Designate users with temporary class access

Supported editions for this feature: Education Plus. Compare your edition

As an administrator, you can give designated users, such as school administrators or support staff, temporary access to visit classes in Classroom without being added as a permanent teacher or student to the class.

Temporary access to classes is useful to support educators, view student profiles, post announcements, and more.

Set up temporary access

Create an admin role with the Manage classes privilege and assign it to designated users or security groups. Also, you can restrict access to classes by organizational unit.

Step 1: Create a custom admin role

  1. In the Google Admin console, go to Menu and then Account and then Admin roles.

    You must be signed in as a super administrator for this task.

  2. Click Create new role.
  3. Enter a name and, optionally, a description for the role and click Continue.
  4. For Admin Privileges, in the Privilege Name list, scroll to Classroom and check the Manage Classes box.
  5. Click Continue.

  6. Click Create role.

    Note: You can add other privileges to this role. For example, if you have the same users assigned the View analytics data for users and their classes privilege, you can add both privileges to one custom admin role.

Continue to Step 2 to assign the custom admin role to users or security groups.

Step 2: (Optional) Require multi-party approval

You must be signed in as a super administrator for this task.

You can require more than one admin to review and approve changes to your organization's role assignments by turning on Multi-party approval for role management. For more information, go to Multi-party approval for sensitive actions.

  1. In the Google Admin console, go to Menu and then Security and then Authentication and then Multi-party approval settings.

    You must be signed in as a super administrator for this task.

  2. Click the Multi-party approval settings section.
  3. Check the Require multi-party approval for sensitive actions box.
  4. Click Save.
  5. To require more than one admin to review and approve changes to role assignments in the Admin console:
    1. Click Multi-party approval for role management (Admin console).
    2. Check the Role assignment and update role privilege in Admin console UI box.
    3. Click Save.
  6. (Optional) To require more than one admin to review and approve changes to role assignments using an API:
    1. Click Multi-party approval for role management (API).
    2. Check the Role assignment and update role privilege in API box.
    3. Click Save.

Step 3: Assign the custom role to a user or security group

  1. In the Google Admin console, go to Menu and then Account and then Admin roles.

    You must be signed in as a super administrator for this task.

  2. Click the custom admin role you created and then Admins and then Assign members.
  3. Enter the first few letters of the email address of the user or the security group, and select the address from the list.

  4. (Optional) To limit access to an organizational unit, click Edit , select an organizational unit, and click Done.

    (Optional) To grant access to more than one organizational unit, follow the steps in Assign or unassign the role for multiple organizational units on this page.

  5. Click Assign role.

  6. If Multi-party approval for role management (Admin Console) is on, you get a message that another admin must approve your update. To send your request to another admin, enter a message (optional) and click Send request. Your request expires after 3 days. For details, go to Multi-party approval for sensitive actions.

Note: When you restrict access to an organizational unit, the user or group can access only classes whose primary teacher is in that organizational unit.

After you assign the custom admin role to a user or a security group, they can visit a class as an education leader or staff.

Assign or unassign the role for multiple organizational units

Repeat Step 2 above and select a different organizational unit each time to grant a user or security group access to more than one organizational unit.

In the Admins list, the user or security group name appears separately for each organizational unit they can access.

Or, you can follow these steps:

To complete these steps, you need the appropriate User management privilege. Without the correct privilege, you won't see all the controls needed to complete these steps.

  1. In the Google Admin console, go to Menu and then Directory and then Users.

    Requires having the appropriate User management privilege. Without the correct privilege, you won't see all the controls needed to complete these steps.

  2. To open the user's account page, click the user's name. Or, at the top, in the search box, enter the user's name and open their account page. For more options, go to Find a user account.

  3. Scroll down and click Admin roles and privileges.

  4. At the custom admin role you created, for Scope of role, click Edit .

  5. Do one of the following:

    • To select an organizational unit, check the box for the organizational unit.
    • To unselect an organizational unit, uncheck the organizational unit box.

  6. Click Done.

  7. Click Save.

  8. If Multi-party approval for role management (Admin Console) is on, you get a message that another admin must approve your update. To send your request to another admin, enter a message (optional) and click Send request. Your request expires after 3 days. For details, go to Multi-party approval for sensitive actions.

Manage the custom admin role using APIs

Instead of assigning the custom admin role to users and security groups manually in the Admin Console, you can designate temporary class access using APIs. To do so, review the developer guide on automating the process: Developer Guide - Provide Temporary Access.

If Multi-party approval for role management (API) is on, the API request will fail. The failure message includes details about multi-party approval and indicates that another super admin must approve the update. Your request expires after 3 days. For details, go to Multi-party approval for sensitive actions. For details, go to Multi-party approval for sensitive actions.

Manage sensitive information

You can control access to sensitive information and resources using security groups. You can create a new security group or update an existing group by adding the security setting. For details, go to Control access to sensitive data with security groups.

Remove temporary class access permissions

To complete these steps, you need the appropriate User management privilege. Without the correct privilege, you won't see all the controls needed to complete these steps.

  1. In the Google Admin console, go to Menu and then Directory and then Users.

    Requires having the appropriate User management privilege. Without the correct privilege, you won't see all the controls needed to complete these steps.

  2. Click the user's name and then Admin roles and privileges.
  3. At the custom admin role you created, for Assigned state, click Assigned .
  4. Click Save.
  5. If Multi-party approval for role management (Admin Console) is on, you get a message that another admin must approve your update. To send your request to another admin, enter a message (optional) and click Send request. Your request expires after 3 days. For details, go to Multi-party approval for sensitive actions.

Note: If the role was assigned to a security group, removing users from the security group also removes their access permissions.