Overview

Account Switching allows Organization Staff members to log in with their individual credentials but “act on behalf of” their parent Organization.

Specifically, this allows those staff members to work on Learning Plans (Applications) that are owned by the Organization itself, such as applications for credentials awarded to facilities or companies rather than individual people.

LearningBuilder’s audit logs track “who is logged in” separately from “which account is active” so that actions taken on those Organization-level Learning Plans are attributed to the specific staff member that took them.

Permissions and business rules

The Account Switching feature lets a Staff user switch between multiple available accounts.

The list of “available accounts” is controlled by the StaffCanActOnBehalfOfOrg permission, which can be granted to both Organization Roles and Staff Roles.

A user can “account switch” into Organizations where:

The user is a Staff of the Organization
The Staff Role linking the user to that Organization has the StaffCanActOnBehalfOfOrg permission
The Organization itself has at least one granted Role that also has StaffCanActOnBehalfOfOrg

Diagram showing how the StaffCanActOnBehalfOfOrgs permission must be assigned

What can a staff member do on behalf of an Organization?

Generally speaking, a staff member that has “Account Switched” into an Organization (the Organization account is “active”) can do anything the Organization would be able to do if logged in directly.

Some limited exceptions include:

Staff members cannot access any pages in the /Admin area, even if the Org account has access

Configuring the “Account Switching” feature

1

Grant the “StaffCanActOnBehalfOfOrg“ permission to the Organization(s) that will allow it

Organizations can only be selected through the Account Switch feature if they hold at least one granted Member Role that has the StaffCanActOnBehalfOfOrg permission.

If you have different types of Organization accounts, and Account Switching only makes sense for one of them, you can use this permission to restrict Account Switching for the Organizations where it should not be supported.

2

Grant the “StaffCanActOnBehalfOfOrg“ permission to the desired Staff Role(s)

Staff members can only switch into the Organizations for which they are a Staff, and the Staff Role linking them together has the same StaffCanActOnBehalfOfOrg permission.

3

(optional) Add the Staff member(s) as Alternate Emails for the Organization account

If you intend for Staff members to act on their parent Organization’s Learning Plans then you may want to list the Staff member’s email addresses as Alternate Emails for the Organization. This will cause them to receive copies of notifications sent to the Organization.

User experience

The “Account Chooser” login prompt

When a user logs in and has access to multiple accounts, but has not indicated a default account, they are prompted to choose an account to activate.

This serves to familiarize users with the feature and train them how to activate it.

The profile picture associated with each account is displayed, if one exists.

The “Account Switch” menu

Users that have access to only a single account (their personal one) will not notice any changes to the user interface. For those users, clicking the “My Account” link will take them to their profile page.

Users that have access to multiple accounts, however, will see a “My Accounts” (plural) link instead. Clicking it will display the Account Switch menu.

Setting a default account

In many cases, we expect that users with access to multiple accounts will have a “primary” one that should be used most of the time.

Those users can indicate a default account to bypass the “Account Chooser” login prompt. They will retain the ability to account switch once they have logged on, they just aren’t immediately prompted to do it.

Access denied account switch prompt

When a user tries to access a page that the Active Account cannot access, but at least one of the other available accounts might be able to access, then the user sees a modified version of the Access Denied page.

This modified version prompts the user to activate one of the accounts that might have access.

This is useful when a Staff member is logged in and their personal account is active, and they then receive a copy of an email notification pertaining to their Organization’s Learning Plan.

If they follow that link they will be prompted to switch to the Organization account, rather than getting a confusing Access Denied page.

LearningBuilder only considers the area access Permissions, not feature-specific permissions, when deciding to show this prompt. It is possible that a user could be prompted to switch accounts even if none of their available accounts can actually access the requested page.

This is not considered a common use case and is unlikely to happen through normal configuration and use of the Account Switching feature.