[ARCHIVED] Act as User in a Sub-Account?

[lora_penola]

Hello! We need our Heads of Schools to have ACT AS USER access. However, we can only give them access to sub-accounts since we do not want them to have full access to our Board Room course. We created sub-accounts and placed them as admin in those. Is there a way to either limit viewing of a course from somebody with full admin access to the root account (seems unlikely), or is there somehow a potential for allowing them to act as user in the sub-accounts?

Thank you!

[rmurchshafer · Accepted solution]

Hi Lora,

I think I have an answer for you.  You've already added them to the sub-account with the permissions they need; perfect.  Now in the Root Account, create a new Account Role (possibly named "act as user") and only give the permission "Users - Act As".  Last thing, add them to the Root account as admin, but in that new role you created for Act as a user.  

I've added a link to the Canvas Guides section that deals with roles and permissions in case you need more guidance on how to create new roles and assign permissions to them.  https://community.canvaslms.com/docs/DOC-10895#jive_content_id_Roles_and_Permissions

Rick

[lora_penola]

Wow! Thank you Rick, that was really helpful. I found a workaround using the same idea but thought I had to create another user for these people, so thank you! My solution was cumbersome.

The reason we wanted Act as User for a sub account was because we had to move a confidential course out of any subaccounts. These users cannot view the course, but they CAN act as users in this course. Is there a way to block anyone acting as any users in certain courses?

Thank you!

[rmurchshafer]

I can't think of any way to block people from Acting as Users in certain courses.  Allowing someone access to the Act as a User permission really does give them a lot of rights; if they act as someone they essentially are that person with regards to being able to see and do anything that person can.  

With the scenario discussed above, I think the Admins you are working with should only be able to Act as Users who are enrolled in courses within the sub-account they have the larger admin access to.  When they go to that Sub-account and click on People, they will only see people enrolled in courses in that sub-account and thus can act as them.  But if they go to the root account and click on People I don't know that they will see anyone (or maybe they see people but again only people who are enrolled in that other subaccount.

So - I suppose for the case you are talking about with a single course, if you move the course to a different subaccount AND no one in that course is enrolled in any other courses within the subaccount where those people have admin access, it should prevent those admins from having a way to get into that course.

There are a lot of "ifs" in that scenario above 🙂

Rick

[dan_rothwell]

We had this method set up but it appears Canvas has made some changes to the permission structure and it no longer works for our sub-account folks to act as.  Is anyone else experiencing this issue? 

[nwilson7]

@dan_rothwell  There are other threads about this issue as well.  Canvas just fixed this issue: https://community.canvaslms.com/t5/Known-Issues/Admins-are-able-to-act-as-non-admin-users-with-more-...so if your sub-account admin does not have a permission level that any of the users you are trying act as has, then that is the cause.  I tested this last night and it seems to still be working for me but maybe I am just getting lucky since many others are not having any luck.

-Nick

[lbethany]

So I have done somewhat the scenario described above, I have created a role "Act as user" that only has that permission.   Then I have given our online dean some other admin permissions in a subaccount. (she isn't over our "main" campus courses  so that's why it is divieded).  However, she does not have all admin access in that subaccount as we don't want anyone creating "for credit" courses, adding students to those courses or adding teachers and TA's because we integrate with our SIS.   

With this setup, she can "act as " students, but cannot "act as" faculty.   Any ideas?  With her admin roles she is only denied the following permissions in her subaccount:

Account-level settings - manage

Admins - add/ remove

Data services - manage

Feature Options - enable / disable

Manage LTI

Permissions - Manage

Storage Quotas - Manage

add/ remove in courses: Observers, users - students, users - TAs Users-Teachers

Users - allow administrative actions in courses

Users - Manage students in courses

Web Conferences - create

I don't see why she would any of these to "act as " an instructor.  She already has more access than instructors in these accounts have.

Thanks,

LeaAnne