Group Admin Role
Overview
The group_admin role lets you delegate limited administrative access to a specific user without promoting them to full tenant admin. A group admin can only see, enroll, and report on learners inside the groups they are explicitly assigned to.
This is useful for team leads, department managers, or regional coordinators who need to manage their own people without accessing the rest of the organization.
Permission Matrix
| Capability | Learner | group_admin | Manager | Admin |
|---|---|---|---|---|
| View course catalog | Yes | Yes | Yes | Yes |
| View and launch SCORM | Yes | Yes | Yes | Yes |
| View enrollments | Own only | Assigned groups | All | All |
| Enroll / unenroll users | No | Assigned groups | All | All |
| View completion reports | No | Assigned groups | All | All |
| Export reports | No | Assigned groups | All | All |
| View user profiles | No | Assigned groups | All | All |
| Invite / create users | No | No | Yes | Yes |
| Edit user profiles | No | No | Yes | Yes |
| Change roles | No | No | No | Yes |
| Assign group_admin | No | No | No | Yes |
| Tenant settings | No | No | Read-only | Full |
Step-by-Step: Assign a Group Admin
- Navigate to Admin → Users.
- Click the user you want to promote.
- On the user detail page, scroll to the Group Admin Assignments section.
- Click the Select a group to add… dropdown and choose a group.
- Click Add group.
- Repeat for each group this user should administer.
The assignment takes effect immediately. The user’s session picks up the new scope on their next login or token refresh.
Note: This section is only visible if your account has the
user:assign_rolepermission (tenant admin only).
Step-by-Step: Remove a Group Admin Assignment
- Navigate to Admin → Users and open the group admin’s profile.
- In the Group Admin Assignments section, find the group badge you want to remove.
- Click the × button on the badge.
- The assignment is removed immediately.
If you remove all group assignments from a group_admin user, their role still shows as group_admin but they will see empty data everywhere. To fully demote them, also change their role back to learner or another role via Change Role.
Configuration Reference
| Field | Description | Required |
|---|---|---|
| User | The user receiving group_admin access | Yes |
| Group | The group they will administer | Yes |
| Assigned by | Set automatically to the acting admin | Auto |
| Assigned at | Timestamp of assignment | Auto |
Multiple groups can be assigned to a single user. Each assignment is independent.
What the Group Admin Sees
When a group_admin logs in, they see:
- Users list — filtered to members of their assigned groups only
- Reports → Compliance Matrix — requires selecting one of their assigned groups; org-wide view is not available
- Reports → Summary — headline KPIs scoped to their groups
- Enrollments — can enroll and unenroll learners in their groups only
They cannot see other users, other groups, or any tenant settings.
Troubleshooting
| Symptom | Cause | Resolution |
|---|---|---|
| Group admin sees empty user list | No groups assigned | Assign at least one group via the user detail page |
| Group admin compliance matrix is empty | No groupId passed | Group admins must select a specific group; the org-wide view is not available |
| ”Access restricted to your assigned groups” error | Group admin attempted to access an unassigned group directly via API | Expected behavior — assign the group or use a higher-privilege account |
| Group admin can’t see users even after assignment | User session not refreshed | Ask the user to log out and back in to refresh their token |
| Assignment panel not visible | Session user lacks user:assign_role | Only tenant admins can manage group_admin assignments |
SOC 2 Notes
All group_admin assignments and removals are written to the audit_log table with:
action: "group_admin.assigned"or"group_admin.unassigned"resourceType: "group_admin_assignment"- Before/after state, actor identity, IP address, and user agent
This satisfies SOC 2 CC6.3 (role changes logged with before/after state).