What are the advantages of removing the HR Admin role from the system Admin role after the HR Implementation tasks have been completed? (Choose two.)

Separating the HR Admin [snhrcore.admin] role from the System Admin [admin] role after implementation is a critical security best practice. The primary advantage is that it ensures confidential HR data is protected and only accessible to authorized HR personnel, as the global admin role cannot access scoped HR data by default. Secondly, it establishes proper governance by ensuring that only designated HR administrators have the authority to make configuration changes to the HR application, preventing unauthorized modifications and maintaining the integrity of HR processes.

The HR Admin role should remain a part of the system Admin role: This contradicts ServiceNow's security best practices for protecting sensitive, scoped application data. It is not necessary because the system Admin always has access to all HR data: This is incorrect; the HR application is scoped, and the global admin is explicitly blocked from its data unless granted a specific HR role.

1. ServiceNow Product Documentation. (2024). Security for HR Service Delivery. Retrieved from docs.servicenow.com. This section details the scoped nature of the application and notes, "By default, the system administrator (a user with the admin role) does not have access to HR data."

2. ServiceNow Community. (2023). HRSD Implementation Guide. White Paper. The official implementation guides and best practices emphasize the principle of least privilege and recommend removing the snhrcore.admin role from the system admin post-setup to enforce the application's security boundary.