Role-based access control means you can manage each staff member's permissions to access different areas of the MAT/LA and school sites. You can see more guidance on what business roles and permissions are here: What are Business Roles and Permissions in Arbor?
Permissions
To add business roles and add/edit ad hoc permissions on a profile you need the Group: User Details: Manage All Users permission.
Adding and removing permissions
If you need to change access for a user, there are two ways to manage this. Please note, you cannot add any more business roles than the current list.
Give or remove business roles
You can select a different business role for the user from the list of roles. You can either remove the first role and replace it with a second, or add an additional role - their permissions will combine to give them all of the permissions for both roles. You can see how to do this in the Business Roles and Permissions section here: The MAT Staff Profile
Give staff additional ad hoc permissions
If you need to give a staff member a few extra permissions, you can with Ad Hoc permissions!
Go to the Roles and Permissions section of the staff member's profile, and click +Add in the Roles & permissions section.
Select Ad Hoc Permission.
Select the permission from the dropdown (type into the box to narrow down the list). Select the date range this permission should be given for, or leave the date blank to set it as ongoing, then click Assign permission(s).
You'll then be able to see the permission in the list. You can click it to remove it if needed.
Please note: You can only add ad hoc school-level permissions to a staff profile if the staff member in question has the Group: Login to MIS: Associated institutions (this needs to be active), which can be a stand-alone permission or part of a business role. If staff do not have this permission, the Permissions dropdown on the slide-over does not list any School: permissions.
Changing the permissions of a business role
If the permissions are not sufficient or too much for all users with a certain business role, you can modify the default permissions for the Business Role.
Assuming responsibility for a business role
We don't recommend assuming responsibility for permission management. This is because we sometimes need to make changes to the default permissions included in a business role. Any business roles managed by your school won't be updated. If your school or MAT/LA has responsibility for managing a Business Role, you can see the actions you'll need to take here: Are we notified of updates if we edit the permissions for a business role?
If you do decide you need to do this, follow these steps:
- Go to Group Staff > Access Control > Business Roles
- Select the business role
- Click the Permissions Management field
- On the slide-over, click the red Assume Responsibility for Permissions button
- Confirm using the reb button on the pop up
You can add or remove a permission from the business role by going to Group Permissions or School Permissions from the left-hand menu. Click on the permission, you'll see the option to add the permission if there's a cross, or remove the permission if there's a tick.
Reverting responsibility for a business role back to Arbor
If you made a mistake or you want Arbor to manage a business role's permissions again, you can revert permission management back to Arbor. This resets all permissions to Arbor's recommended settings and resumes automatic permission updates for that role.
Note: Reverting will erase any custom permissions you've set. If you later choose to manage permissions yourself again, you'll need to manually re-add those custom settings, as they aren't saved.
To revert the permission management of a business role back to Arbor:
- Go to Group Staff > Access Control > Business Roles
- Select the business role you want to revert back
- On the role's Overview, click into the Permissions management field
- On the slide-over, click the green Revert Management to Arbor button
- Confirm the changes in the pop-up
Viewing business roles and permissions assigned
Navigate to Group Staff > Access Control > Business Roles to check the Business Roles in use and see the number of users assigned each role. Please note, you cannot add any further roles than what you see here.
By clicking the Business Role, you will be taken to the Role Overview, where you can see if it's managed by your MAT/LA or by Arbor.
Who has each business role
From the left-hand menu, you can click Users to view who has been allocated this role. You can also assign new staff members this role by clicking the green button.
Permissions included in each business role
You can view the permissions associated with the particular role on a MAT/LA or School level by clicking the Group Permissions or School Permissions on the left-hand menu.
Permissions determine what level of access a user has to an area of the system. These could be set to Off (user cannot access this area of the system), View (view only) or Admin (make administrative changes e.g. manage users, make payments, amend targets) as appropriate for the role.
To view more information about the permission, click the permission and then the 'More Information' button in the slide over.
Full permissions list and who has each permission
You can see a full list of available permissions by going to Permissions from the left-hand menu or by heading to Group Staff > Access Control > Permissions.
Click the permission to view more information.
You can view the Business Roles and Users that have this Permission by using the left-hand menu.
The All Staff Ad-Hoc Permissions page
You can use the Group Staff > Access Control > All Staff Ad-Hoc Permissions page to see any MAT/LA or school staff members who have an ad-hoc permission in addition to their business role.
This page makes it easy to identify staff with duplicate or unintended permissions, and gives trusts a way to remove those ad-hoc permissions, which helps with security and administrative oversight.
To view the ad-hoc permissions page, you need the Group: User Details: Manage All Users or Group: User Details: View All Users permission.
To remove ad-hoc permissions from staff, you need the Group: User Details: Manage All Users permission.
Click on a staff member in the list to view their ad hoc permissions on a slide-over.
On this slide-over, you can:
- Revoke and ad-hoc permission using the bulk action. Just tick the box(es) next to the permission(s) you want to remove, then click Bulk Action and select Remove ad-hoc permissions
- Head to the staff member's profile using the View Staff Profile button
Comments
Article is closed for comments.