Hello, @ACU_Derek
Thanks for posting in the community.
I have had to look into manually enrolled users inside accounts, and manually enrolled users in courses before, and when that happens, we usually look at the users api, or the enrollments API inside the course. This will show if the user was added with SIS Import or not.
https://canvas.instructure.com/doc/api/users.html#method.users.api_show
https://canvas.instructure.com/api/v1/users/user_id
or at the course level:
https://canvas.instructure.com/doc/api/enrollments.html#method.enrollments_api.index
https://canvas.instructure.com/api/v1/courses/course_id/enrollments
you should see a "sis_import_id": specifying if they were added via sis import.
If you are seeing
"sis_import_id": null,
This would mean that user was manually added as they were not created with sis import.
As far as telling who added a user to a course we do not have the ability of seeing this in Canvas unfortunately. In this case you would need to reach out to Canvas Support with specifics as to the "created_at" time of the user in the course, as well as any users we suspect might have added them. With a specific time range and a specific user, Canvas Support can check logs for user access and hope to find a user if they have been added within the last thirty days.
Hope this helps!
This discussion post is outdated and has been archived. Please use the Community question forums and official documentation for the most current and accurate information.