Granular Permission Changes -- Impact on Existing Roles

[ken_cooper]

Hi All,

Hope everyone's week is off to a great start!  I have been meaning to post something about this for a while in the community, but I wanted to share some of the issues we've been having with Instructure rolling out more granular permissions.  I know we were one of the louder voices pushing for this, and in my experience having a larger permission set allows for far better role customization (such as in Moodle, D2L, etc.).

We're a large district, four colleges, 5-7k classes, 70-80k unique users per term, and we run Canvas from one instance with a huge number of subaccounts.  That said, we had setup the roles in such a way were the sub-admins from each college had the appropriate permissions from within  their college subaccount, and had permissions at the top level, etc. (such as the ability to act as).  What has been happening lately is that as permissions are rolled out, some of what our roles have been able to do now is not possible.  We've worked with Instructure and have multiple cases open, but often we'll get responses that we need to add permissions to the roles we aren't comfortable with.

We have 27 different course/admin roles currently, and when for instance a subaccount admin no longer has permission to manage enrollment status in their courses due to a role they have at the account level in Canvas, that seems to be a usability issue.  The solution seems often to be adding additional permissions, but again we aren't comfortable with many of those, as the users have elevated permissions only for their college and other similar subaccounts (such as Dev, Clubs&Orgs, etc.).

Mainly I am wanting to see if other higher ed users have been seeing this as well.  There are so many functions in Canvas not tied to a specific permission but are dependent upon a number of other permissions being enabled.  If you do have a large number of roles or multiple colleges with different admins at each sharing an instance I would be curious to hear how you have been managing.

I do like that Instructure is listening to feedback and creating more granular permissions, it has just been  a bumpy road for us as we've already created so many roles based on what the permissions were initially.

Thanks for your time reading this!

Ken 

[kirsten_ryall]

Hi Ken, permissions are a bit of a mine-field IMO. Especially due to those dependencies on other permissions that may or may not be required in order to complete an activity in Canvas. I think that even Instructure struggles to clearly document permissions themselves - we have those two PDFs to navigate: https://community.canvaslms.com/t5/Canvas-Resource-Documents/Canvas-Permissions-PDF-Updates/ta-p/466....

I'm in higher education and we have at least 40 course and account roles across 100's of sub-accounts. Recently-ish, we decided we needed to completely review how we manage permissions and roles. It started out with a couple of Admins working on it and we were making slow progress. We started by applying a risk rating to each permission. That in itself was a big job as we had to develop a risk matrix first, and then go through every single permission and apply the rating. That is where we got up to. 

Our next steps are to be confirmed but we suspect we'll take a look at our roles again, but this time from a risk lens. At the same time, we'll need to work out what is the minimum set of permissions required in order for a user to complete an activity in Canvas. And then check that against our current role/permission set-up. Or something along those lines. 

Long story short, it turned out to be a massive job, and we have now got more resources involved in getting this sorted. If we have any break-through moments, and someone comes up with a simple way for us to manage this, I'd be happy to share it with you. Feel free to get in touch. 

I do love the more granular permissions too by the way. Keep that coming at us Instructure!

[Nancy_Webb_CCSF]

We are concerned with permissions as well.  We have non-editing support roles, for those who are not supposed to edit content but instead tutor, review or otherwise need to see the content and students.  Unfortunately, certain permissions are built into all roles based on Teacher or TA and can't be removed. For example, a custom TA role which is not allowed to edit grades, assignments or content can edit the course navigation links, export course content, edit course dates, add a course grading scheme and change other Settings.  We cannot take these capabilities away.  True for all the roles based on Teacher or TA.  We can't base these roles on Student or Observer, so we are stuck with this. 

We were very shocked at all the roles that allow exporting of course content, which is the property of the person who created it at our school.