Create account support role

Community Explorer


Has anyone attempted to create a role that closely resembles an Account Admin but lacks the permissions to modify the global configurations for the Canvas instance? The background for this is that we want to restrict who can make configuration changes for the entire instance, while still allowing support staff to assist with various administrative tasks within the system.

What I’m trying to create is a role that can use “Log in as” and manage users, access courses, and add institutional administrators to sub-accounts and so on, but without the permission to make configuration changes for the entire instance (such as the settings found on the “Settings” page at the top/root level).

I’ve nearly succeeded in creating a functional role, but I’ve hit a roadblock with the setting called “Account-level settings – manage” on the Permissions page. This is the setting I want to deselect for the new role. The desired effect would be that a person with the support role can no longer see the “Settings” page at the root level. Unfortunately, it seems that the unintended side effect is that the role also loses the ability to view settings for all sub-accounts. The support role needs permissions so that users with this role can add other administrative users to sub-accounts.

This is where I realize that Instructure doesn’t differentiate between a users roles and permissions at the sub-account level and root level. One potential workaround might involve adding the support role to all sub-accounts, but that could lead to administrative complications. The ideal scenario would be for the new support role to be located at the root level, but with restrictions limited to making changes to settings only within sub-accounts, not at the root account level.

Does anyone have any tips on how I can proceed with this idea or other suggestions on how to solve this issue?