Is it possible to lock down certian CIs to certian Assignment Groups

Is it possible to lock down certain CIs to certian Assignment Groups.


For example, navigate to Configuration Management > Resoruces > Click Search CIs, operators in assignement group 'A' can only search and view 'Computer' CIs.  Opeartors in assignment group 'B' can only search and veiw 'Network' CIs.

  • Hi,

      yes it is possible. You can use mandanten and security resritcion folders

  • Hi again,


    You can check:


    Folder entitlement

    Folder entitlement isolates company information in folders, ensuring that the right users have the right access to sensitive company data. For example, a company that manages more than one organization could create separate security folders for each organization. Users in organization A could be granted access to Folder A and users in organization B could be granted access to Folder B. The information in an organization is tied to a security folder when users open records, such as incident records. Therefore, users in organization A could not access incidents, changes, or requests made by organization B, and vice versa. When folder entitlement is enabled, a new field appears when users open records. This field allows users to select the security folder, allowing them to tie the information in the record to that security folder. Users outside the organization who have not been granted permission to access the data in the folder cannot see the record. When users outside the organization search incidents, changes, or requests, the records are not found.

    In Service Manager, a System Administrator enables or disables folder entitlement. For more information on enabling and disabling folder entitlement, see the related topics.

    The available out-of-box company security folders on the Folder Entitlement tab are DEFAULT and advantage. However, the System Administrator can add folders to meet your business needs.

    For each security folder added, a System Administrator must grant permissions to a specific application security profile, thereby granting permissions to all operators associated with that profile. Permission settings are selected for operators based on roles that reflect their responsibilities. When defining roles, each role displays a top level view for all folders. You can then click on each folder and set rights on individual fields for a folder, or modify workgroups. If a user does not have specific rights defined for a folder, the default rights from the user profile are assigned.

    The System Administrator can set the default folder for an individual operator. This setting allows the records opened by the operator to be automatically associated with the default security folder selected

    Mandanten file security

    Mandanten is an optional file security feature that filters the data that operators can see when they query specific files. Rather than having access to all the records in a file, operators who are members of a security group see only the records that meet the specific filtering criteria of their group. The system administrator defines the filtering conditions when creating a security group. The system administrator decides which operators belong to particular security groups and can assign operators to any number of security groups. Operators who are members of multiple security groups see only the records that match all their separate filtering conditions.

    At login, HP Service Manager reads the operator record to determine the security groups of which the operator is a member and uses this information to determine the files to which the operator has limited access. When an operator queries a restricted file, Service Manager reads the security group records to determine the filtering conditions to apply to the query. Service Manager then returns only those records that match the filtering conditions in the security group records.

    Unlike Format Control, which provides security at the application layer, Mandanten secures files at the database layer. Any file that a system administrator restricts from an operator with Mandanten always uses the filtering conditions regardless of the operator’s user role and application profile. Only operators who are not members of any security group can have unrestricted access to files protected by Mandanten.

    Typically, a system administrator enables Mandanten file security in a multi-company environment where each company wants to ensure that only their users see the data relevant to their business. However, system administrators can also use Mandanten to conceal department records selectively within an organization. For example, a system administrator could create two filtering conditions for an operations and finance department that allow the operations personnel to see their own Incident tickets and devices but not those belonging to the finance department.

    Setting filtering conditions

    To enable Mandanten file security, a system administrator must create records in two files:

    scsecuritygroup — The system administrator uses this file to define the security group name and the field values to be used as the filtering condition.
    scmandant — The system administrator uses this file to define the Service Manager file to be protected and the field to be read for the filtering condition. The field defined in this file is referred to as the Mandant field. You can only define one Mandant field for each file you want to protect, although the Mandant field can contain an array of values. The Mandant field you chose must be defined either in the file you want to protect or by a virtual join in another file.
    System administrators can define additional filtering conditions on fields other than the Mandant field. These additional filtering conditions are referred to as restricting queries because they further restrict the data that an operator can access. To define a restricting query, a system administrator must create a record in the scaccess file.


    You cannot enable Mandanten file protection on the following shared system files:



    You can find more information also in SM help server

  • Is it possilbe to provide examples on how to setup the Mandanten Security Groups?

  • There are multiple existing threads that provide an explanation of Mandanten. Please search the forums (I'm writing this from my phone, so searching and copying for you isn't happening).
  • There are multiple existing threads that provide an explanation of Mandanten. Please search the forums (I'm writing this from my phone, so searching and copying for you isn't happening).
  • There are multiple existing threads that provide an explanation of Mandanten. Please search the forums (I'm writing this from my phone, so searching and copying for you isn't happening).