Act as User (Masquerade) for Sub-Account Admins

[DanBurgess]

We have a need for our sub-account admins to be able to masquerade as users. Our sub-account admins are typically school/college level support staff that cannot be given account-wide access.  The staff are currently dependent upon account-level admins for debugging issues with students and instructors. 

The masquerade function for sub-account admins would need to created in such a way that the sub-account admin could only masquerade within courses that are listed within the sub-account.

[bpfingst]

We'd also really like to see the option for limiting Act As to subaccounts!  That would solve a lot of permissions management issues for us.

-Brett

Brett Pfingston, MLS
Ivy Tech Community College
Director, Educational Technology
Adjunct Faculty, School of Information Technology

[jdammeier2]

Our institution has a single instance of Canvas with multiple campuses and sites. It would be incredibly helpful to be able to assign this permission to securely provide appropriate support for our students and faculty. It would also be helpful to have the ability to read emails hidden from the ACT AS permissions unless coupled with an elevated root-level admin role. Acting as an instructor or student is a critical tool in providing tier 1 support, but support staff at that level do not necessarily need the ability to read communications between users.

[hgould]

I agree with option for Sub-Account "ACT AS" feature. This would solve so many management permissions issues.  

Holly M. Gould
Ivy Tech Community College of Indiana
Director, Educational Technology Support and Operations
Adjunct Faculty, School of Business

[doug_greenholt]

This is a feature that needs to be allowed for sub-accounts.  From a security standpoint, we must allow someone the ability to see ALL students, when they only have an education right to see students in their sub-account.  This must get fixed.

[SHEBENE]

There seem to be a couple of misconceptions within this thread. Some have tied this to viewing students at a sub-account level. You can already have someone (counselor, etc) see all students in their sub-account without seeing everyone in the instance. They can see grades etc. by having an account role if you set the permissions to view all students and they are only added to that sub-account, the "all" refers to all in the sub-account and below.

Additionally, I don't believe this changed but any account role can be given "act as" but it can only be done at the top / instance level. It's not limited to the "Account Admin" role.

One comment was about teachers being able to use a demo student account to test things. If you have a demo student account, they can just log in as that account. Otherwise with masquerade you are actually logged in as a specific real student and the actions you take are recorded as theirs (though on the backend you can tell it was through masquerade it could be confusing and misleading). 

Just by allowing "act as" permission to be given to a role that's given at the sub-account level will ensure that the masquerade function only applies to users within that sub-account (meaning any user ever enrolled in any course role in that sub-account's courses). 

This is still a needed thing, (even though I have some trepidation about using it), I just wanted to point out that there is already a solution for a few of the comments in this thread. Keep in mind that this is a powerful feature and that being able to "act as" means all users, teachers, admin, and students and that won't change because users are users in Canvas. So the idea of giving a lot of people this ability at even a sub-account level is dangerous and should be done sparingly if it's added to sub-accounts in the future.

[ShaneWhitford]

Same here. We have a need for our sub-account admins to do this without access to the overall organization.

[KristinL]

Thank you for sharing this idea with the Instructure Community!

The Product Team reviewed all feature proposals recently, and unfortunately, this thread was identified as one that they would not be able to include in their current or future plans. While we appreciate your proposal, we also want to be transparent about the likelihood of something like this making it to production.

Thank you for collaborating, and we hope that you submit another idea in the future!