Account Admin in Sub-Account Can't Manage Student Logins

[jpastorek]

Problem: I have an Account Admin as part of one of my Sub-Accounts with full permissions, but they cannot manage student logins.

Context: We import our rosters from FACTS SIS into one main Account, but the students and teachers are split between two Sub-Accounts (and campuses). I have confirmed that the user is in the correct sub-account and has the permissions set and is listed as an Account Admin. However, they still cannot edit login information of students. I do not want this admin to be able to edit information about any other sub-accounts. For some reason it works when this user is an admin in our main account, but not when they are set as admin in the sub-account.

I would like to avoid making this person admin over the main account, as that is not a security best practice. But this has proven to be my only solution.

Could it be that even though the students are separated into their sub-accounts, they are truly managed in the main account?

[mzimmerman]

Hi @jpastorek 

As you have guessed from your last line, users really exist at the top level (main) account, not in sub-accounts.  So, to make changes to users, you need administrator permissions at the top account level, not at the sub-account level.

[Hildi_Pardo]

In Admin when you look at Account Roles, you can click on each Permission to see:  1) What it Does, and 2) Additional Considerations.   The Additional Considerations will point out of one permission is dependent on another permission.    Have you had an opportunity to look there?   But it may be necessary to be at the Top/Root level for this.