hello my name is Jason Miller founder of Aspen now solutions and we're about to unlock the power of service now I'd like to start off by thanking all 1998 subscribers in over 80 countries globally if you believe in transferring knowledge to those who need it most please click Subscribe your user data will not be transferred to anyone outside of Aspen now without your express consents domain separation this is where we go from the children's end at the pool to the adult side of the pool and for those of you that have been working on ServiceNow for I don't know over five years now and I've never touched a domain separator instance I can tell you that it's a very humbling experience so basically take all that you've known about developing applications and anything that you've done in service now and we can make it exponentially harder probably by a factor of 10 just because the exponential possibilities for error due to the way domains are structured in ServiceNow but also domain separation is also apparent and other cloud applications or platforms out there too so in order to get domain separated what we have to do is activate a plug-in kind of like any other application and what we're looking at here when we type in domain in our picker here so our application navigators using will find here we have domain admin as our application now we're going to have our domains or domain map and our configuration I'll go through each one of these with a little bit of detail also for this series probably going to do several videos because there was a lot to learn about domain separation also in my previous video I saw that there were some comments they liked the individual like the domain separated aspect of doing the performance analytics and the dashboards so I'm gonna do probably videos on both performance analytics but also domain separation since it is a topic that isn't really covered that often and about a year or two ago I did notice that there was an uptick in the need for developers who have experience in domain separate environments so this or domain lists and one thing there's a couple things that I want you to remember with domain separation number one I am an admin so I break all the rules when it comes to domain separation which means that I'm gonna have access to everything and this right here this is our domain paper so our domain picker is basically showing us kind of the structure here I'm also going to show you how to change it so it's searchable in a future video but just remember that if all else fails I kind of have this rule I can't find something I go to global does Global contains everything and then after that we start with our structure and there's also another way to map this out and I'm going to show you that in a second with our their domain map so here we have all the names of our domains there's a couple that I've created we'll see here MCT that we're going to have customers I created and then kingfisher which is a separate account this is what we call a whale accounts and maybe we only want certain people touching this account I will show you how it looks on the map in just a second let's talk about what we have our descriptions here out of the box which you're going to find is that you have this MSP domain I guess this managed service provider this actually contains top even though there is a parent-child relationship here so it's hop is what we would call a primary domain this is true right here so just make sure you remember this you can only have one primary domain so you can repeat that you can only have one primary domain and that's it and then here we're gonna have our parent domains so if we were to put one in and we'll see here that top has no parent since it's the primary now we don't consider global the parent of top it's just kind of out there so if we take a look at our domain map and I'll skip through these real quick so this is kind of what our good this is exactly what our domain map looks like right now so we have here MCT is our corporation here this was the mayor of constitute one of the places one of my favorite restaurants in Miami and the mayor is retired from politics now he's running a corporation we call it MC t so this is one domain here for all the mayor's customers and then we have the King fish or the Whale account over here which is kind of like privileged access so I'm going to show you the differences later on and when we give someone access to this environment versus one of these kind of what it looks like to them so again I think I've talked about this MSP one out of the box it actually contains all the stuff here in top so you're probably wondering why they would do that out of the box that's a great question I'm assuming that they're figuring that you're probably gonna put all your developers may be in this MSP domain and then everything is gonna trickle down from here but the way that in my experience I've had developers working in here so one thing I'm going to show you is how to put your your admins on top and also one of the things you always have to remember is that you have to check your domain picker because this thing will reset to whatever's in your profile I'm going to show you that a little bit but rule of thumb is this there's actually three rules number one put your admins on top number two is never forget to put your admins on top and number three is always remember to never forget to put your admins on top it's going to prevent the creation of what we call overrides on what we call process tables we'll get more into that maybe in this video I'll touch on a little bit but probably in later videos I'll show you what overrides are they can be very frustrating to do developers and whoosh and I'll show you how to basically clear out overrides in a future video or two okay so this is our domain map and let's see what happens if we tried to create a second top domain right so a second primary so we'll see here we have our box check this primary I'm gonna put in top two here and then it will see it's contained but I'm gonna do an insert and stay let's see what happens probably gonna mess this thing way up okay so washes this thing wigs out right domain high work has changed I made a valve all blah blah okay record not found so now if we go to our map let's see what happened is here okay so it looks like we have here top and I'm not even sure if it'll let me do this with the second primary so it looks like we have top here but we can't find that top two that we just created so now bite and in fact it's not even showing here so here I'm gonna try that again I really try to break the system so I'm gonna call it top two I'm gonna do primary I'm gonna do a submit there we go that's that's what I wanted here duplicate entry key name that's not really what I was looking for so let's try top three now let's do is submit here it has been deleted or you'd have no longer access to read let's see if we're gonna really break this thing okay it looks like it's hanging in there so now if I go to global write because here I can't find this thing looks like everything is there and now if I go to global we'll see if it let us insert that record or not okay so it looks like top two it allowed us to do two primary domains but I'm gonna get rid of this one because we can't have two primary ones here and in fact I'm gonna change this to false so of course when I was trying this before what happened basically it broke this system so just remember that you can only have one primary even though I was able to do it there by doing it inserting to stay so let's see if I'm able to delete this thing now maybe I'll have to go into the record here's a confirmation coming up it's probably thinking to itself like well what are you doing here okay let's delete this and now we'll see that I'm in global right now just I going on there we go so here I'll try it with just one more time to see if I can make this thing break or not let's do no all right there we go so I'm just gonna type in I'm gonna call up Miami I'm gonna make a primary I'm gonna hit submit there's changed okay so now I'm in global and it looks like it made this the primer right now I'm probably because I'm in global now if I'm in top let's see what happens here we can see top stuff and everything on down but I don't think we're gonna see Miami here so just remember you can't find it go into global fact what I'm gonna do is I'm gonna go to the top and I'm gonna refresh our map here there we go that's what I wanted so cannot display domain map primary domain record not found so basically what it's telling us here is like hey something is majorly wrong so if you ever get this or your Maps like totally blanked out go to global chances are someone tried to create they they flip that little primary to true on this one so what I'm gonna do now is I'm gonna make this one false and now I'm gonna make this one through four top all right so now I'm in I'm gonna go back to the top and now let's refresh this list and sometimes it'll take a second for it to refresh list cuz it has to run that business rule so if you're changing the labels here that's fine you can change the labels all you want and it'll it'll automatically change everything which is cool that's not a problem what you want to pay attention to is like domain path will also be important because here you have unique value so you could even name a domain it's kind of like a society I guess in a sense and they've also had this domain code which is something I'm curious about I really haven't tinkered with this too much but for right now all we're gonna remember is our parent and our primary all right so now we spent enough time on trying to break this this tongue so let's and and I've seen it broken a couple of times by accident one other thing I wanted to note was that all these things are not all these domains here they're not audited so when you go into a record here there's no related to the list for like versions or updates or anything like that and if we wanted to check that out we'd go to configure and related lists and we'll see if we have anything for versions or updates or anything like that because these are technically records so this is all part of you know your data structure so if we go down here I don't think there are any versions here or nope does not look like it at all so again that'll probably be another video I'll set up maybe auditing for these things so that way we can keep track of who's doing what here so at this point I've added the edit to our contained by I don't think I'm gonna use this MSP domain for my admins so as you can see your process flows down here overrides from global process they're done here so they're saying look do the overrides here I guess and they're in top right so what I'm gonna do is I'm gonna get out of this business of having MSP contain top I just don't like that set up right there I'm gonna have my admins work on top and so be it that's the way it's gonna be so now one thing and let's see here if I can read it the contained by yeah so if I want to read out it I'll just bring it back in there not a problem so as we can see here our domain map I think we you know showed enough or talked about this enough so the next thing we want to get to and this is our configuration page now why is this important you probably won't go this page that much to be honest with you if you want to change the domain table meaning you want all your domains to be on a different list or something you know I guess you don't have to have it there yet just create another table and then you know change this right here never done it before don't think I will take the out of the box thank you if I want to validate the hierarchy this is just going and sometimes if you really get into a pinch and someone messes something up with your domains you open up maybe a high ticket they might have you go through this just to validate that everything is okay and now let's say your security people come to you and say well I need to know like every table that is domain separated which basically has a system Ain field so when they say is it a domain seperated table just say okay you know does this does this table have the system a field we're gonna bring it up you know click on this UI action here it's gonna pop you out into a list like that with a you got 1260 tables what do you want to do this I don't know do you want to do a chart probably not you probably want to export this thing via like excel so that way or maybe just want to like filter on the tables that are relevant so that's another thing there with that and now I need to get back to that page on here alright so let's open my page back up alright so then we have your domain progress workers and then I've never uncheck this box don't recommend doing that and then delegate administration never mess with any of this stuff here so and then this looks like just our alerts that are that are coming in okay so we've talked about those three things those modules underneath the domain application now let's talk about users a little bit so I think I told you that like my account since I'm an admin should be on top now one thing I found is that in your user records right so we'll talk about Emily Jason in just a second but now we're gonna talk about my account so here's my account when I go into it should I click into my account here it's gonna require a company or it should yeah right here here's our company right so I can put myself in Kingfisher let's say which probably won't matter for me because I'm an admin it breaks the rules anyway one things that I wanted to show you though if you really want to tell if you want to keep your admin in a certain company but you want them to be in top one of the ways you can do that is you don't have to necessarily create a company that you know isn't top or relate at the top you can do that if you want to put it maybe it's easier to do it that way they just manage domain right here let's watch this so see this is my domain automatically becomes top MCT customers now maybe I want to change that at the top let's see if I can do it here now maybe it'll give me a problem stuff with that company in there I don't want let me do customers okay so maybe what I'm going to do here is I want to try to break the system from the list so now just go into let's see if I can bring this domain and you know one of the things that I think needs it a little bit of improvement here is that the domain field once you're done I separate is not any of the lists so that's kind of a pain in the butt because you're gonna want to look things up via domain so let's see if I can change this to top just have that stick yep there we go so now if I open up my record so it's like it changed it there so even though my company is in his Kingfisher which technically is like a grandchild as a grandchild I guess is a grandchild or maybe a great grandchild top I managed to make my managed domain now let's go ahead and reload this form see if this thing comes up great okay so I don't have this even checked but it'll still hold the value in there for domain so in essence let's say I did want to make it customers and I'll show you what that does so I'm gonna select customers here [Music] and now what I'm going to do is I'm just gonna impersonate a user here in order to go back and forth and we'll see what kind of default domain it gives me here [Music] you see on top isn't that wonderful maybe I need to log out and then it'll let's see if I can walk out great okay let me log back in maybe it'll bring up customers hit yeah so this is what we're looking for all right so you see here how it automatically puts me in customers because that's the domain that was selected there so the way to do it is basically in my opinion I'm here oh look Miami's still there got to get rid of that thing okay so the way to do it is to put your customers right here on top or excuse me your admins on top that way they'll always defaults there and it won't create overrides so what am I gonna do I'm gonna go back to my user record I should I'm gonna go back to the ListView we're gonna refresh this list [Music] I'm gonna change it here at the top and hopefully it will do that is it not playing nice with me sometimes it won't find that reference say no you have to stick with these so okay how are we going to do this clear out or I don't think we can even clear out a pump in the air let's try it this way let's do a save also what domain am I am probably live I gotta go to the top to do it see how wonderful this administrative effort is there's a lot of stuff we have to remember here what so a man of my end always have to remember what domain you're in see there we go now I can bring them tops and so I'm in the top domain alright so there's a little lesson for you on you know your admins and like how to keep them steered in the right direction sometimes your customers they're gonna be really adamant that oh I want everyone in this company that's a admin or that works for us or something like that so remember this managed domain even though I don't have it checked right here all this uija policy does right here it just opens up this box but if whatever you have to be very careful if you uncheck this box it doesn't clear it so make sure that if you do want to clear it you put in a UI policy to clear that thing out so that way your note your domain is empty there and it takes basically the company record for that domain so if we take a look at Kingfisher as a company here let's drill into that real quick and you know what we're gonna do we're actually gonna create a domain and then we'll go through the whole motions here because all this stuff so we're gonna say see here Kingfisher is tied to that that's why the customers was coming through right so now if I want to change this domain see if I can do it here see if I can do king I'm searching this thing they like just go this way can I do it I don't know that's all you know let me do customers so maybe I'm just gonna save it like this alright so now it's gonna assign a global one now I'm gonna go in and put in Kingfisher all right bill so there we go we got it now all right so kind of gone through that we have a company here we gave it a domain now let's let's take a look at that I don't we can find that map again okay so let's say that MCT maybe they got some financial stuff that they don't want every won't even want like the admins to see well the admins would be kind of impossible but there's some functionality like that I think with HR where they have like a specific role we're like the only the people with that role can see like the salary data or something like that not even that man's can well let's just say that people whoever's working at MCT we want to have a domain above MCT a parent domain for MCT that not all these users can see like only a couple the higher-ups can see that we'll call it like MCT financial so what am I gonna do now I'm gonna go back to our domain list right [Music] so right now what I want to do and you know what I'm gonna see if I can go find that let's see if I can find this Miami domain and just kill it all right here's the Miami domain but here's a little trick that I want to pop up the global I kill this thing all right it's a primary right nope let's delete it let's see it delete thumbs up their comment yeah there we go excellent [Music] it'll kill this thing off all right looks like it did so I think I said this in the beginning though they like with certain there are certain things that you have to be in global to do and I'll get into that in future videos now you're probably saying well Miami's still there what's going on I think I just got to refresh my browser and it should go away let's see if it does come on now oh I am you still there doesn't want to go away so off to take a look at that later and see what what I did to break the system so to speak okay but yeah rule on that one primary domain there's only one all right so let's get into our user here which was what Emily Jason okay so Emily here up I wrote her note ITIL don't forget so I have a user here who she's in let's see here three groups she's in MCT and she's in the Aspen now test group so she should be able to see you know let's see what's going on in that MCT group and one thing we'll notice on here's a great question for you so with this domain picker thing do you have to be an admin to see the domain picker no you do not have to be now because we're going to have people work in the service desk that need to create incident tickets in different domains so they're gonna have to be able to navigate using this picker now if I give a user I to admin will they be able to see the domain picker so let's just take a look at how many anomalies roll here and oh let's see if she's got she's got I to admin but she doesn't have ITIL so I think this would be a great test question that's out there like what role do you need to see the domain picker so let's go ahead and impersonate her and first off I want to show you and here where you see the domain picker you'll notice here it's in general right now we can even change her from here and all that stuff but generally you want to have it right here we can see it kind of like our that picker it's not in developer which tells us what it's not only for developers so that's one thing to note there now if we go in and impersonate a user like Emily all right all right let's go into her gearshift ha we don't see it she has I to admin shouldn't she have everything that I told us apparently not so what are we gonna do we're gonna go back to Emily's profile here no Simon top great all right now I'm going to hit edit yeah sure I want to leave now I'm gonna go find ITIL no I don't want a favorite past work all right let's hit save all right great one thing I wanted to stress about domain separation one thing that is critical is that if you are building something as an admin you have to remember that impersonation is going to be really important because you want to be able to see what the user sees if you're an admin you can see everything so of course everything is going to work for you but you have to make sure that everything all the work that you do especially if it's on top that it goes all the way down to whatever domain that you want it to affect and if it doesn't then you're gonna have to take a second look at that so if you're not familiar with that concept just remember that little impersonation it's gonna be very important whatever people test you have to have them test as a user that has access to that domain and will be working in that domain all right so no I don't want her to impersonate oh I'm sorry I want to hit the gear shift there we go so see what domains does she have she has all three of these domains Emily does alright now we're gonna show her domain picker in the header rates so why does she have access to all three well you remember our map here look MCT customers Kingfisher oh okay so she gets access to data and here here and here but you know maybe here's the thing like maybe we don't want Emily to be working all this up maybe it's too much work load for her and maybe we just want her work in the Kingfisher account so what are we gonna do that or even better here's one that has come up in my experience I want her just to see customers and Kingfisher but I don't want her to see anything I'm CG typically what people will do is they'll throw her an MCT but then later on they'll realize that she can see everything so in fact let's go and make while she's while she has access to all three let's go ahead and make like three tickets here incident tickets real quick with each different domain so let's go to incident dot do now let's take a look at the form here and see if we have domain on here we don't have domain on here we didn't add to this this form so what does that mean whatever's here is gonna go now later on we'll show you how to do so though you know the user can select the domain sure without using the picker does that spend a my experience one of the things that come up well we don't want them to use the picker or whatever and of course here are the company read-only great Wayne you know yeah me I forgot something forgot to take this thing out less so sorry about that folks let me go ahead and swap that out let's get rid of the company on the form it's obviously mandatory so let's go to incident dot do I'm gonna get rid of that thing and in fact maybe I'll do that now i'll throw domain on there now instead of company just go form layout and let's get rid of was collared up something little things all right so what I want to do here at domain sure so the old domain on there all right let's try come on I want you to go right there there we go all right okay all right now look we just created something called an override so I'll show you a little bit about overrides later on but basically because we're on top like when you start out domain separation and everything is gonna be in global so whenever you made our adjustment to in a form to a form somewhere lower I'm just gonna create what we call an override later on and you're gonna probably create lots of overrides by accident and you're gonna pull your hair out trying to find these things but Jason's gonna show you how to how to clear these override serious let's go ahead and reverse innate just go back to Emily all right we'll see she's an MCT here and now let's go back to our new record for incident it still wants oh I see why because see now here's a great example so we're on top MCT chances are that there might be something going on on this form here in this domain let's see if I change the customers it was different probably is not why because these two are children so you can see how time-consuming this is now maybe maybe I did this on purpose right just to show you you like a little bit about overrides let's go back to our incident new record and now let's go down to the top MCT let's see huh huh yeah look at that see how that changed the form all right I'm gonna get that sucker out of there nice it's got a form layout and this will be a lot of your day if you're working in domain separation is trying to figure out okay so like where where did the form change and all that stuff all right so now let's put our domain in there and now let's see okay it says we got top MCT now it's impersonate I don't like this one one more time so I apologize for the length of this video however I think that we've seen a lot of good behavior here or adverse behavior that we'll need to overcome in future videos so here we go top MCT now if I change this to customers let's see what happens refresh your screen it's going to put in MCT customers if we put in Kingfisher that's gonna be Kingfisher now can they change this certainly they want to change this no problem now let's see what's in the picker here for them okay so here's change this Kingfisher now let's see if I go up to MCT what happens let's see what's available there you can reload let's see what's available see all three or because this is the parent right here so see how that works all right and now we'll see what happens with visibility domains because what I'm gonna do is I'm gonna take Emily out of this one and I'm going to put her in Kingfisher and then give her visibility to customers so we'll note that will not that in a second so first we're gonna create one called customers well she goes behind the customers domain and then I'm just gonna type in here customers [Music] I will see you so then we're gonna go to a new record again we'll make one and MCT let's yeah CT domain hit submit [Music] alright so let's go to a new record and now what do we got left horse the Kingfisher account you could forget about that there he goes Kingfisher [Music] alright KF domain and when I hit submit now if Emily goes to incident that list or the incident application whatever you want to call it alright so here we got our numbers what we want to see here - seven - seven alright so what do you want to do here we want to put in so we see these three here right so we're gonna go to put in a domain and again out of the box you're not gonna have the domain tag here so you have to add it for every table which is a pain in the butt so now we're going to see how these that are global I care about these gonna filter them out and that looks like some of these if some of these have been created - so it's kind of cool so at this point she has access to all this stuff so now what are we gonna do we're gonna say look we just want Emily working the Kingfisher account but she needs to have access the customer is also so that way she can go back and forth but we don't want her having access to stuff that's happening there and MCT so here you see that look it took over and said I want to be an MC too I want to be on top though so make sure you're careful with that too one thing that if you're working in a million tabs like I am I'll tell you what happens is this you'll be in a record like this and then you're gonna change your domain or maybe your domain like I said I want to keep myself in top but let's say my domain was like MCT because that's what you know management that you got to be an MC T but it'll flip back over a certain amount of time to MC t then what I'll do is I'll create a business rule or something like that and it automatically I've created what's called an override and I have to go back clear that thing out and then I got to start over again which can be a real pain and a lot of people would say well you know you shouldn't be hitting like control you know click or whatever it is you're doing to come into this type of screen well I say to those same people look if you're in a forum like this right here and you hit configure form layout is there any way to see your domain picker no you can't see anything you can't see anything but you can't see the updates to picker from this screen you can't see the domain picker so this could be a mistake waiting to happen right here because the domain resets so if you come up with solution to put in the update set picker and the domain picker and all these screens that would be very helpful so but here you know in that type of screen it's almost impossible so now we're gonna go down Lee's profile and let's see your here's our group I'm CT so we'll see here her companies I'm CT what we want to do is we're gonna want to put Emily we're gonna pull her out of em CT [Music] and let's see if we have let's see we do have a company called Kingfisher great and I'm gonna put a user I want to put her in here alright so I'm gonna go to our profile do it this way then they don't want to let's reload this dossier she's in two groups it at it alright so now what do we want to do I'll put on Kingfisher right [Music] is about showing hair out cdk it doesn't see oh there's probably not a group created so good let's create a group the Kingfisher that continued all right so I'm gonna make a Kingfisher and you know what I want to make Emily the manager cuz she just got a promotion anyway great and then the company Fisher I'm gonna hit save alright now I'm gonna throw her into this group does not see her prior she's the manager let's see let's see if I clear this out curious about this now I'd say we just wanna find her it's not finding her that you're staying so here we have our company let's let's take a look here that's that that's probably what I'll do on her record just make her company so they make our MCT see if I can make it came Fisher there we go okay excellent so we set it up that way and let's see if we can find kingfish journalist here now there we go all right as you can see here domain separation caused you a lot of heartburn and trying to get this stuff working all right so now she'll see stuff and kingfisher let's see what our managed domain is those kingfisher okay so it set it up so let's go ahead and reverse innate her and we'll go directly to incidence and let's see what's in her so see here however domain picker changed so now let's go to our incidence and now what do we see anything sin global right because global everything is out there alright and then we have Kingfisher so let's filter out all the global stuff [Music] Kingfisher's anyone that we see that's it's not empty right so now what we're going to do is we're going to say you know what she needs to see what's going on in customers so let's see how we can do this let's go - that's our company they don't really care about that that's another company from CT here's our group okay so now we could do this for the group probably easier to do it for the group then it would be for an a you know user by user basis right that's usually the way these things work let's go to our visibility domains here let's see if we can get customers up here port just wants to show us Kingfisher so let's see if I can pop in that global sea everything if not then I'll have to save this for another video sometimes and that's what will happen it'll just show you that 1:1 selection for whatever reason so that way you can't get your visibility domain is going here alright so now I'm gonna pop this back down to top alright so let's see your oh one thing it did also for MCT when I took looks like it deleted for Emily you know this the group and then you know all this that so get accustomed to these business rules running and it's going to tell you what's happening and sometimes people just flick write their own but try to understand what's happening in each one of these things here so let's see if we can get a little bit oh yeah all right so we toggled our scope let's try to reload our form now let's edit our visibility domains well I do it No won't won't listen Kingfisher for whatever reason so so she's already been granted that's her company so it wants to do maybe we can toggle it again see if that'll affect our list here I'm gonna do it there we go okay so at this point we want to put her in customers get away Cisco all right so now we have earn customers and what a tog line the domain scope means it means that you expand your don't your domain so that way you can do different things like this right so just remember that you have that in your menu right there toggle of domain scope so now let's go see what I'm only gonna see [Music] all right so Kingfisher and customers voila there we go so there we have two sibling domains you can see this one as you can see this one as you can't see anything in here so it's kind of a pain to set up but we got it going good point so now let's go to incidence and voila we have one from customers here we can even take out one from Louisville so that way she won't see anything that's going on at MC T so we have that data segregation there just like we wanted okay so I think that's a good overview for right now enough to get your start of a domain separation like I said they'll probably a couple of videos coming forward and I don't know next couple of weeks that you have to look forward to and I'll probably and I guarantee it'll be shorter than hit this one but there is a lot to absorb here and like I said you know how many years you've been in service now when you go a domain separation kind of irrelevant because there's a lot of stuff here that's going on that you're not used to dealing with when you're a single in a single tenant instance so as I like to say you know this is where you develop from a child onto a real adult start swimming in the adult side of the pool so my name is Jason Miller founder of Aspen now solutions that we just unlocked the power of service now [Music]