Domain separation and Advanced Work Assignment
Summarize
Summary of Domain separation and Advanced Work Assignment
Domain separation in Advanced Work Assignment (AWA) allows ServiceNow customers to logically separate data, processes, and administrative tasks into distinct domains. This separation controls user access and visibility, enabling multiple service provider (SP) customers to coexist securely within a single instance. AWA facilitates automatic work item assignment to qualified agents through domain-specific queues and routing conditions tailored to these domains.
Show less
Key Features
- Domain-aware application properties: Properties adjust behavior based on domain context, supporting multi-tenant use cases.
- Domain-specific routing conditions: Admins can configure queues to route work items to specific domains or domain hierarchies, ensuring correct task visibility and segregation. For example, routing can be set to match a specific domain exactly or include child domains via domain path conditions.
- Eligible assignment groups aligned to domains: Assignment pools must contain agents within the domain authorized to view and work on routed items. If an agent lacks access, AWA automatically rejects the assignment and reassigns the work item to a suitable agent.
- Handling access mismatches: Work items can be temporarily assigned but rejected if agents lack domain visibility, preventing unauthorized access and ensuring proper reassignment.
Practical Considerations for ServiceNow Customers
- Instance owners must configure minimum viable product (MVP) business logic and data parameters specific to each tenant to enforce domain separation effectively.
- Admins can customize domain-specific behaviors, such as requiring comments on record closure for one tenant but not another.
- Misconfiguration in assignment groups can cause work items to be repeatedly rejected and stuck in queues, requiring administrative correction.
- Use routing conditions carefully to ensure work items are visible and routed only to appropriate domains and agents.
Outcomes
By leveraging domain separation with Advanced Work Assignment, ServiceNow customers can:
- Maintain strict data and process segregation between tenants or organizational units within a single instance.
- Ensure that work items are routed and assigned only to agents authorized within the correct domain, preserving security and compliance.
- Enable service providers to manage multiple customers effectively, each with tailored process controls and access restrictions.
- Reduce operational risk associated with unauthorized access or task misassignment in multi-tenant environments.
Domain separation is supported in the Advanced Work Assignment feature. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.
Support level: Standard
- Includes all aspects of Basic level support.
- Application properties are domain-aware as needed.
- Business logic: The service provider (SP) creates or modifies processes per customer. The use cases reflect proper use of the application by multiple SP customers in a single instance.
- The instance owner must configure the minimum viable product (MVP) business logic and data parameters per tenant as expected for the specific application.
Sample use case: An admin must be able to make comments required when a record closes for one tenant, but not for another.
For more information on support levels, see Application support for domain separation.
Overview of domain separation and Advanced Work Assignment
Advanced Work Assignment enables the automatic assignment of work items to qualified agents using work item queues defined for specific service channels. Managed Service Providers can create domain-specific queues by specifying a particular domain as a queue routing condition.
How domain separation works in Advanced Work Assignment
- Route work by domains
- To push work items to agents in domains where only certain tasks or interactions are
visible to them, use a routing condition that routes those items to the appropriate
queues. For example:
- To restrict a queue to only items that match exactly to a particular domain X, specify this condition: [Domain] [is] [X]
- To route all work items in domain X and its child domains to a queue, use the Domain Path field and specify a condition such as: [Domain Path] [starts with] [!!!/!!#/]
- Assign work to agents in the appropriate domain
- To assign work items to agents in the appropriate domain, ensure that the assignment
groups specified in the queue Eligibility Assignment pools have agents that belong to the domains where
they can see the work items routed to the queue.
If a mismatch occurs, and agents in an eligible assignment group cannot see a work item in a queue, AWA may temporarily assign an item to an agent. However, before the item is moved to the agent's inbox, AWA automatically rejects the assignment with the reason No access. AWA reassigns the work item to a different agent who might have access. If none of the available agents can see the work item, the item could be rejected multiple times.
Warning:The item can get stuck in the queue until the AWA admin corrects the eligible assignment configuration.