New Analytics and Admin permissions on subaccounts

[tlc_OU]

Hello everyone!

I have a puzzling situation. It was brought to my attention that individuals with the Analytics-View permission on their admin role on a subaccount are able to view the student information in New Analytics for courses on subaccounts in which they do not have admin permissions. 

I was able to at least partially confirm this issue for the user that brought this to our attention. She has admin permissions on the subaccount of a subaccount (e.g. MATH subaccount that resides under the College of Arts and Sciences subaccount), yet she is able to view student analytics for ALL students in a course that she is enrolled in (e.g. enrolled in an engineering course in a completely different subaccount, yet she can view other students' course analytics). While impersonating her I was also able to view student analytics information for courses on other subaccounts that she was enrolled in as. a student but did not have admin permissions for.

Has anyone else experienced this issue? Or would someone be willing to see if they can replicate the issue? If it is true that anyone with the Analytics-View permission can view student analytics across subaccounts (even those they don't have admin permissions for), then I think that is troubling.

[dan_wright]

@tlc_OU We experienced the exact same issue. We had an admin from one sub-account taking classes as a student from another sub-account and they were able to see all of the analytics as though they were an admin within the account. This is the response that we received:

When one account shares account level and course level permissions we run into the issue of cross permissions allowing access the way you are seeing it. This is out lined in our guide linked below which states: 

Admins who are given student roles in a course may still be able to view admin features. To avoid
permission conflicts, admins should create a separate account

 This is why the student/admin is seeing access in New Analytics.

https://s3.amazonaws.com/tr-learncanvas/docs/Canvas_Permissions_Account.pdf

The user will need separate accounts to access new analytics as a student.

We ended up just disabling the feature because of the FERPA concerns. I was looking back into it since it is supposed to have recently added attendance reporting. Do you know if this issue has been resolved?