Create account support role

[jorgen_ivarsson]

Hi!

Has anyone attempted to create a role that closely resembles an Account Admin but lacks the permissions to modify the global configurations for the Canvas instance? The background for this is that we want to restrict who can make configuration changes for the entire instance, while still allowing support staff to assist with various administrative tasks within the system.

What I’m trying to create is a role that can use “Log in as” and manage users, access courses, and add institutional administrators to sub-accounts and so on, but without the permission to make configuration changes for the entire instance (such as the settings found on the “Settings” page at the top/root level).

I’ve nearly succeeded in creating a functional role, but I’ve hit a roadblock with the setting called “Account-level settings – manage” on the Permissions page. This is the setting I want to deselect for the new role. The desired effect would be that a person with the support role can no longer see the “Settings” page at the root level. Unfortunately, it seems that the unintended side effect is that the role also loses the ability to view settings for all sub-accounts. The support role needs permissions so that users with this role can add other administrative users to sub-accounts.

This is where I realize that Instructure doesn’t differentiate between a users roles and permissions at the sub-account level and root level. One potential workaround might involve adding the support role to all sub-accounts, but that could lead to administrative complications. The ideal scenario would be for the new support role to be located at the root level, but with restrictions limited to making changes to settings only within sub-accounts, not at the root account level.

Does anyone have any tips on how I can proceed with this idea or other suggestions on how to solve this issue?

[paul_fynn · Accepted solution]

@jorgen_ivarsson I believe that you may need to start with a clone of a role below that of Account Admin, and then enhance that to elevate the permissions you want your 'super user' to have. We do this to allow Admin staff, School managers and External Examiners (oh - and Learning Technologists) to see and (for some)  update content across courses without enrolment at course level.

It is likely that some functions are reserved to the Account Admin role.

[paul_fynn · Accepted solution]

@jorgen_ivarsson I believe that you may need to start with a clone of a role below that of Account Admin, and then enhance that to elevate the permissions you want your 'super user' to have. We do this to allow Admin staff, School managers and External Examiners (oh - and Learning Technologists) to see and (for some)  update content across courses without enrolment at course level.

It is likely that some functions are reserved to the Account Admin role.

[chriscas · Accepted solution]

I'm actually thinking that the role can have the "Account-level settings – manage" permission off for the root account, but enabled for all subaccounts.  We have a few permissions like this and this method generally works for us.  if there a ton of subaccounts, this may not be an ideal solution, but one that could be considered in addition to the original suggestion from @paul_fynn.

-Chris