Impersonating users

  • Release version: Xanadu
  • Updated August 1, 2024
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Impersonating users

    ServiceNow administrators can impersonate authenticated users to access the system exactly as those users do, including their menus and modules. This capability is primarily used for testing purposes, allowing admins to experience the system from another user’s perspective. All actions performed during impersonation are logged as if executed by the impersonated user.

    Show full answer Show less

    Impersonation limitations

    • Access to scope-protected and encryption module roles during impersonation depends on the configuration of the Impersonation option in the module access policy.
    • Impersonating users with admin roles limits access to certain features and modules unless the impersonator already holds those roles.
    • For application-specific admin roles (e.g., Human Resources Admin, Security Incident Response), some areas like security incidents and user profile information remain restricted unless the impersonator has those roles.
    • Admins cannot change passwords of users with application admin roles while impersonating them.
    • Impersonation ends if the user impersonates another user or the session ends (e.g., logout).
    • Impersonation start and end events are logged in the system log.

    Impersonation requirements

    • The user to be impersonated must have a valid user ID in the User [sysuser] record; otherwise, impersonation is not possible.
    • Accounts used for impersonation should cover different roles (e.g., admin, ITIL technician, end user) to support comprehensive testing scenarios.
    • If impersonating a locked or inactive user, the system will log out the impersonator upon any action.
    • Changes made during impersonation only apply to the current session; it is recommended to log out and back in after completing impersonation to ensure accuracy.

    Additional features

    • Mobile impersonation is supported through ServiceNow mobile apps.
    • Administrators must enable the impersonation feature’s visibility before users can use it.
    • Users can select or enter a username to start impersonation.
    • All impersonation activities are recorded in the system log for auditing purposes.

    Administrators are able to impersonate other authenticated users, a feature primarily used for testing.

    This function enables the administrator to access the system exactly as the impersonated user, including identical menus and modules. All actions performed by the administrator during impersonation are recorded as if they were executed by the impersonated user.

    Impersonation example

    Impersonation limitations

    When you impersonate a user, all scope-protected roles and encryption module roles are supported if the Impersonation option is configured in the module access policy. See Create a module access policy for details.

    Impersonating a user enables access to scope-protected and encryption roles, as defined in the access policy. However, if impersonating a user with an admin role, access to certain features and modules is limited unless the impersonator already possesses those roles.

    Impersonating a user with an application-specific admin role, like Human Resources admin or Security Incident Response, limits access to certain features such as security incidents and profile information, unless these roles are already assigned to the impersonating admin. This restriction extends to certain modules and applications in the navigation bar, and admins can’t change the password of users with application admin roles.

    The following actions or conditions cause a user impersonation to end:
    • The user impersonates a different user
    • The user session ends, for example after a user logs out of their instance
      Note:
      When an administrator starts impersonating a user, the 'Impersonate Begin' event is logged in the system log. Similarly, the 'Impersonate End' event is recorded when impersonation concludes under one of the two conditions listed above.

    Impersonation requirements

    The user account to be impersonated must have a user ID. You can find this ID in the User [sys_user] record for the account. If this value is missing, the message The user you selected could not be impersonated appears.

    You need several different accounts to test the system.

    • An admin account to do work
    • An information technology infrastructure library (ITIL), or similar, account to test as a technician
    • An ESS account to test as an end user
    More logins may be required to adequately test the system.
    Note:
    If you try to impersonate a user who is either locked out or inactive, the system will automatically log you out if you initiate an action or select a link. Remember that all changes made during impersonation only apply to that session. To help ensure accuracy, log out and then log back in after completing the impersonation.

    Mobile impersonation

    Mobile impersonation is available on ServiceNow mobile apps. For information on mobile impersonations, see Mobile impersonation.