Sub-Account Admins and Apps Access

[benjamin_rodrig]

Hi all,

I noticed that as long as you assign a sub-account admin role to a user in a sub-account, even with all of the permissions turned off on that role, they can still access the Apps tab under Settings and add apps to their Sub-Account. 

Does that sound correct?

Suppose we wanted to tweak a sub account admin role so that it could not add/configure apps in their sub account - is there a way to set up such permissions?

I hope my question makes sense!

Thanks,

Ben

[kona]

 @benjamin_rodrig , sorry your question has been sitting here so long. Did you ever figure this out or do you still have this question? If you still have this question my recommendation is to check with Canvas Support. They would be the authority on whether or not that sub account role should still be able to access/change apps and if there is a way to turn it off.

[benjamin_rodrig]

Hi  @kona 

Thanks.  I'll contact support and post back what they say.

[benjamin_rodrig · Accepted solution]

So I contacted Support and within a few minutes (best IT related customer service ever) I received this reply...

"Hi from Canvas Support! The only way to hide that area would be with Custom CSS and hiding it that way. If you put someone as a sub-account admin in a sub-account you can limit them to only having permission to do things within the sub-account and not effect the entire account. Sub accounts are the best way to have admins but limit them to a specific part of the Account."

So my question is answered.

[cwhermsen]

While it seems to be true that hiding the App area requires CSS, you can still remove subaccount admins' ability to add LTI tools if you disable that Account permission ("LTI add and edit") and if you go to Eduappcenter.com and "blacklist" all apps except the ones you want to enable for your environment.

This way, you can prevent subaccount admins from adding new tools without having to resort to custom CSS.