Managing administrators

Eduvem has a layered permission system: a role applies either to the whole institution or to one specific class, and a broader role automatically includes everything the narrower roles can do within its scope.

Institution-level roles

Role	What it does
Institution Admin	Full control: settings, content, classes, participants and reports
Global Class Administrator	Enrolls participants and answers messages in every class of the institution, with no access to the other settings
Global Class Observer	Views enrollments and generates certificates for every class, without changing enrollments or settings
Content Publisher	Changes the settings and material of content, without the other administrative powers

Class-level roles

Role	What it does
Course Class Admin	Manages that class: settings, enrollments, scores and chat
Course Class Observer	Follows that class in read-only mode
Tutor	Supports the participants of the class, without changing settings or enrollments

Divisions: administration by area

For large institutions, divisions offer a middle ground: a division administrator manages only the classes assigned to their division, without seeing the rest of the institution. A person does not hold a division role and a whole-institution role at the same time - it is one or the other.

Rules that apply to every role

• The person must belong to your institution and must not be deleted to receive a role - even a disabled participant can receive an administrative role.
• The platform rejects duplicate assignments of the same role, with the message “This person already has this role.”
• The institution administrator role can only be granted to a person who is able to sign in on their own: someone with a password or a valid single sign-on login. Single sign-on counts when the institution has SAML or Keycloak sign-in turned on (for social login, only once the account is linked); an account created through external distribution never counts. Otherwise the institution’s Administrators screen shows the error: “This person has not created a password or signed in with single sign-on yet, so they cannot be made an institution administrator. Ask them to sign in and create a password first.” To waive this requirement, an institution administrator can turn on Allow institution administrators without a password under Institution > Access and login (off by default); while it is on, whoever controls the person’s e-mail can claim the administrator account, so only turn it on if you trust the registered addresses. It also applies to administrators granted through the Integration API by a token with the Staff login permission. The other roles (publisher, observer, tutor, class and division administrator) can be granted right after registration, before the person creates a password. Roles already granted do not change.
• Every role assignment and removal is recorded in the institution’s audit history.

Always grant the smallest role that solves the need - and review the list of administrators periodically.