Inactive users can still access the course if they kept a bookmark to it

[Gabitao]

Surprisingly enough, I have just tested the "inactive user" status and I have seen that:

1) Though the course in which the user is inactive will not appear in the user's Dashboard, the user will be able to access the course through a direct URL (for example if the user kept a bookmark to the course).

2) MOREOVER AND MORE SURPRISING, the user will see the modules/pages added after the user was set to inactive.

This is NOT the expected behavior and it is not what the official documentation says:

https://community.canvaslms.com/t5/Canvas-Resource-Documents/Canvas-Enrollment-Status-Comparison-PDF....

 See how this document says (in a big table) that inactive users cannot "View and Access Course/Groups Content".

And notice how the document explicitly mentions that "inactive" is suitable for users that have not paid tuitions. It is contradictory that then they can access the contents added after the user was set to inactive.

Am I missing something or this feature is so terribly implemented?

[nwilson7 · Accepted solution]

@Gabitao I am curious how you tested this as I did not yield the same results?  When I read your post, I thought you may have found an oversight and having a bookmark of the course would work as a work around. 

I have a test student that I can actually login as and not just emulate, I find this helps truly test so Canvas does not pick up any of my admin permissions for anything and gives me a 100% accurate experience to a student.  I set that student to inactive for a course and then logged in as them.  The course was gone from the dashboard, as we expected, but using a bookmark to the course or pasting in the link to the course returned the Access Denied lock.  I also tried some deeper links into the course such as specific assignments and files and all of those returned the same Access Denied message.  I am not able to replicate them getting any access to the course.  I did re-activate the user and was immediately able to access the content again.  So, it looks like things are operating as expected.

-Nick

[nwilson7 · Accepted solution]

@Gabitao I am curious how you tested this as I did not yield the same results?  When I read your post, I thought you may have found an oversight and having a bookmark of the course would work as a work around. 

I have a test student that I can actually login as and not just emulate, I find this helps truly test so Canvas does not pick up any of my admin permissions for anything and gives me a 100% accurate experience to a student.  I set that student to inactive for a course and then logged in as them.  The course was gone from the dashboard, as we expected, but using a bookmark to the course or pasting in the link to the course returned the Access Denied lock.  I also tried some deeper links into the course such as specific assignments and files and all of those returned the same Access Denied message.  I am not able to replicate them getting any access to the course.  I did re-activate the user and was immediately able to access the content again.  So, it looks like things are operating as expected.

-Nick

[Gabitao · Accepted solution]

Hello Nick,

Thanks a million for your quick reply. Thanks to your message I have given this a second thought, and I have discovered that the visibility of the course I was using to test the feature was set to "Public". Therefore, the inactive user was able to see the same as a non-logged user, which makes sense.