Domain separation for Platform Analytics dashboards

  • Release version: Yokohama
  • Updated January 30, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Domain separation for Platform Analytics dashboards

    Domain separation in Platform Analytics allows ServiceNow customers to logically separate data, processes, and administrative tasks into distinct domains. This separation controls user access and visibility, ensuring that users only see and interact with data pertinent to their assigned domain. The feature supports multiple tenants within a single instance, enabling tailored configurations and permissions per tenant.

    Show full answer Show less

    To activate domain separation, customers must enable the domain separation plugin. Additionally, for users in child domains to view dashboards in parent domains, both domain separation and delegated administration must be enabled. Child domain users can only view (read access) dashboards from parent domains and cannot modify them.

    Key Features

    • Data and Access Control: Dashboards, tabs, and widget containers are domain-separated, controlling visibility and editing rights based on user domain.
    • Dashboard Sharing: Only dashboards explicitly shared are visible to other users. A dashboard created in a parent domain and shared appropriately is visible to all child domain users.
    • Editing Restrictions: Users can only edit dashboards within their domain. For example, an HR domain user cannot edit dashboards in the parent or other domains.
    • Widget Content Domain Governance: Widget visibility depends on their original content domain. A widget linked to a report in one domain will not be visible to users in another domain, even if the dashboard is shared.
    • Administrative Guidance: Administrators should edit dashboards within the correct domain context to ensure changes are visible to intended users.

    Practical Implications for ServiceNow Customers

    By utilizing domain separation in Platform Analytics dashboards, customers can:

    • Maintain strict data segregation and access control across different business units or tenants within a single ServiceNow instance.
    • Customize dashboard behaviors and requirements per tenant, such as requiring specific comments on record closure in one tenant but not another.
    • Ensure that users only access relevant dashboards and data, enhancing security and compliance.
    • Manage and share dashboards efficiently across parent and child domains while respecting domain boundaries for editing and data visibility.

    Careful domain-aware configuration and administration are essential to leverage domain separation effectively and avoid visibility or editing issues.

    Domain separation is supported throughout Platform Analytics. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

    Support level: Standard

    • Includes all aspects of Basic level support.
    • Application properties are domain-aware as needed.
    • Business logic: The service provider (SP) creates or modifies processes per customer. The use cases reflect proper use of the application by multiple SP customers in a single instance.
    • The instance owner must configure the minimum viable product (MVP) business logic and data parameters per tenant as expected for the specific application.

    Sample use case: An admin must be able to make comments required when a record closes for one tenant, but not for another.

    For more information on support levels, see Application support for domain separation.

    Overview of domain separation

    To activate the domain separation plugin, see Request domain separation.

    Important:
    For users in child domains to view dashboards in parent domains, both domain separation and delegated administration must be enabled.

    Users in child domains cannot overwrite dashboards. Child domain users only have read access to dashboards.

    How domain separation works in Dashboards

    Assumptions:
    • Only dashboards that have been shared are visible to other users. See Share a responsive dashboard.
    • Users granted edit permissions on a dashboard can only edit that dashboard if they are in the same domain as the dashboard. For example, a user who is in the HR domain cannot edit a dashboard created in the parent of the HR domain.

    Dashboard data that is domain separated includes dashboard records, dashboard tabs, and widget containers. Widget content is governed by the domain separation that applies to the content itself. For example, an admin adds a report created in the HR domain to a dashboard in the IT domain. This report is not visible to users in the IT domain, although they can see the widget container.

    A dashboard defined at the global level is visible to all users with whom it has been shared. A shared dashboard created in a parent domain is visible to users in the parent and all its child domains. For example, a dashboard created in the TOP company is visible to users in:
    • Joe's company
    • Other companies in the TOP company
    • All HR, CS, and IT child domains in those companies if it is shared with those users.
    In the following figure, dashboards created in the IT, CS, and HR domains are not visible to users in the other child domains or in the parent domain.
    Figure 1. Domains list example
    List of company departments in separate domains including IT, CS, and HR
    Important:
    Administrators should not edit a domain-separated dashboard from the global domain, because additions made to the dashboard are not visible to users within the separated domain. When editing dashboards, make sure that you are logged in to the correct domain.