Domain separation terms
Summarize
Summary of Domain separation terms
Domain separation in ServiceNow enhances efficiency, security, and performance by organizing data and processes across multiple customer organizations within a single instance. Understanding key domain-related terms and concepts is essential for configuring and managing domain-separated environments effectively.
Show less
Key Concepts and Domain Types
- Managed Domain: Allows domain administrators to manually assign domains to users, groups, departments, locations, or configuration item (CI) records. This overrides automatic domain assignment from company records and enables customization of application behavior per domain.
- Process Tables: These tables support delegated administration through overrides, enabling domain-specific policies. Global domain administrators can view all process records, including overrides, using Expand/Collapse Domain Scope links. Visibility of process records flows from parent to child domains but not vice versa, ensuring controlled data access.
- Domain Types:
- Customer Domain: Contains the user interface and processes controlling data use for specific customers.
- Process Domain: Defines processes and UI settings applicable across domains without storing core user data.
- Data Domain: Holds shared data relevant to multiple customers, allowing shared access without exposing individual customer domains. Use cautiously due to potential performance impacts.
- User Data: User records reside primarily in customer domains and occasionally in data domains. Admin accounts reside exclusively in the global domain to support administrative functions.
Administration and Configuration
- Lists and Choices: Adding new choice values in the global domain automatically propagates options to all domain-specific lists, with options activated or deactivated based on selection status.
- Instance Administration: Instance owners manage overall process creation and maintenance, while individual domain managers handle user administration, group memberships, locations, and tenant-specific applications.
- Global Process and Parameters: Processes and parameters affecting the entire instance (such as system properties, ACLs, indexing, and dictionary overrides) are managed globally, with access controls as needed.
Practical Implications for ServiceNow Customers
- Domain separation enables secure segregation of customer data and tailored processes, improving organizational control and compliance.
- Delegated administration allows domain-specific policy enforcement while maintaining centralized oversight.
- Careful use of data domains can facilitate necessary data sharing but requires architectural consultation to avoid performance issues.
- Proper domain assignment of user and admin accounts supports security best practices and operational efficiency.
- Global configuration of choices and processes ensures consistency across domains while allowing domain-specific customization where needed.
With a ServiceNow instance, you can improve efficiency, add greater security, and increase performance for your customer organizations. It's helpful to understand some of the most common terms as you create your configurations.
Managed domain
In a managed domain, the Managed domain field allows domain administrators to manually select a domain for the user, group, department, location, or CI record, rather than using the domain that is assigned automatically from the company record.
If you want to change those properties, you can override them to further customize the functions of the applications in each of your domains.
Process tables
In process tables, if you see a value in the Overrides [sys_overrides] field, a process override record exists. That means that delegated administration, which is how administrators can set domain-specific policies, is in effect. Admins in the global domain can use the Expand/Collapse Domain Scope related link to see override records.
When you view process tables from a domain, you see only the relevant process records for the selected domain. When you view a process table from the global domain, the Expand Domain Scope related link is displayed to let you see all process records, including overrides. To view only the relevant process records for global again, use the Collapse Domain Scope related link.
The domain scope feature is used only for process tables and causes the visibility of data on the table to shift in the opposite direction. For example, a record in the parent domain can be seen in the child, but a parent cannot see a child record. This allows the process to flow down to child domains.
Types of domains
Different types of domains can help you organize your processes and data and how they function in the application or feature.
Customer Domain
In the customer's domain is the user interface, as well as the process that controls how the data Is used.
The ACME domain in the following image is a customer domain.
Process Domain
- Specific processes and UI settings for a set of domains
- No core data of any kind (such as specific user data).
- The TOP domain in the following image is a process domain.
Data Domain
Example: The domain may hold tasks that ACME, Cisco, and the SP all need to interact with.
The Default domain in the following image is a data domain.
User Data
User record data never belongs in the global domain or any of the process domains. Users are primarily created in customer domains and can on occasion be created in data domains.
Admin accounts are special as they should not be used as everyday users of the instance and should be in the global domain to facilitate administrative functions.
Lists, admin, global process
Lists
From the global domain, if you right-click any choice field’s label, select Configure Choices, and then add a new choice, the choice pushes automatically to all domain-specific lists for that field. If the new option is marked as Selected, it is added as active. If the new option is marked as Available, it is added as inactive.
Instance Administration
The instance owner’s administrators must handle all normal process creation, modification, and maintenance in a domain-separated instance. Individual domain managers can maintain some parts of data-driven processes. The types of domain managers maintain user administration, support group memberships, and locations, or manage applications that are designed with tenant administration in mind.
Global process/parameters
You can create and maintain the process that affect the global domain as well as set the parameters. These properties are common for all users of a domain-separated instance.
Examples: System properties, dictionary overrides, sys_documentation
(field labels), the data model (classes, CI types, and so on), tables and fields
[sys_dictionary] (access can be restricted), indexing (text indexes as
well as database), ACLs, installation exits, inbound actions, public pages, and
interceptors.