Big Bug with Courses/Power User/Instructor permissions


Userlevel 4

Good afternoon everyone.   I wanted to make everyone aware of a big big bug in the system.   We found from a customer that is a power user that also is an instructor on an eCourse or ILT/Webinar that they can added, delete, modify any training material to and in the course.   Thus someone who should not have any rights to build out a course now has the power to change the course or virtually remove all of the training material in the course.  As a note, this “Feature” ie BUG is not documented anywhere. 

 

We need to raise this up to Docebo management as this is a major violation of  permissions.  We need to have people reach out to support to help drive a fix on this as this is a dangerous situation and needs to be fixed immediately.

 

Please reach out to me if you have any questions

 

  • Eric VanAuken

19 replies

Userlevel 7
Badge +7

Hi @Eric M VanAuken sadly this is the way the system is configured for those users identified as Instructors.

https://help.docebo.com/hc/en-us/articles/360020124779-Instructor-User-Guide#subtitle-2

Don't think this will be recognized as a bug by Docebo but you can certainly look for and vote on any existing ideas to change this, or create a new idea. I agree that this gives an instructor too much power.

Userlevel 6
Badge +1

We thought this was weird too and worked with Docebo on how to work around it.  The only way we could resolve it was not not make anyone a session instructor, but instead make instructors Power Users and assign them as event instructors.  That allowed them to take roll but didn’t allow them any rights to change the training material.

 

The PU profile we use for instructors:

ILT Sessions - Permissions: View

Enrollment - Permissions: View

Reports - Permissions: View

Users - Permissions: EditView (We allow instructors to change passwords for students)

 

In this configuration, instructors have to go to Reports (not the course’s reports tab) in order to see student progress.

Userlevel 4

Hi @Eric M VanAuken sadly this is the way the system is configured for those users identified as Instructors.

https://help.docebo.com/hc/en-us/articles/360020124779-Instructor-User-Guide#subtitle-2

Don't think this will be recognized as a bug by Docebo but you can certainly look for and vote on any existing ideas to change this, or create a new idea. I agree that this gives an instructor too much power.

Unfortunately this is indeed a BUG and should not be considered a feature.   I work in all the major LMS systems out there daily (Absorb, Litmos, Cornerstone, Oracle learning, Eloomi...etc) and none of them would ever do this in the system.  I consult with over 60 different companies and have been in the business for over 30 years. 

 

This is a BUG and needs to be fixed now.  It violates rules that are tied to Federal regulations on who and how can modify a registered course.   

 

Thus please forgive me but giving a flip answer that it is the way it is and vote it up to fix a major Bug is not a good or real answer.   

Userlevel 4

We thought this was weird too and worked with Docebo on how to work around it.  The only way we could resolve it was not not make anyone a session instructor, but instead make instructors Power Users and assign them as event instructors.  That allowed them to take roll but didn’t allow them any rights to change the training material.

 

The PU profile we use for instructors:

ILT Sessions - Permissions: View

Enrollment - Permissions: View

Reports - Permissions: View

Users - Permissions: EditView (We allow instructors to change passwords for students)

 

In this configuration, instructors have to go to Reports (not the course’s reports tab) in order to see student progress.

I know that this might work for ILT’s or Webinars, However when you assign an instructor to an Elearning course then the logic you have worked through with Docebo does not work.   There is a need to have an Instructor for Elearnings as they may have assignment components.  But you can not allow the instructors to have the ability to change or modify the courses.  It violates many federal regulations and could indeed keep Docebo from being a system of choice for regulated industries.

 

I am passing this along to all of my clients that use Docebo.   This is a major show stopper for regulated industries.   Almost as bad as not keeping records of every time a course has been taken and the scores...etc.   At least that fix is due to be out soon after me pushing the development team for the past 6 months.   

 

This needs to be pushed along as hard as the other major issues.

Userlevel 2

We thought this was weird too and worked with Docebo on how to work around it.  The only way we could resolve it was not not make anyone a session instructor, but instead make instructors Power Users and assign them as event instructors.  That allowed them to take roll but didn’t allow them any rights to change the training material.

 

The PU profile we use for instructors:

ILT Sessions - Permissions: View

Enrollment - Permissions: View

Reports - Permissions: View

Users - Permissions: EditView (We allow instructors to change passwords for students)

 

In this configuration, instructors have to go to Reports (not the course’s reports tab) in order to see student progress.

I know that this might work for ILT’s or Webinars, However when you assign an instructor to an Elearning course then the logic you have worked through with Docebo does not work.   There is a need to have an Instructor for Elearnings as they may have assignment components.  But you can not allow the instructors to have the ability to change or modify the courses.  It violates many federal regulations and could indeed keep Docebo from being a system of choice for regulated industries.

 

I am passing this along to all of my clients that use Docebo.   This is a major show stopper for regulated industries.   Almost as bad as not keeping records of every time a course has been taken and the scores...etc.   At least that fix is due to be out soon after me pushing the development team for the past 6 months.   

 

This needs to be pushed along as hard as the other major issues.

Hi @Eric M VanAuken , I’m Oscar, PM for power user area. Can you please provide me the permissions that the PU has? 

Userlevel 7
Badge +7

@oscar.logoteta Hi Oscar, I think the real issue being described here is what the Instructor receives as permissions without the PU role where they can add training, modify and delete training materials on a course. I tend to agree that this is an odd feature of being assigned as an instructor and have never seen this type permissions in other systems before. It hasn't been an issue for us for thus far but it is an inherent risk that should be addressed with proper instructor permissions that would give your clients the ability to add or remove this option.

Adding @Adam Ballhaussen 

Thank you.

Userlevel 4

@oscar.logoteta Hi Oscar, I think the real issue being described here is what the Instructor receives as permissions without the PU role where they can add training, modify and delete training materials on a course. I tend to agree that this is an odd feature of being assigned as an instructor and have never seen this type permissions in other systems before. It hasn't been an issue for us for thus far but it is an inherent risk that should be addressed with proper instructor permissions that would give your clients the ability to add or remove this option.

Adding @Adam Ballhaussen 

Thank you.

Well Stated. 

 

This is a big issue in regulated industries.   What Docebo really needs to do is not put together set roles with defined permissions.  Most LMS systems allow for the admins to create custom roles with specific permissions based on what they put together.   Docebo tries to do this via the Power user profiles and roles but it is not done in a standard way and consistent with what the industry does.   I am happy to help Docebo understand where it is making these major mistakes.

Userlevel 4

We thought this was weird too and worked with Docebo on how to work around it.  The only way we could resolve it was not not make anyone a session instructor, but instead make instructors Power Users and assign them as event instructors.  That allowed them to take roll but didn’t allow them any rights to change the training material.

 

The PU profile we use for instructors:

ILT Sessions - Permissions: View

Enrollment - Permissions: View

Reports - Permissions: View

Users - Permissions: EditView (We allow instructors to change passwords for students)

 

In this configuration, instructors have to go to Reports (not the course’s reports tab) in order to see student progress.

I know that this might work for ILT’s or Webinars, However when you assign an instructor to an Elearning course then the logic you have worked through with Docebo does not work.   There is a need to have an Instructor for Elearnings as they may have assignment components.  But you can not allow the instructors to have the ability to change or modify the courses.  It violates many federal regulations and could indeed keep Docebo from being a system of choice for regulated industries.

 

I am passing this along to all of my clients that use Docebo.   This is a major show stopper for regulated industries.   Almost as bad as not keeping records of every time a course has been taken and the scores...etc.   At least that fix is due to be out soon after me pushing the development team for the past 6 months.   

 

This needs to be pushed along as hard as the other major issues.

Hi @Eric M VanAuken , I’m Oscar, PM for power user area. Can you please provide me the permissions that the PU has? 

I can but better yet there are tickets in the support system from FLPPS via Ilonka Stull that we have asked this question and provided all of the information.   You can see everything there.   They are the ones that said it was because of the power user and instructor roles tied together that gave those rights.     

 

Either way those rights should never be given to an Instructor unless on a course by course basis or a person specific basis you grant them the additional rights.    

 

The rights in the system need to be reworked to meet modern design standards and use cases.   

 

My biggest complaint with Docebo is that it does not listen to the customers and does not look at all of the use cases before designing something.  You should be looking at industry experts to better understand how customers actually use the system and how other LMS companies have addressed the use cases.    I have shared this with the design team at Docebo in the past and they have appreciated this information but it needs to be done on a regular basis not on a one off when someone complains.

Userlevel 7
Badge +3

Thank you everyone for the feedback regarding Power User and Instructor permissions. @Eric M VanAuken thanks also for pointing out the conversation in support ticket #220313. That helped us better understand the information you’ve already provided related to the challenges you’re facing.

 

@Eric M VanAuken, I understand that Instructor permissions don’t function as you’d expect in Docebo Learn today. Despite that, Instructor permissions are working as Docebo’s product team intended and designed, as @lrnlab identified when he shared the Instructor User Guide. For that reason, we don’t consider the gap that you identified to be a “bug”.

 

With that said, the fact that Docebo doesn’t consider this a bug by our standard definition doesn’t lessen the importance of the issue you’ve identified. We value the feedback you’ve shared and want to understand your use case better so that we can help find a solution. To start, I’d like to align on how Instructor and Power User permissions function in Docebo Learn.

 

Let’s start with Instructors. Some of this will likely be redundant for you, but I want to make sure that others who come across this thread understand the difference. For others, you can also find more information about instructors in this knowledge article.

 

Any user in Docebo can be added as an Instructor to an E-Learning or ILT course. In ILT courses, Event Instructors do not have the ability to edit other Events or the Session their event is in, and cannot upload or manage training material assigned to the course.

 

Aside from these nuances in ILT, all Instructors in Docebo have the same following permissions for any courses to which they’re assigned as an Instructor:

  • Upload, edit, and delete training materials in their courses

  • Manage the layout and add/edit/delete course widgets for their courses

  • View enrollments of all users in their courses

  • View Course Reports in their courses

  • (for ILT courses) View Session and Event enrollments

  • (for ILT courses) Evaluate Session and Event attendance

  • (for ILT courses) Add Performance Evaluation comments during Evaluation

  • (for ILT courses) Add and delete webinar recordings to Sessions

Instructors that exist as normal Users in Docebo Learn cannot view or access the ⚙️ Admin Menu in the top right of their platform. In order to perform each of the above actions, they have to first navigate directly to the course(s) they’d like to control.

 

As @elamast pointed out, Power Users give you more flexibility and granularity to configure permissions per individual than Instructors, since they aren’t a “one size fits all” solution like Instructors are. With the Power User permissions available in Docebo Learn today, it’s possible to grant a Power User each of the Instructor permissions listed above.

 

Because of the way that we’ve designed user permissions in Docebo Learn, it’s more likely that we add new permission options for Power Users than to give Superadmins the option to select partial permissions for Instructors. 

 

With this groundwork laid, I have a few questions for you to better understand your use case:

 

  • “There is a need to have an Instructor for Elearnings as they may have assignment components – could you please expand on what you mean by this?
  • After reviewing the list of Instructor permissions above, which permissions do you believe Instructors should have? Which permissions shouldn’t they have? Are there any other permissions that Instructors should have that are missing from that list?

  • What are the major blockers for you in the way that Power User permissions function today?

  • If using Power User profiles to grant your users the appropriate permissions won’t solve your use case, how would you recommend Docebo go about solving the gaps that remain?

 

Lastly, it would really help us if you could explain which specific Federal regulations our current profile permission options block organizations in heavily regulated industries from complying to. Could you please share more information about these federal regulations and the industries in which they’re most common?

 

It violates rules that are tied to Federal regulations on who and how can modify a registered course.  

 

Thanks, and have a great weekend!

Userlevel 4

Thank you everyone for the feedback regarding Power User and Instructor permissions. @Eric M VanAuken thanks also for pointing out the conversation in support ticket #220313. That helped us better understand the information you’ve already provided related to the challenges you’re facing.

 

@Eric M VanAuken, I understand that Instructor permissions don’t function as you’d expect in Docebo Learn today. Despite that, Instructor permissions are working as Docebo’s product team intended and designed, as @lrnlab identified when he shared the Instructor User Guide. For that reason, we don’t consider the gap that you identified to be a “bug”.

 

With that said, the fact that Docebo doesn’t consider this a bug by our standard definition doesn’t lessen the importance of the issue you’ve identified. We value the feedback you’ve shared and want to understand your use case better so that we can help find a solution. To start, I’d like to align on how Instructor and Power User permissions function in Docebo Learn.

 

Let’s start with Instructors. Some of this will likely be redundant for you, but I want to make sure that others who come across this thread understand the difference. For others, you can also find more information about instructors in this knowledge article.

 

Any user in Docebo can be added as an Instructor to an E-Learning or ILT course. In ILT courses, Event Instructors do not have the ability to edit other Events or the Session their event is in, and cannot upload or manage training material assigned to the course.

 

Aside from these nuances in ILT, all Instructors in Docebo have the same following permissions for any courses to which they’re assigned as an Instructor:

  • Upload, edit, and delete training materials in their courses

  • Manage the layout and add/edit/delete course widgets for their courses

  • View enrollments of all users in their courses

  • View Course Reports in their courses

  • (for ILT courses) View Session and Event enrollments

  • (for ILT courses) Evaluate Session and Event attendance

  • (for ILT courses) Add Performance Evaluation comments during Evaluation

  • (for ILT courses) Add and delete webinar recordings to Sessions

Instructors that exist as normal Users in Docebo Learn cannot view or access the ⚙️ Admin Menu in the top right of their platform. In order to perform each of the above actions, they have to first navigate directly to the course(s) they’d like to control.

 

As @elamast pointed out, Power Users give you more flexibility and granularity to configure permissions per individual than Instructors, since they aren’t a “one size fits all” solution like Instructors are. With the Power User permissions available in Docebo Learn today, it’s possible to grant a Power User each of the Instructor permissions listed above.

 

Because of the way that we’ve designed user permissions in Docebo Learn, it’s more likely that we add new permission options for Power Users than to give Superadmins the option to select partial permissions for Instructors. 

 

With this groundwork laid, I have a few questions for you to better understand your use case:

 

  • “There is a need to have an Instructor for Elearnings as they may have assignment components – could you please expand on what you mean by this?
  • After reviewing the list of Instructor permissions above, which permissions do you believe Instructors should have? Which permissions shouldn’t they have? Are there any other permissions that Instructors should have that are missing from that list?

  • What are the major blockers for you in the way that Power User permissions function today?

  • If using Power User profiles to grant your users the appropriate permissions won’t solve your use case, how would you recommend Docebo go about solving the gaps that remain?

 

Lastly, it would really help us if you could explain which specific Federal regulations our current profile permission options block organizations in heavily regulated industries from complying to. Could you please share more information about these federal regulations and the industries in which they’re most common?

 

It violates rules that are tied to Federal regulations on who and how can modify a registered course.  

 

Thanks, and have a great weekend!

Good afternoon Adam,   Respectfully.  You can not say it is working as designed when it is what all other LMS systems would consider a bug. At a bare minimum this is a very bad design.  And regardless of how you try to spin it a bad design is still a bad design.

 

 I am sure I have more experience in more systems than you or most people in Docebo.   I can tell you that this is an unacceptable bug and needs to be addressed that way.   If the Docebo team would like to learn how to actually set up permissions and understand real use cases, then please contact me. 

In the mean time I will be informing about 15 of my clients who are regulated that they have to move off from the Docebo platform as this will violate regulations from a variety of governmental organizations. I am more than happy to point the federal regulations out to the Docebo team.  I have done so in the past and will do so again if need be.

 

Please escalate this up to your new VP/PLM   I had been talking through this issue with your previous leadership before they left Docebo to find other opportunities.

 

 

Userlevel 7
Badge +3

I can tell you that this is an unacceptable bug and needs to be addressed that way.   If the Docebo team would like to learn how to actually set up permissions and understand real use cases, then please contact me. 

 

@Eric M VanAuken we’re eager to work with you and others in the community to determine how we can improve Instructor / Power User functionality. The more details you can provide in your feedback, the better we can help you. Could you please answer each of the following questions?

  • “There is a need to have an Instructor for Elearnings as they may have assignment components” – could you please expand on what you mean by this?
  • After reviewing the list of Instructor permissions in my previous post, which permissions do you believe Instructors should have? Which permissions shouldn’t they have? Are there any other permissions that Instructors should have that are missing from that list?

  • What are the major blockers for you in the way that Power User permissions function today?

  • If using Power User profiles to grant your users the appropriate permissions won’t solve your use case, how would you recommend Docebo go about solving the gaps that remain?

 

I am more than happy to point the federal regulations out to the Docebo team.  I have done so in the past and will do so again if need be.

 

That would be great. Could you please share more information about these federal regulations and the industries in which they’re most common?

 

Please escalate this up to your new VP/PLM   I had been talking through this issue with your previous leadership before they left Docebo to find other opportunities.

 

Our VPs and PLMs have full visibility into the community. We’ll make sure they see this thread. Once you’ve answered our questions here, we can respond accordingly or even set up a call to discuss further.

 

Userlevel 4

I can tell you that this is an unacceptable bug and needs to be addressed that way.   If the Docebo team would like to learn how to actually set up permissions and understand real use cases, then please contact me. 

 

@Eric M VanAuken we’re eager to work with you and others in the community to determine how we can improve Instructor / Power User functionality. The more details you can provide in your feedback, the better we can help you. Could you please answer each of the following questions?

  • “There is a need to have an Instructor for Elearnings as they may have assignment components” – could you please expand on what you mean by this?
  • After reviewing the list of Instructor permissions in my previous post, which permissions do you believe Instructors should have? Which permissions shouldn’t they have? Are there any other permissions that Instructors should have that are missing from that list?

  • What are the major blockers for you in the way that Power User permissions function today?

  • If using Power User profiles to grant your users the appropriate permissions won’t solve your use case, how would you recommend Docebo go about solving the gaps that remain?

 

I am more than happy to point the federal regulations out to the Docebo team.  I have done so in the past and will do so again if need be.

 

That would be great. Could you please share more information about these federal regulations and the industries in which they’re most common?

 

Please escalate this up to your new VP/PLM   I had been talking through this issue with your previous leadership before they left Docebo to find other opportunities.

 

Our VPs and PLMs have full visibility into the community. We’ll make sure they see this thread. Once you’ve answered our questions here, we can respond accordingly or even set up a call to discuss further.

 

I will be happy to answer the questions when they ask them.

Userlevel 4

I can tell you that this is an unacceptable bug and needs to be addressed that way.   If the Docebo team would like to learn how to actually set up permissions and understand real use cases, then please contact me. 

 

@Eric M VanAuken we’re eager to work with you and others in the community to determine how we can improve Instructor / Power User functionality. The more details you can provide in your feedback, the better we can help you. Could you please answer each of the following questions?

  • “There is a need to have an Instructor for Elearnings as they may have assignment components” – could you please expand on what you mean by this?
  • After reviewing the list of Instructor permissions in my previous post, which permissions do you believe Instructors should have? Which permissions shouldn’t they have? Are there any other permissions that Instructors should have that are missing from that list?

  • What are the major blockers for you in the way that Power User permissions function today?

  • If using Power User profiles to grant your users the appropriate permissions won’t solve your use case, how would you recommend Docebo go about solving the gaps that remain?

 

I am more than happy to point the federal regulations out to the Docebo team.  I have done so in the past and will do so again if need be.

 

That would be great. Could you please share more information about these federal regulations and the industries in which they’re most common?

 

Please escalate this up to your new VP/PLM   I had been talking through this issue with your previous leadership before they left Docebo to find other opportunities.

 

Our VPs and PLMs have full visibility into the community. We’ll make sure they see this thread. Once you’ve answered our questions here, we can respond accordingly or even set up a call to discuss further.

 

Hi Adam, I am happy to discuss this with the product team to help correct the poor design that has been baked into the product. Docebo is non complaint for the Banking, many non profits, Medical device, Medical industries as it does not comply with the requirements laid out in CFR Part 11 Compliance as defined by the FDA's rules.

 

In particular allowing users/instructors to change training material breaks one of the key rules:

 

Technically, all electronically-stored training records fall under the purview of 21 CFR Part 11. In most cases, they must also comply with Good Manufacturing Practices, Good Clinical Practices, and Good Laboratory Practices. However, the most important training records include the following:

  • Course versions (to ensure versioning accuracy) - Need to have a link of all revisions and history of who has taken each of the revisions. Docebo does not do this.
  • Course completions (to ensure accurate tracking) - Need to have each attempt and completion tracked and recorded. Docebo does not currently do this. I have reached out to the development team and that is one item they are working on but it is still not in compliance.
  • Exam completions (to track knowledge retention) - Need to have each attempt and completion tracked and recorded. Docebo does not currently do this. I have reached out to the development team and that is one item they are working on but it is still not in compliance.

 

When it comes to learning management systems, there are several technical aspects of the rule that must be met. These include:

  • The LMS must be secure. This generally means secure usernames and passwords, which form part of an e-signature but also includes additional security tools, such as the ability to restrict access to specific information to only those with a need, the ability to remove usernames and passwords from the system, and much more.
  • The LMS must support audit trails. As discussed above, any changes made (including training record creation in the first place) must include not only the username and password of the person making the changes but also the reason for the change itself. All changes must be logged and accessible for auditing purposes, providing a clear trail showing who did what, when, and why. - Docebo misses the marks here as it does not keep all of teh history and training records. Major violation here.
  • The LMS must rely on robust e-signatures. Electronic signatures must be the equivalent of physical signatures in terms of trust and validity, but for that to happen, there must be trust that those signatures have not been falsified or obscured in any way.
  • The LMS must provide reporting capabilities. This ensures that those who need access to information have it, but also provides the ability to home in on specific data quickly, and the ability to share information (including with the FDA) when necessary.
  • Training the trainer matters, too. The FDA requires that “persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks”. This means that administrators, and even employees who will complete training in the LMS, must be trained on how to use the system effectively and to ensure continued compliance with FDA rules and regulations, as well as the organization’s own practices and policies. - This again is where Docebo violates Part 11 in giving instructors these rights. That is why other Complaint LMS systems allow each Admin to create specific roles and rights and then assign them to users.

 

 

There are more examples of where Docebo is missing the mark on this and why I am very concerned and am having to recommend many of my clients leave Docebo. I am more than happy to discuss this with the development teams and upper management if they truly want to listen.

Userlevel 5
Badge +1

I have completed an idea post, It has been accepted and marked open, Please upvote

 

 

 

Gary

Userlevel 5
Badge +2

@elamast Thanks for your suggestion. We tried implementing your solution. It seems to work for the Course Training Materials but the file repository remains open to event instructors to add content.

Maybe I missed something, but we find that event instructors can still upload but not modify or delete content from the file repository.  This continues to be a challenge for us.

I’ll see if the customer solutions team has another idea.

Userlevel 6
Badge +1

In our situation we don’t use the file repository, but I can definitely understand your need.

With some recent process changes and tightening up on version control, we may actually remove the training materials from the ILTs and only leave in the course eval and final exam. In this case our content would be housed in a SharePoint repository and presented by the instructor from that location rather than the LMS.

Hi Eric - saw this post from 10 months ago and you mentioned a fix was six months out.  What is your current view on the status of Docebo and 21 CFR Part 11?  Thank you!

Userlevel 4

Hi Eric - saw this post from 10 months ago and you mentioned a fix was six months out.  What is your current view on the status of Docebo and 21 CFR Part 11?  Thank you!

Good afternoon.   Unfortunately I do not have great insight into this as I have tried working with the Docebo leadership and have not gotten that far with many things.  I have pulled back from using Docebo with my clients and have moved them over to other more progressive and responsive platforms.    I wish i could give you a better answer but unfortunately I don’t have any.

 

Best of luck

Eric VanAuken

I am having a somewhat similar conundrum.  I have a Instructor that is also a Power User (we wanted to grant them the ability to create their own Sessions/Events for ILT, so they have the ability to view/edit the one ILT Course).  There seems to be a conflict between the two roles.  An instructor, as Adam pointed out:

  • View enrollments of all users in their courses

This is true if my Instructor/Power User manages the course from the Course itself via the “Manage” drop down.  However, since the the user has Access to the admin menu they can go to Course Management there.  But when accessing via this route, they cannot see the enrollments (the Power User profile does not have view users).  It seems the permissions are completely separated based on how the user access the management tool - as a Power User vs as an Instructor.

This is annoying for my user since if they are updating an event time/description/url they cannot simply go and check their current enrollment.  They must exit complete and access the course in a different manner.

A Eric has implied, there seems to have been little reasoning or logic applied to a scenario where a user is both an Instructor and a Power User.

Reply