---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Configuring Session Access role

# Configuring Session Access role {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Configure Session Access to reduce user access in a session based on IP, location, Identity Provider attributes, and user attributes using adaptive authentication policies.

## Vorbereitungen

Role required: security_admin  
Hinweis:  
* Session Access configurations can only be performed with <kbd class="ph userinput">security_admin</kbd> role. You must elevate your role to <kbd class="ph userinput">security_admin</kbd>.
* Session Access doesn't support integrations.
* Session Access has no impact if the reduced or limited role isn't assigned to a user. In this case, there are no changes to the logged in session. User will still continue to access the instance with their assigned privileges.
* Session Access has no impact while the user is already logged in to the instance and simultaneously the admin configures the policy. The user has to log out from the session for the policy to be effective.
* Session Access is enforced at the time of login. Any change in risk parameters during the session won't result in reduced access. For example, a user switching from the corporate network to an untrusted network after establishing the session, won't result in reduced access unless the user logs out and logs in again.
* Session Access (Zero trust access - ZTA) feature, roles like <kbd class="ph userinput">snc_internal</kbd> and <kbd class="ph userinput">snc_external</kbd> cannot be removed.
* Session Access (Zero trust access - ZTA) feature does not remove a role from the <kbd class="ph userinput">sys_user_has_role</kbd> or the user group membership table. Based on the ZTA policy, it establishes the user session with reduced or limited roles.
* The scripts running in the system context will not honor the ZTA session roles.
{#configure-session-access-role__ul_kcm_4vj_qxb}

## Prozedur

1. Navigate to AllZero Trust AccessSession Access Role Configurations.
2. To create a Session Access role configuration, select New.
3. On the form, fill the fields:  
   {#configure-session-access-role__table_vdl_r1g_twb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the configuration |
   | Description | Short description of the configuration. |
   | Policy | Choose the adaptive authentication policy. Use the look-up icon to view the list of policy. |
   | Action | Remove Roles or Limit to Roles. * Remove Roles: When the configured user logs in, the list of roles provided in the Role or Group List are removed for the session. * Limit To Roles: When the configured user logs in, only the selected roles are provided to the user and all other roles are removed for the session. {#configure-session-access-role__ul_q4g_bzq_2xb} |
   | Role List | Choose roles from the Role List. |
   | Group List | Choose the roles from the Group List that you want to remove or limit to the user. |
   [Tabelle : 1. Session Access Role Configuration]

   {#configure-session-access-role__table_vdl_r1g_twb}
4. Select, Submit.  
   The login for users based on the configured countries is as follows:
   * In Remove Roles, the users from the configured countries with the selected roles no longer have those roles for the session.
   * In Limit To Roles, the users from the configured countries with the selected roles only have those roles for the session.

   {#configure-session-access-role__ul_oz4_dvf_kxb}

   To know more about how to remove or limit roles for a session explained with a sample use-case, see [Tutorial: Use Zero Trust Access](https://servicenow-prod.fluidtopics.net/Tm~l3LUhvY33l9vvvgKYxw "Procedure to use Zero Trust Access feature with an end-to-end use case.").