[ARCHIVED] Do You Allow Non-Employee Instructors and Course Designers?

[jacob_standish]

I'm faced with a significant number of requests from our staff to create accounts for professionals that are not affiliated with our school district. For a variety of reasons they would like these individuals to have access to Canvas with instructor or course designer roles.  There are some valid concerns regarding security and confidentiality that make us on the admin side nervous about this, however we don't want to just say no if we can build some management and policies around it.  I am in the process of building a workflow where I create their accounts after they agree to an acceptable use policy and then schedule to remove them after a defined expiration date (up to two years).  

Some questions:

• Do you have an official policy regarding non-employee user requests? 
• Can you share any documentation with the community? 

[jbuchholz]

Jacob,

This is a great question. At my university, we are working on this very same thing. There are a lot of issues that creating external accounts raises and we want to make sure that we address all of them when we are creating policy and/or procedures.  Also, we found that there needs to be a workflow associated with the creation of these accounts so that the right people check off on the necessary steps (i.e. HR, User policy, Network policy, etc).

As of now, all contractors are using a stand-alone instance of Canvas that the administrating faculty designs and updates, or they are communicating within Canvas and the courses are utilizing a Blueprint methodology so that all the content remains static.

I use Google Sheets to create a workflow that I can then track and keep the accounts on my radar. I am also working on a reminder system that will prompt me to revisit certain accounts for either deletion or continued activation and use.

I will share what we create and use once it is fully baked.

Jesse

[jacob_standish]

That's great Jesse!  

I've written some Google Apps Script to create the users after they agree to terms and to create a sis file for me when I need to delete them.  Maybe we can collaborate on this. 

[jbuchholz]

Jacob,

I love the idea of an Apps Script. That is terrific. Let's definitely collab on this.

Jesse

[tdelillo]

Our process for these requests are as follows:

• The non-employee fills out an Access Request form that is routed to our Instructional Technology team (who creates the account).
• The non-employee also fills out a "Computer Security Agreement" that confirms their acceptance of our rules for use of technology.
• Both documents are archived with our IT Security team, in case any questions or issue arise.

Some version of this process has been in place for several years (we've had Canvas for 6 years already). The one aspect of this we're still struggling with is appropriate rules for deletion. Since there are so many various reasons for these requests, it's tough to come up with standards like "unused accounts will be deleted after 6 months" or the like.

I can't really share our documents, however, if you happen to Google "alamo colleges computer security agreement" you might stumble upon an outdated version of the form that may or may not be useful.