---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Elevated privilege roles

# Elevated privilege roles {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Elevated Privilege Roles

Elevated privilege roles require users to manually accept the responsibility of using these roles before accessing their features.
By default, users do not have elevated privileges upon login and must elevate their role for the duration of their session, which ends with session timeout or logout.
Show full answer Show less  

## Key Features

* Any role can be designated as an elevated privilege role, allowing assignment to multiple users to manage access rights effectively.
* Users must meet specific conditions to use an elevated role, including having the role assigned and manually elevating to the required role for its privileges.
* The admin role can only be granted by another user with the admin role, while the securityadmin role requires elevation by a user with the admin role.
* The securityadmin role is the sole elevated privilege role in the base system, granting access to ACLs and High Security Settings.
* A property exists to require admins to manually select their elevated role, enhancing security management.

## Key Outcomes

By effectively managing elevated privilege roles, ServiceNow customers can ensure that users only access necessary rights when needed, thereby enhancing security and compliance. Administrators will have the tools to control user access more rigorously, ensuring that elevated privileges are handled safely and responsibly.  
Elevated privilege roles require you to manually accept the responsibility of using the
role before you can access the features of the role.

By default, you do not have elevated privilege roles upon login. You must manually elevate to
the privilege of the role. An elevated privilege role lasts only for the duration of your user
session. Session timeout or logout removes the role.

You can designate any role as an elevated privilege role, and then assign that role to one or
more users. Do this when you want to restrict users from having access to the rights that the
role provides immediately after login. You can designate the privilege role on the Role form. See
[Create a role](https://www.servicenow.com/docs/access?context=t_CreateARole&version=australia&pubname=australia-platform-administration&ft:locale=en-US) for instructions.  
To use an elevated role, you must meet these conditions:

* The elevated role must be assigned to you.
* You must manually elevate to a specific elevated role to get its privileges, even if you are already elevated to a second elevated role that contains the first elevated role.For
  example, if elevated role A contains elevated role B, even if you elevate to role A, you must
  still elevate to role B to get its privileges.

{#c_ElevatedPrivilege__ul_uhx_3yz_k1b}

## The admin role {#c_ElevatedPrivilege__section_b1s_fw4_3gb}

To grant the admin role to a user, the granting user must also have the admin role. For example, a user with only the user_admin role cannot grant the admin role to other users.

* Non-admin users cannot add a user to a group that contains the admin role.
* To grant the security_admin role to a user, the granting user must also have the admin role and must elevate to the security_admin role before granting the security_admin role to other users. A user with only the admin role cannot grant the security_admin role to other users.
* A user without the security_admin role cannot add a user to a group that contains the security_admin role.

{#c_ElevatedPrivilege__ul_tsk_gt4_3gb}  
Warning:  
The use of elevated privilege on an admin role is not supported. Instead, require admins to manually elevate, see [Force administrators to manually elevate](https://www.servicenow.com/docs/7pe1Ib_wyYE1Up0ZD_Rqxg "A property is available to force all users with the administrator role to manually select the role that they want to elevate to.")

## The security_admin role {#c_ElevatedPrivilege__section_rlm_wtz_k1b}

In the base system, the security_admin role is the only role that has elevated privileges.
This role is automatically assigned to the user who is the default System Administrator (admin)
user. It provides access to [ACLs](https://www.servicenow.com/docs/Hi4a7ZI7SruBj5ML5waM_g "Access control lists (ACLs) restrict access to data by requiring users to pass a set of requirements before they can interact with it.") and [High Security
Settings](https://www.servicenow.com/docs/6M331EdyVeGLv~dElwIKiQ "High Security Settings refer to several security options available in your instance.").  
Figure 1. Roles assigned to the System Administrator (admin) user  
Note:  
To see this role, you must actually elevate to the security_admin role first. If you are logged in as the System Administrator (admin) user only, you cannot see the security_admin record in the list of roles.
* **[Security_admin role](https://www.servicenow.com/docs/jH6V1bct8nljqPFnbcpCyA)**   
  The security_admin role is an elevated privilege role provided with High Security Settings that lets users create and change access controls and change High Security Settings.
* **[Elevate to a privileged role](https://www.servicenow.com/docs/KHD6acRdk65mqNIgdvlpng)**   
  The base system admin can elevate to a privileged role to have access to the features of High Security Settings.
* **[Force administrators to manually elevate](https://www.servicenow.com/docs/7pe1Ib_wyYE1Up0ZD_Rqxg)**   
  A property is available to force all users with the administrator role to manually select the role that they want to elevate to.