[ARCHIVED] Allowing Teachers to add Students/Student-Based Roles

[adriana_arce]

We recently disabled the permission to “add/remove student users” within a course for those that hold a Teacher role within Canvas. Although we have our Canvas enrollments sync with our SIS, some faculty would still take it upon themselves to add/invite students into their course which caused a few enrollment discrepancies, leading us to quickly decide to disable that permission. However, disabling this permission caused any student-based role to also not be available to our faculty. At our college we have an array of roles that were based on the student role for specific purposes that only that role would accomplish. For example, our faculty are given a local username/password to invite themselves as a “student” because Canvas’ “Student View” does not allow access to LTI/external tool integrations within a course. Additionally, we have faculty evaluators that need to see/access a course as enrolled students do, per our faculty contract.

So, I hope I haven’t lost you! I wanted to make sure you all had context to why I am reaching out. Here are my questions:

• Do you allow “Teachers” to add/remove student users? Why/why not?
• How are evaluators/reviewers added to online courses?
• Do you allow for local users within your system (someone not connected to your SIS)?
• How do faculty access/test out integrations as students without using a student-based role within Canvas?

[dtod]

We do not for the same reason as you, at least not in courses which are derived from our student information system. For "sandbox" courses, we do. They are in different sub-accounts.

Evaluators and reviewers can be added as Observers (not attached to a user) or in some other role. We have some non-student custom course roles which teachers can add.

We allow for non-SIS users through a formal request process, and I try to add them using a third-party login like Google or Microsoft. I actually have an Office 365 form that triggers a Power Automate flow to create them through the API which gives them an SIS ID that includes both the identity of the person who requested it, and an expiration date. I then have a separate process that looks at those guest accounts and disables them when the expiration date is reached (by changing their login id).

For example:

auser@somecollege.edu is created as a Google login with an SIS ID of
ourperson@ourcollege.edu-guest-TD12756681-2020-08-01

When it's time to expire them, they become

auser@somecollege.edu-disabled
ourperson@ourcollege.edu-guest-TD12756681-2020-08-01-disabled

Ideally that functionality would reside in our identity system, but it doesn't yet.

Testing integrations is a whole other thing. Often the test user can test them and an admin can test them using Act As..., but there are others which are untestable without a correlating account on the other side and good security protocols make it really hard to test, e.g. Google. We do not hear that complaint from our faculty.

[gcollins1]

We also 

• do not allow “Teachers” to add/remove student users because we sync with our SIS.
• allow for local users within your system (someone not connected to your SIS); I find this especially helpful (as an admin) to test things with my off-campus account instead of masquerading as a user.

• The Teacher role may add evaluators/reviewers.
• Faculty access/test out integrations as students without using a student-based role within Canvas, using sandbox shells in Canvas.