User Access Roles

User Access Roles provide PowerSchool administrators with the ability to create roles specifically for their system's use. User Access Roles control user access to PowerSchool or external applications, such as PowerSchool Independent Software Vendor (ISV) systems. When a role is created, you can assign a PowerSchool security group to that role. This role can then be used to override the default security group for a user within a specific school context.

There are two types of User Access Roles: Roles with a PowerSchool security group associated to them, and roles without a security group. Typically, roles created without a PowerSchool security group associated to them are the roles used to uniquely identify a user to an external application. Roles without a PowerSchool security group associated to them can be simply labels, or they can have field-level security or document attachment access restrictions. If they are simply labels, they provide flexibility in identifying the user to an external system, but they do not affect the users access within PowerSchool. Roles with a PowerSchool security group associated to them directly control the access the user has within PowerSchool.

It is important to understand that the security group is the backbone of a role that is used for PowerSchool access. A role that has a PowerSchool security group can be used to override a user's default security group for any school affiliation. Users can have multiple role/group combinations for each of their schools, but can only have one default security group. If a user has no roles with a PowerSchool security group, PowerSchool recognizes the user's default security group.

For more information on assigning roles, refer to Staff Security Settings.

Pre-Seeded User Access Roles

PowerSchool includes several pre-seeded or pre-defined user access roles. None of these pre-seeded roles have a PowerSchool security group associated with them, and all of them were created to assist with single sign-on (SSO) integration between PowerSchool and other systems.

As of PowerSchool 10.0.1, the following pre-seeded User Access Roles have been added: Assessment Teacher, SPED Teacher, and LMS teacher. By default, any user with an existing sign-in to the PowerSchool SIS Teacher portal will have these roles assigned to them. These roles were created to support SSO integrations between PowerSchool Group's portfolio of products. Should your district or school have more than one PowerSchool product, you can enable SSO between the PowerSchool SIS and other PowerSchool products. With SSO enabled, the SSO links within the PowerSchool SIS Teacher portal will display for any user who has the corresponding user access role for that product.

Should you want to remove a user's access to the PowerSchool product SSO links in the PowerSchool SIS Teacher portal, you can remove the corresponding user access from that user. Without the corresponding user access role, the SSO link for that product is hidden from the user.

To add or remove user access roles from a selected group of users, refer to the Mass Assign User Access Roles to Selected Group of Users section.

Create a User Access Role

Navigate to the User Roles page.
Click User Access.
Click New.
Enter the name and description of the role.
Select Enabled to make the role active. When inactive, the role can still be assigned to a user, however, PowerSchool will treat the role as if it does not exist.
Select Indicates if this role represents a Counselor if this role serves as a counselor in some capacity. Users assigned roles that have been flagged with this option will be listed as counselors and can have students assigned to them.
Select PowerTeacher Pro Read-Only Admin Access to allow read-only access for PowerTeacher Pro.
Select Manage Locked Reporting Terms to allow this user role to change the PowerTeacher Pro Lock Reporting Term settings, or manually unlock individual sections.
Select User can set up and run system-level scheduled exports (bypasses all user-level security) to allow users assigned to this role to set up and run system-level scheduled exports.
Select the group you want to assign to the role. This security group will override the user default security group when this role is associated with a school on the user account. For more information, refer to Role Assignments. Once a security group is assigned to a PowerSchool role, a different security group may be assigned to the PowerSchool role, but not removed altogether (blank).
Edit Document Attachment Categories to control user access to document categories. For more information about creating categories, see Document Attachment Categories.

If all permissions on a given category are removed from a role, including Use Default, users assigned that role will have no access to documents with that category (even when other roles assigned to the user would have otherwise granted them access).
Select the group capabilities you want to enable for this role. These capabilities are often created by and for a specific plugin or PowerSchool feature.
Click Submit.

Edit a User Access Role

Navigate to the User Roles page.
Click User Access.
Click the name of the role you want to edit.
Edit information as needed.
Click Submit.

Enable PowerSchool Learning User Access

Enable access to PowerSchool Learning for teachers. The PowerSchool Learning plugin must be enabled to provide access to the application. For more information, refer to PowerSchool Learning.

Navigate to the User Roles page.
Click User Access.
Click the name of the role you want to edit.
Select the PowerSchool Learning Access checkbox.
Click Submit.

Delete a User Access Role

Navigate to the User Roles page.
Click User Access.
Click the name of the role you want to delete.
Click Delete.
Click Confirm Delete.

Define Export/Edit Settings

Using the Export/Edit tab on the Edit User Access Roles page, you can define which data sources a user can export and/or edit. These access levels only apply to exporting, previewing, and editing with data export functions. For step-by-step information, refer to Export/Edit User Access Role.

Define Enterprise Reporting Settings for User Access Roles

Using the Enterprise Reporting tab on the Edit User Access Roles page, you can define which categories of Enterprise Reports published within PowerSchool a user can access. In addition, users assigned to this role may be granted permission to Manage Enterprise Reports, which allows them to view, add, edit, and remove new or existing Enterprise Reports from within PowerSchool. These access levels only apply to Enterprise Reporting.

Configure the User Access Matrix View

Navigate to the User Roles page.
Click User Access.
Click Configure Table.

Use the following table to enter information in the fields:

Field

Description

Description

The description entered for the role appears.

Short Name

For each permission, enter the text you want to display on the column heading on the User Access Roles page.

Show in Matrix

For each permission, do one of the following:

Select the checkbox to display the permission on the User Access Roles page.
Deselect the checkbox to hide the permission.

Click Submit.

Sort User Access Roles

Use the following procedure to arrange the roles into the order in which you want the roles to appear on the User Access Roles page.

This procedure may only be performed at the district level.

Navigate to the User Roles page.
Click User Access.
Drag and drop the role you want to move. The changes are automatically saved.
If a role is added, it appears as the last item in the sort order. If a role is deleted, the sort order is automatically updated and re-sequenced as needed.

Search for Staff by User Access Roles

Using the Search Staff function, you can search for staff members that are assigned to a particular role.

In the Search Staff field on the Start Page, enter the role of a staff member whose record you want to review using the format Role.useraccess= [Role Name].
Leading and trailing spaces are removed from the value for which you are searching, embedded spaces are not, and considered part of the term to match.
Click the Search icon.
Click the name of the individual whose record you want to review.
To work with the entire group of staff members, click Functions at the bottom of the list to display the Group Staff Functions page. For more information about the group staff functions, refer to Work with Staff Groups.

Alternatively, you can view all users associated with a specific User Access Role on the User Access Role page. Select the information icon for the User Access Role you want to review.

Assign User Access Roles to Individual Users

Roles can be assigned to an individual teacher or staff member on the Admin Access and Roles tab of the Staff Security Settings page. Teachers and staff members can have multiple school affiliations. Each school affiliation can have a different role assignment. Note that all roles assignments are configured on the Admin Access and Roles tab, whether the user is a teacher or administrative staff.

Mass Assign User Access Roles to Selected Group of Users

Using the Mass Edit User Access Roles page, you can assign or remove roles to multiple teachers or staff members. Be sure to review the security settings for the roles you want to mass assign to ensure you are providing the correct security settings for each staff member.

The following is key information about this process:

User Access Roles with and without an associated PowerSchool security group may be assigned to a user at any given time. Typically, user access roles with a PowerSchool security group associated with them are assigned to control the user's access within PowerSchool. User access roles without a PowerSchool security group associated with them are used to identify the user to an external application, such as a PowerSchool Independent Software Vendor (ISV) system.
When a user has a default access group assigned at a school, that default will be overwritten by the mass-assigned user access roles. A user with existing user access roles will not have those roles overwritten during the mass assignment. Additional roles that are mass assigned to the user will be added to their existing list of roles. When accessed at the district level, user access roles with a PowerSchool security group associated with them are only assigned to users at the schools they already have access to within PowerSchool.
When accessed at the district level, user access roles without a PowerSchool security group associated with them are assigned to users at all the schools that have been selected, regardless of whether or not the user has access to that school within PowerSchool. This gives the external system the option to permit users more flexibly, and not be constrained by the user's PowerSchool access.

Mass Assign User Access Roles at the School Level

Navigate to the Mass Edit User Access Roles page.
Do one of the following:
- Click the Roles With Security Groups tab to assign roles that control the users' PowerSchool access.
- Click the Roles Without Security Groups tab to assign roles typically used to identify the users in external applications that are integrated with PowerSchool.

Use the following table to enter information in the fields:

Field

Description

Mass assign User Access Roles with () selected teachers

The selected staff members appear as the current selection.

Possible Roles

Indicate which roles you want to assign.

To assign a role:

Select the role you want to assign.
Click the single arrow pointing right.

To assign all roles, click the double arrows pointing right.

Selected Roles

The roles selected from the Available User Access Roles list appear.

To remove a role from this list:

Select the role you want to remove.
Click the single arrow pointing left.

To remove all roles from this list, click the double arrows pointing left.

Click Assign.

Mass Remove User Access Roles at the School Level

Navigate to the Mass Edit User Access Roles page.
Do one of the following:
- Click the Roles With Security Groups tab to remove roles that control the users' PowerSchool access.
- Click the Roles Without Security Groups tab to remove roles typically used to identify the users in external applications that are integrated with PowerSchool.
Select the role you want to remove from the Selected Roles box.
Click Remove.
Click Confirm Delete.

Mass Assign User Access Roles at the District Level

Navigate to the Mass Edit User Access Roles page.

Use the following table to enter information in the Add User Access Roles fields:

Field

Description

Step 1: Schools

Select the checkbox next to each school you want to assign roles to for the selected staff members.
If your external applications do not need to distinguish a user's roles within each school, you can select External Systems as the school. This is not an official school, but simply a way to group all external application roles under one heading.
Click Next.

Step 2: Roles

Select one of the following options:
- Use Roles With Security Groups to assign roles that control the users' PowerSchool access.
- Use Roles Without Security Groups to assign roles typically used to identify the users in external applications that are integrated with PowerSchool.

If roles with a PowerSchool security group associated to them are selected, they will only be assigned to users at schools where the selected users already have PowerSchool admin access. If the users currently have Default Group access to a school it will be replaced by the role assignments made here.

Select the checkbox next to each role you want to assign to this group of staff members.
The security group associated to the role appears in parenthesis.
Click OK.

Once all roles have been assigned, the Add button appears shaded.

Click Assign.

Mass Remove User Access Roles at the District Level

Navigate to the Mass Edit User Access Roles page.

Use the following table to enter information in the Add User Access Roles fields:

Field

Description

Step 1: Schools

Select the checkbox next to each school you want to remove roles from for the selected staff members.
To unassign the user account with roles used for external systems, select External Systems, and select any roles that apply. Roles assigned to External Systems do not grant access to any PowerSchool school or district regardless of the PowerSchool Security Group.
Click Next.

Step 2: Roles

Select one of the following options:
- Use Roles With Security Groups to remove roles that control the users' PowerSchool access.
- Use Roles Without Security Groups to remove roles typically used to identify the users in external applications that are integrated with PowerSchool.

If roles with a PowerSchool security group associated to them are selected, they will be removed from users at the selected schools if they exist, but, if the last role with a security group is removed from a user for a given school, the user will revert to Default Group access at that school. This is done to prevent admin users from losing their admin access.

Select the checkbox next to each role you want to remove for this group of staff members.
The security group associated to the role appears in parenthesis.
Click OK.

Click Remove.
Click Confirm Remove.