constraint—'Service Desk' conflicts with 'SERVICE DESK'.
type	string	Type	Categorizes groups for filtering in reference qualifiers. No referential integrity—invalid values break UI filters but don't error.
active	boolean	Active	Controls visibility in reference field selections. Inactive groups remain on existing assignments but can't be selected for new ones.
email	string	Email	Group email address used for notifications when individual member emails aren't specified. Empty value breaks group notifications.
manager	reference	Manager	References another group record for hierarchical relationships and escalation paths. Circular references cause infinite loops in traversal scripts.
description	string	Description	Free-text field describing the group's purpose and responsibilities. Commonly used in approval workflows to display group context.
source	string	Source	Identifies how the group was created—manual, LDAP import, or automated process. Critical for data governance and sync processes.
cost_center	reference	Cost center	References cmn_cost_center for financial reporting and charge-back processes. Used in time tracking and expense allocation.
include_members	boolean	Include members	Controls whether group notifications include individual members or just the group email. Affects notification volume and delivery.
default_assignee	reference	Default assignee	References sys_user for automatic individual assignment when tasks come to this group. Bypasses group assignment logic.
parent	reference	Parent	Creates organizational hierarchy separate from manager relationship. Used for reporting rollups and inherited permissions.
roles	string	Roles	Comma-separated list of roles inherited by group members. Automatically grants access without individual role assignments.
u_custom_field	varies	Custom Fields	Organizations commonly add location, business unit, or escalation path fields. Check your instance's customizations before scripting.

Common Queries

Get all active groups for reference field population

// Most basic query - what every developer tries first
var gr = new GlideRecord('sys_user_group');
gr.addQuery('active', true);
gr.orderBy('name');
gr.query();

while (gr.next()) {
    gs.info('Active group: ' + gr.name);
}

Find assignment groups of specific type with manager hierarchy

// Filter by group type and check manager relationship
var gr = new GlideRecord('sys_user_group');
gr.addQuery('active', true);
gr.addQuery('type', 'itil'); // ITIL assignment groups only
gr.addNotNullQuery('manager'); // Groups with escalation path
gr.query();

while (gr.next()) {
    var manager = gr.manager.getDisplayValue();
    gs.info('Group: ' + gr.name + ', Manager: ' + manager);
}

Find groups for user assignment routing based on location

// Real-world scenario: route incidents by user location
var userLocation = 'Boston';
var category = 'network';

var gr = new GlideRecord('sys_user_group');
gr.addQuery('active', true);
gr.addQuery('name', 'CONTAINS', userLocation);
gr.addQuery('name', 'CONTAINS', category);
gr.query();

if (gr.next()) {
    // Found location-specific group like 'Network-Boston'
    current.assignment_group = gr.sys_id;
} else {
    // Fallback to generic network group
    gr.initialize();
    gr.addQuery('name', 'Network');
    gr.query();
    if (gr.next()) current.assignment_group = gr.sys_id;
}

Count groups by type for reporting dashboard

// Aggregate count using GlideAggregate
var ga = new GlideAggregate('sys_user_group');
ga.addQuery('active', true);
ga.addAggregate('COUNT');
ga.groupBy('type');
ga.query();

while (ga.next()) {
    var groupType = ga.type + '';
    var count = ga.getAggregate('COUNT');
    gs.info('Type: ' + groupType + ', Count: ' + count);
}

Check group membership - wrong way vs right way

// WRONG: Manual join is slow and unreliable
// var gr = new GlideRecord('sys_user_grmember');
// gr.addQuery('group', groupId);
// gr.addQuery('user', userId);
// return gr.hasNext();

// RIGHT: Use built-in API that handles caching and inheritance
var user = new GlideRecord('sys_user');
if (user.get(userId)) {
    var isMember = gs.getUser().isMemberOf(groupName);
    gs.info('User is member: ' + isMember);
    
    // Or check specific user object
    var userObj = new GSUser(userId);
    return userObj.isMemberOf(groupName);
}

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue

sys_user_group