Canvas provides the ability to assign instructional, technology, and support staff an administrative role in the system. For example, a departmental tech support specialist may be granted access to all courses in a department, in  order to help instructors with an issue or question. Or, a dean or chair may be granted access in order to view course statistics for a college. These  administrative roles are managed through ASTRA, the UW's central authorization management service. When you create a new authorization in ASTRA, you select:

1. a Canvas role (defined below)
2. a Campus, College, or Department level limit
3. an ASTRA role (defined below; most often this will be the User role)

The combination of these settings determines the tasks an administrator can carry out in Canvas and the level (campus, college, or department) at which the tasks can be performed.

Canvas Roles

Typically, Authorizers can manage all three Canvas roles. Users need only one of the following roles: College or Department Administrator or Course Designer: Broadest permissions. At the account level, can impersonate users; add, edit, and delete courses; view statistics and list of courses, create learning outcomes, question banks, and rubrics. At the course level, can do everything the instructor can. This is a powerful role intended for a departmental LMS administrator or instructional designer. College or Department Support/Outcomes Manager: Limited permissions. At the account level, can view course statistics, analytics, and list of courses; manage learning outcomes, rubrics, and question banks. At the course level, can manage learning outcomes; add or remove students; view the list of users, analytics pages, course content, group pages of student groups, usage reports; view and link to question banks. This is a limited role intended for technical support staff who might troubleshoot student access or instructor issues, or create shared resources at the account level, such as learning outcomes. College or Department Researcher/Observer: Most restricted permissions. At the account level, can view course statistics, list of courses, and analytics pages. At the course level, can view analytics pages, usage reports, course content, and discussions. This is a restricted role intended for an individual reviewing departmental analytics or observing a course.

Limit

In addition to the above roles, you designate the level at which a User will be able to perform administrative tasks by selecting a Limit. In ASTRA, for Canvas most people will see two Limits to select from:

• Campus | College: Can perform tasks at the college level (access to all departments)
• Campus | College | Department: Can perform tasks at the department level

ASTRA Roles

Delegators use ASTRA to manage Authorizer access. The Delegator is authorized to distribute management authority to units within their campus, school or college, and department. Most Authorizers will likely need to manage all three Canvas roles, so make sure that, when delegating, you select each role as well as the limit level (college or college | department) so the Authorizer can choose which role and limit is appropriate when authorizing Users. Authorizers use ASTRA to manage User access at the level for which the Authorizer is authorized--typically within their school or college--by selecting a limit level (college or department), in addition to the Canvas role the User needs in order to assist faculty. Users use Canvas to assist faculty with course development, troubleshoot issues, create shared learning outcomes or grading schemes, or view usage statistics.

Example Cases

To show how these settings work to determine the tasks that can be performed, the table below shows five possible combinations of Canvas Roles, Limit (types and values) and ASTRA Roles.

Settings	Actions possible
Canvas Role: Admin or Course Designer Limit: Campus Campus: UW Bothell ASTRA Role: User	This combination of settings would give an admin the broadest permissions, allowing her to impersonate users in any course in any college in any department on the Bothell campus.
Canvas Role: Observer/Researcher Limit: Campus | College | Department Campus: Seattle | A&S | ENGL ASTRA Role: User	The actions possible for an Observer/ Researcher are limited to viewing course content. Even though the other three settings remain the same, the person with this combination of settings can do much less than the Admin or Course designer role in the first example. This level of permissions would be appropriate, for example, for a researcher interested in viewing content across the English Department in the College of Arts & Sciences at UW Seattle.
Canvas Role: Support or Outcomes Manager Limit: Campus | College | Department Campus: Tacoma ASTRA Role: User	These settings would be appropriate for a support person who needs access to all the Canvas courses in the Tacoma College of Interdisciplinary Arts & Sciences (IAS) so that she can assist all Canvas instructors in IAS. Also appropriate for an administrator who is reviewing and managing learning outcomes across a college or department.
Canvas Role: Admin or Course Designer Limit: Campus | College | Department Campus: Seattle | College of Engineering | Chemical Engineering ASTRA Role: User	The person with this authorization could assist with course design and troubleshooting for instructors in the Chemical Engineering Department of the College of Engineering.
Canvas Role: Admin or Course Designer Limit: Campus | College Campus: Bothell ASTRA Role: Authorizer	The person with this authorization, most likely a Dean or Administrator, would be able to create Users with the role of Admin or Course Designer who could help instructors in any department on the Bothell campus. Typically, an Authorizer will be given all three Canvas Roles and thus will be able to authorize a User for any Canvas roles.

  To create a new authorization for Canvas in ASTRA:

1. To log in to ASTRA, go to https://ucs.admin.washington.edu/astra/.
2. Click Log in now to manage authorizations.
3. Log in with your UW NetID, password, and an enrolled two-factor authentication (2FA) device. (For information about 2FA and how to enroll, visit https://it.uw.edu/tools-services-support/access-authentication/2fa/.)
4. Near the top of the screen, click Create New Authorization.
5. In the first field, enter the name of the person you want to authorize (last name, first name), or UW NetID, or employee ID. Click Find & Verify. A list of names may appear. If your entry returns multiple matches, review the list and select the person you want to authorize.
6. Under Application, select Canvas (Canvas may be the default if it is the only application you manage).
7. Under Role, select one of the three options in the menu (these are Canvas roles, which determine what a User will be able to do in Canvas; see the Canvas role definitions above for more information):
   • College or Departmental Administrator or Course Designer (can impersonate users)
   • College or Departmental Support or Outcomes Manager (can view courses and manage learning outcomes)
   • College or Departmental Researcher/Observer (restricted to view permissions)
8. Under Action, Actions defined in Canvas should be selected by default. You don't need to do anything.
9. Under Limit, you can select either:
   • Campus | College (greater scope of permissions, can perform tasks at the college level)
   • Campus | College | Department (lesser scope of permissions, can perform tasks only at the department(s) you select)
   When you select a limit, a list of the three UW campuses appears below, followed by a college selection area. (Note: for Bothell and Tacoma, the Campus and College are synonymous. Campus and College level permissions are the same for these campuses. In other words, to see the list of departments at Bothell or Tacoma, you must choose Campus | College | Departments.) When you select Campus | College | Department, the list of three campuses is followed by the college selection area and a department selection area.
10. In the list of campuses, select the appropriate campus. You can select only one campus at a time. To see the list of departments for:

    Seattle

    UW Bothell or Tacoma

    Select Campus | College | Department. Select Seattle. The listing appears below. In the college selection area, click Find & Verify. The list of all colleges at UW Seattle appears. Select a college, such as College of Arts & Sciences. In the department selection area, click Find & Verify. The list of departments associated with the college you chose in step 3 appears.

    Select Campus | College | Department. Select a campus. The campus you selected appears below. In the college selection area, click Find & Verify. The campus you selected will appear in this area. (You must do this step in order to get the right list of departments. If you skip this step, you get the list of UW Seattle departments by default.) In the department selection area, click Find & Verify. The list of departments associated with the campus you chose appears.

     
11. Select a department. To select multiple departments for the same User, after making the first selection, click OK, add another. The first selection you made will be saved, and the settings you chose will persist so that you can continue to select additional departments from the same college. To see the list of departments, click Find & Verify again.
12. Select an ASTRA role, which in most cases will be User.
13. When you are finished creating authorizations, click OK, proceed to cart or move to the Cart/Checkout page by clicking the tab at the top of the page. You will see the list of pending authorizations you have created. Review the list, checking that the person, Canvas role, campus, and college or department, if any, are correct.
14. Options before checkout: To do any of the following, click Notification & Ownership Options. You can include a Note that will be sent to the newly authorized people (everyone in the Cart will receive the same note), which is useful if you want to include an additional recipient (receives a cc copy of the ASTRA email notification) or change the owner of the authorization. To change the owner of the authorization, under Owners, click Replace [your name] with the following person as the owner and enter the name, UW NetID, or Employee ID of the person you want to designate as the owner.
15. Click OK. This returns you to the cart.
16. To complete the authorization, click Checkout Now. You will see a Checkout Confirmation message that lists the names to whom notification email will be sent.