Act As for Sub Accounts

[apaglione]

Can we allow Act As to be delegated at Sub Account Levels and not just Global Account admin?

[melodyc_lam · Accepted solution]

@apaglione No, the User - Act As permission is handled at the root account level and can only be granted at the root level of your Canvas instance. 

If you do enable it, be extremely careful as it can allow users to gain access to subaccounts that they won't normally have access to. This may violate your institution's policies. Hope this helps!

[melodyc_lam · Accepted solution]

@apaglione No, the User - Act As permission is handled at the root account level and can only be granted at the root level of your Canvas instance. 

If you do enable it, be extremely careful as it can allow users to gain access to subaccounts that they won't normally have access to. This may violate your institution's policies. Hope this helps!

[chriscas · Accepted solution]

Hi @apaglione,

I just to expand on @melodyc_lam's reply a bit, as I know this is a feature that's been asked about quite a bit over the years...

On one hand, I totally understand the desire to limit root account admin access as much as possible, which this could help.

On the other hand, when thinking about hot it could/would work, things can get very complicated very quickly in the varied scenarios that happen often in Canvas.  For example, users are often enrolled in courses belonging to different subaccounts (which is why all uses really live in the root Canvas account.  if subaccount A admin acts as a user who has an enrollment in subaccount A, would they get to see the other courses the user is enrolled in for subaccount B and C as well?  From a strict access perspective, the answer would probably be "no", but to truly get the user's identical experience for support issues, the answer would have to be "yes".

It could be argued that root admins could have some option checkboxes to set and control some of the above behavior as they want to, but that would likely also complicate the codebase very quickly, which I'm sure Instructure wants to avoid.

Depending on the size of your school, the approach we use may work for you, as it's somewhat a blend of functionality and security.  We give our subaccount admins their "normal" permissions at the subaccount level.  In addition, we created a custom admin role with just a few permissions, including acting as users, and enroll our subaccount admins with that role in the root account.  This may get unwieldy for larger schools/institutions, but it does work for us and it does help make it explicitly clear to everyone the permissions we're giving to each admins and at what level those permissions come in at.

So the bottom line right now is exactly what Melody said...  At this time, this can't be done at the subaccount level.  That could change in the future though, and there are some workarounds like the one I mentioned that may help.

I hope this extra info helps make things slightly clearer for you.

-Chris

[dbrace]

Hi @chriscas,

We are a relatively small (subjectively speaking) community college. Would you be willing to share (while redacting as needed) screenshots of what you have described so that others could consider implementing something similar?

I ask because we have thought about (but not done anything) giving more Canvas user access for help purposes but are hesitant.

-Doug

[chriscas]

Hi @dbrace,

Sure!  Here's a screenshot of our permissions fro the role we enroll subaccount admins as at the root account level.  Basically, we give root permission to view courses and users, including sis, email, and notifications.  And of course we have the users - act as permission enabled as well.

When we have a new subaccount admin, we add them to the appropriate subaccount with (close to) full permissions, and then add them to the root account with this limited role to allow them to search for users/courses and act as any user in our instance.  This could be considered by some to be allowing too much access (outside their specific subaccount), but this has been the best solution for us.

Let me know if you have additional questions!

-Chris

[dbrace]

Thanks, Chris!

-Doug