Canvas Access Report Discrepancy

[EduMentor_92]

I am currently on leave from work, but my supervisor has emailed me, stating that they see I am active in Canvas. However, I haven’t accessed Canvas since last weekend. After receiving the first email earlier this week, I closed all Canvas browser tabs and deleted the app from my phone. Despite this, I received another email this morning with the same concern.

My supervisor stated they are checking the "People" tab for login times and using the "access report" under my name to track activity. To investigate, I briefly logged in and reviewed the access report myself. I noticed multiple activity entries, including logins, that I did not perform since going on leave.

Does anyone know how Canvas logs activity for instructors in shared courses and how accurate this data is?

I co-teach a course with multiple instructors, but I am the primary creator of many pages and assignments in our course. Could Canvas be attributing activity from other instructors to me because I originally created the content?

Or, should I be concerned about a breech in my Canvas account security?

I have reached out to IT at my institution, but their response has been delayed, and I was hoping to get a quicker answer. Thank you for your time.

[Gabriel33 · Accepted solution]

I hope you already have changed your password. If not, you should do so immediately.

Your IT support should be able to tell the IP address that accessed Canvas, and compare with your other confirmed logins.

[James]

@EduMentor_92 

In addition to the advice @Gabriel33 gave about changing your password, I want to address the question of what a login really means.

Canvas is tracking your logins and not those of other people who are accessing content you've created.

I do see a lot of activity related to app usage that is not the person actually doing anything in the course. For example, I had a student accessing a course that had been over for two years. He wasn't actually going into the course, but the mobile app was loading all of his courses and it was registering that he was viewing the course. That was a couple of years ago and I hope Canvas has made improvements in tracking, but sometimes it is difficult to know what was done through the App and what was done through the browser.

I also mention that because I've written a bunch of code that uses the API to perform tasks as me. They run every 20 minutes or so, so I'm seeing activity on my account, but they don't count as logins.

When administrators masquerade as another user, that doesn't show up as a new login.

Logins themselves are unreliable because they can last for a long time. We have a test user that last logged in in February 2023, but the account was showing activity yesterday.

So, if you're seeing logins that aren't you -- definitely log out of all existing sessions, change your password.

Another thing that wasn't mentioned is that you should go into your Account > Settings and look at Approved Integrations. These integrations are essentially an account and password combined so any of those can act as you. If you want to make sure that you invalidate your app logins, find the Canvas for [operating system] (example Canvas for iOS) or Canvas Teacher for [operating system] and remove those. They also have a last-used date, so you can see if someone is still using your mobile app login, even after you've deleted the app from your phone.

It is possible that you have a Canvas login as well as your regular login. For example, we use Office 365 for our primary authentication, but some of us have separate logins that allow us to log into Canvas when there are problems with Office 365. It's possible that account is what is being used and they don't know your primary password. Not saying that's the case, but you want to be aware of it in case it is.