--- sourceDocument: Australia Strategic Portfolio Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/it-business-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Strategic Portfolio Management ft:clusterId : - itbm bundleId : - itbm workflow : - Technology --- # Explore # Exploring SPM Enterprise-Wide Deployment {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read SPM Enterprise-Wide Deployment (EWD) provides data partitioning capabilities for Strategic Portfolio Management (SPM) tables that enable organizations to separate and control record visibility across functions such as departments and business units. EWD is a Strategic Portfolio Management (SPM) product for enterprise-scale organizations that must balance centralized platform management with department-level data isolation. Administrators can create and configure partitions that separate data across functions such as IT Operations, HR, and Finance. Each partition is governed by a dedicated role that determines which records users can access, reducing the need for separate ServiceNow instances for each function. EWD supports key SPM tables including projects, demands, programs, and portfolios. Partition logic extends automatically to related records such as cost plans, resource plans, and planning items through automatic partition stamping. For complete list of supported tables and related entities, see [Supported tables for partition](https://servicenow-prod.fluidtopics.net/xSUbN9ilEuJYpcQOF9yCEg "Several tables are supported for partition using Enterprise-Wide Deployment, including direct and indirect related tables for each entity."). ## What is a partition {#explore-ewd__section_how_partitions_work} A partition is a vertical data separation unit that controls which users and roles can access specific records within supported tables. Partitions are configured at the function level using a partition criteria field such as Department, and each partition is assigned a dedicated role that governs record visibility for users in that department. For example, an organization can create separate partitions for IT Operations and HR Learning and Development. A user assigned to the IT Operations partition accesses only IT Operations projects, demands, and related records. That user can't access records belonging to the HR partition. After a partition is configured, access control is enforced automatically at runtime. Partition criteria and role assignments determine data visibility without additional configuration. This enforcement applies consistently across Project Workspace, Resource Management Workspace, Portfolio Planning Workspace, and Strategic Planning Workspace. ## Partition criteria {#explore-ewd__section_partition_criteria} Partition criteria define the reference column that determines which partition a record belongs to. When a record is created, the application evaluates the value in the criteria column --- such as Department, Portfolio, or Investment Type --- and stamps the record with the matching partition. Each supported table uses a single criteria column across all its partitions, ensuring consistent record segregation throughout the SPM data model. Once set, the criteria column is locked for that table to maintain consistency across existing and future partitions. ## Automatic partition stamping {#explore-ewd__section_partition_stamping} When a record is created in a supported table such as a project or demand, the system automatically evaluates the partition criteria and stamps the partition value on the record. Administrators don't have to manually assign partitions to individual records. For related records and sub-entities such as cost plans, resource plans, and planning items, the partition value is automatically inherited from the parent record. This maintains data consistency across the full SPM data model without manual intervention. For existing records created before partition configuration, an admin-runnable backfill job is available to stamp partition values on historical records. ## How partitions control access {#explore-ewd__section_partition_tables} Partitions enforce data visibility through Security Data Filters using a dynamic filter called One of my partitions. When a user accesses a record, the system evaluates their assigned partition role and returns only the records that match their partition criteria. The following diagram shows the end-to-end flow of partition setup and access control across four departments: IT Ops, HR L\&D, Finance, and Sales. Figure 1. End-to-end flow of partition setup and access control across An EWD admin creates partitions for each department and configures the partition criteria using a reference field such as Department on each supported table. A system admin assigns partition roles to department members and assigns the EWD PMO role to organization leads who require visibility across all partitions. For records created before partition configuration, a scheduled job stamps existing records with the correct partition value. When a record such as a project, demand, program, or portfolio is created, the application stamps it with the correct partition based on the department field. The One of my partitions filter then evaluates the partition at runtime, so each user sees only the records in their assigned partition. Users with the PMO role can access records across all partitions. The following examples show how partition access works at runtime: * A user assigned to the IT Ops partition can access only IT Ops projects and demands in all workspaces. No HR L\&D, Finance, or Sales data is visible in list views, search results, or dashboards. * A user assigned to the HR L\&D partition can access only HR L\&D records. No other partitioned data is visible anywhere in the application. * A user with roles for multiple partitions, such as a portfolio lead, can access records from all assigned partitions across any view --- workspaces, list views, search results, or dashboards --- with no duplication or data merging. {#explore-ewd__ul_gjv_bjk_fjc} Extended Security for Enterprise-Wide Deployment (Extended Security for EWD) provides additional security for partitioned tables. It extends partition access controls across APIs, agentic workflows, indirect references, and unpartitioned parent tables. For details, see [Additional security with Extended Security for EWD](https://servicenow-prod.fluidtopics.net/EnRcEF~aEBvrL1UWExXJtg "Additional security is an ACL enforcement feature available with Extended Security for Enterprise-Wide Deployment that applies partition-based access control to four partitioned tables: Project, Demand, Program, and Portfolio."). ## Workspace support {#explore-ewd__section_workspace_support} EWD partition enforcement applies across the following workspaces: * Project Workspace --- Partition enforcement applies across all tabs including Details, Planning, Resources, Financials, RIDAC, and Status Reports. * Portfolio Planning Workspace (PPW) --- Partition enforcement applies to projects, demands, roadmaps, scenario planning, financial planning, resource capacity, and dashboards. * Strategic Planning Workspace (SPW) --- Partition enforcement applies to planning item types --- project and demand --- when the ServiceNow Internal Alignment integration is enabled. When a user populates the partition criteria field on either the planning item or its linked execution record, the partition details are stamped on both records. This bidirectional behavior verifies that strategic and operational teams work from the same data while maintaining departmental data separation. * Resource Management Workspace --- Partition enforcement applies to resource plans, allocations, capacity views, and time cards linked to partitioned records. {#explore-ewd__ul_ijv_bjk_fjc} ## EWD roles {#explore-ewd__section_ewd_roles} EWD includes two roles that govern partition creation, access, and record visibility: EWD admin \[sn_spm_ewd.ewd_admin\] : Grants access for creating and configuring partitions. Users with this role can create partitions, define a role for each partition, configure partition criteria for each supported table, and manage partition settings. This role grants no elevated privileges outside the partition configuration scope. EWD PMO \[sn_spm_ewd.ewd_pmo\] : Grants visibility across all partitions regardless of the assigned partition role. When the One of my partitions dynamic filter detects this role, all partition records are returned. Use this role for PMO users who require enterprise-wide visibility across all departments. ## Scope and limitations {#explore-ewd__section_current_limitations} Partition enforcement applies to classic form views, list views, search results, and dashboards. The following limitations apply: * Partition criteria can only be defined on reference columns available on the partitioned table. * All partitions on the same table must use the same reference column --- for example, if Department is set as the criteria for the Project table, all subsequent partitions on the Project table must also use Department. * Different supported tables can each have their own criteria field defined independently --- for example, the Demand table can use a different reference column than the Project table. * Only one condition per partition is supported. * Changing partition criteria after data has been populated requires deleting and recreating the affected partitions. * Partitioning is supported only on pm_project, pm_portfolio, dmn_demand, and pm_program. * Partition enforcement does not apply to indicator-based reports and widgets that calculate scores from a separate table. Users may see unfiltered data in indicator-based widgets regardless of their partition assignment. {#explore-ewd__ul_jjv_bjk_fjc} ## Comparing EWD with Extended Security for EWD {#explore-ewd__section_cc1_jyv_dwb} * EWD: Create goals, set targets for them, and evaluate the progress of the goals and targets to accomplish the organizational plans and drive business outcomes. * Extended Security for EWD: Automate the actual value of your targets by collecting the actuals from different target sources such as benefit plans, cost plans, assessments/surveys, and PA Indicators. {#explore-ewd__ul_usy_pyv_dwb} {#explore-ewd__table_bmt_jnf_fwb__entry__3} | Feature | Enterprise-Wide Deployment | Extended Security for Enterprise-Wide Deployment | |-|-|-| | [Create and configure partitions](https://servicenow-prod.fluidtopics.net/9OVKfJ0_6~5TJ~KxmfzxIA "Create a partition to control record visibility for users within a specific function, such as a department or business unit.") | ![Yes]() | ![Yes]() | | [Assign partition role for access to the partition](https://servicenow-prod.fluidtopics.net/G16OXmkMBigNPOCNHRsyzw "Assign a partition role to users or user groups to grant them access to records within a specific partition.") | ![Yes]() | ![Yes]() | | [Assign PMO role for visibility across all partitions](https://servicenow-prod.fluidtopics.net/fRHlz2kQx9h8qhJgL~2iAw "Grant users or user groups access to partitioned records in Enterprise-Wide Deployment by assigning the appropriate EWD PMO role.") | ![Yes]() | ![Yes]() | | [Update partition details for existing records](https://servicenow-prod.fluidtopics.net/nT6Ey~89t4jDLemYwJTp4Q "Update existing records in the project, demand, programs, portfolios, and planning item tables with partition details by running the Update existing records with partition details scheduled job.") | ![Yes]() | ![Yes]() | | [Enable additional security for partitions](https://servicenow-prod.fluidtopics.net/0KKA4giiZgJ07LnMmmqEow "Enable additional ACL enforcement for partitioned tables to strengthen access control validation. Select the tables where you want to apply enhanced security.") | ![No]() | ![Yes]() | [Table 1. Comparison of EWD and Extended Security for EWD features] {#explore-ewd__table_bmt_jnf_fwb} Note: The Extended Security for Enterprise-Wide Deployment application is an extension to the Enterprise-Wide Deployment application. When you install the Enterprise-Wide Deployment application, you get all the features of Enterprise-Wide Deployment and the additional security for partitioned tables feature.