What are Roles and Groups in ServiceNow?

Reading Between the Lines

Every ServiceNow interview touches on user management. Roles and Groups are the foundation of security and task routing — understanding how they connect is essential.

Roles vs Groups

• Role: Defines WHAT a user can do. A role grants permissions — access to modules, ability to read/write tables, visibility of UI elements. Examples: itil (IT staff), admin (full access), incident_manager, catalog_admin.
• Group: Defines WHO works together. A group is a collection of users — typically a team. Examples: 'Network Support', 'Database Admins', 'HR Service Desk'. Groups are used for task assignment and routing.

How They Connect

// A user can have:
// - Roles assigned directly (user → role)
// - Roles inherited through groups (user → group → role)
//
// Example:
// User: Jane Doe
//   └── Group: 'Network Support' team
//         └── Group has role: 'itil'
//         └── Group has role: 'network_admin'
//   └── Direct role: 'change_manager'
//
// Result: Jane has itil + network_admin (from group) + change_manager (direct)

// Groups are also used for ASSIGNMENT:
// When a P1 Network incident comes in:
// → Assignment Group = 'Network Support'
// → Any member of that group can pick it up
// → The group manager gets escalation notifications

Common Role Types

• admin — Full system access. Bypasses all ACLs. Use sparingly.
• itil — Standard IT staff role. Access to incident, problem, change modules.
• catalog_admin — Manage Service Catalog items and categories.
• knowledge_admin — Manage Knowledge Base articles.
• approver_user — Can approve/reject requests and changes.

Important Distinctions

• Roles control access: Can this user SEE the incident table? Can they EDIT change requests? Can they DELETE records?
• Groups control routing: Which TEAM should this ticket go to? Who gets notified? Who's in the approval chain?
• A user without a group can still have roles and access. They just won't receive group-assigned work.
• A user in a group inherits the group's roles automatically.