[sims] SIMS User Permissions - what department sets these

[MattyDB]

Who sets the user permissions at your schools

Currently, when new staff join, the HR Manager for the Trust does this initially when creating the new user, but then any changes after this are expected to be completed by the IT Support team here.

We've been asked by one of the Heads of School if we can check the user permissions for every member of staff to make sure only a selection of users have the necessary permissions to edit and make changes, from a security perspective.

 

What department does this where you are? Are you lucky enough to have a SIMS Manager?

[howartp]

I'm lucky to work closely with the SIMS Manager.

 

Two years ago we agreed to abandon the current permission groups that were assigned in SIMS, including the defaults, and create our own 2021_Admissions, 2021_Exams, 2021_AccessArrangements, 2021.....etc

 

We warned staff that they would be stripped back to basics and only given access to what we (SIMS and IT) understood to be their roles; any requests for extra had to come via their Line Manager. This was all approved by SLT.

 

There was some shouting but overall it's worked very well. Even SLT only have read permissions to areas they should read but not edit.

[jcooke16]

We moved to Arbor a couple of years ago but before that I did try to tackle permissions in SIMS, and have since done the equivalent in Arbor. It fell to me as we no longer had a MIS manager as such, but I was reasonably well-placed to gauge what access everyone needed (I do timetabling and some areas of IT but was a teaching HOD before I supposedly retired!)

 

In my experience it seems that out-of-the-box permission groups can rarely meet the needs of individual settings, and I agree it's best to strip back to the minimum and to add on extras as required. Sometimes for us this has resulted in customised settings for groups with particular roles, and sometimes it needs a more bespoke approach for individuals with specific responsibilities.

 

Who should do it? Depends so much on the particular establishment set-up, but I think for operational purposes it could equally well be overseen by (and this isn't an exhaustive list) IT support, or a MIS manager, or an HR manager, or a timetabler in conjunction with an office manager, as long as there is a clear enough framework. Then ideally should have a line manager/ approver for anything non-standard?

Edited March 11, 2024 by jcooke16

[MattyDB]

Okay, thanks for the replies.

I think we definitely need to strip the permissions back to the basics and then only give elevated ones to certain members of staff as agreed with the Head of school.

 

I was really hoping that their would be more of a unanimous consensus that IT Support should not being doing this and that it was for another department to do instead

[RyanK]

Working for an LA SSU we often get requests to create new accounts and set permissions for users from our schools, but we do shy away from this as our support is just that, to support you using the product, not to do things for schools and make changes in SIMS where we have no understanding of the school internal structure for staff.

 

As a rule of thumb, I generally point staff in the direction of their School Business Manager/HR for setting SIMS permissions on users profiles and we will advise them on what permissions will allow access to what, or help them create unique permission groups if required. I seldom find IT have this responsibility in the schools we support as IT should not require System Manager access, that opens a big can of worms in my opinion on what data would be at their fingertips.

 

If a school is insistent on us setting users permissions we ask as a rule of thumb for written confirmation from the SBM or HT on what access that user should have and will give the new user account details only to the SBM/HT once it has been set up, so they can log in and test the permissions are accurate for the users needs before resetting the password/amending permissions and allowing the user access.

[PotNoodleTech]

Adding the staff member etc as part of their onboarding = business manager

 

Going into system manager and setting permissions based on role = me.

 

Don't have an issue with that.

[bobsmith]

I've kinda forgotten what we had in SIMS - but isn't there a basic teacher access level?

 

In bromcom the default teacher account works perfectly for 90% of the staff - heads of year then get a couple of extra permissions groups because they managed the behaviour system. SLT don't need more permissions than the teachers as they don't do data entry.

Exceptions are the timetabler who needs that extra access.

 

Support staff are given the extra permissions relevant to their role - attendance/HR etc.

 

Only changes to the default permissions groups was a more locked down staff access group for support staff that need to check basic staff details - contracts etc were restricted to HR staff.

 

I can remember that SIMS was a lot more fiddly as the out of the box permissions weren't quite what we wanted.

 

As for assigning permissions - I've trained the HR staff to issue the basic level (which everyone gets) and then I (Data manager) add any extras on top - If I'm off they tend to copy the permissions from someone with the same role - I then give it a double check when I'm available.