nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Disabling Account Role Permissions in Production is a Major Security Concern

RickBargerhuff

My team and I have been tracking how permissions are revoked over the course of 3-4 days. We started in the Beta Environment and today we moved to Production hoping that the process was quicker then non-production environments.

I regret to inform you that revoking a permission IS NOT quicker in Production contrary to what the Canvas documentation says. In fact, the documentation points out that revoking permissions is instant and this is incorrect:

Updated May 4th, 2026: https://community.instructure.com/en/kb/articles/661570-how-do-i-set-permissions-for-an-account-level-role

Updated June 1st, 2026: https://community.instructure.com/en/kb/articles/387078-unknown

THIS IS A SECURITY CONCERN

Currently, I have managed to time the revoking of all permissions for an Account Role and it took ~40 minutes to reflect the changes.

This is absurd. Trying to restrict a role to ONLY the permissions the role requires is an arduous, painstakingly difficult process in Canvas.

Someone from Canvas please help me understand what is happening with the revoking of permissions.

Having to wait an indeterminate amount of time could lead to security breaches.

Find more posts tagged with

Developers

Accepted answers

Chris

Hi @RickBargerhuff,

In addition to what @Robert said, I believe if you change a user's timezone after you do the permissions change, that will reset their server side cache and make the permission change happen immediately. That trick has worked for me on multiple occasions when I've needed to test various combinations of permission settings.

-Chris

All comments

Robert

Hi @RickBargerhuff,

The permissions are cached (server side) and take awhile to be fully reflected for logged in users. You could terminate the current users sessions if you are worried about them retaining access to something you need to revoke. The other option, based on your statement, would be to test your roles and permissions in either the test or beta instance, with accounts people are not currently accessing. This would help you establish the required permissions for the roles without the risk. Since beta resets weekly, it is important to document your changes, or once you approve of a specific permission to add it to your production environment.

https://community.instructure.com/en/kb/articles/664371-how-do-i-terminate-user-sessions-as-an-admin

https://community.instructure.com/en/kb/articles/661148-how-do-i-access-the-canvas-beta-environment-as-an-instructor

Chris

Hi @RickBargerhuff,

-Chris

RickBargerhuff

@Chris the time zone switch worked! This was brilliant!! Thank you very much!!!

Unanswered Questions

New Quizzes Matching Choice options
Yesterday, after much trial and error…I concluded the new quizzes matching choice options do not work as I expected, and have used with other LMS. I thought that I could provide students a matching choice quiz with multiple attempts that would report incorrectly answered matches on the first attempt, and display the…
Does the iCal feed link change periodically?
I have seen documentation that says you must recopy your iCal link and resubscribe when you are enrolled in new classes, does this mean my iCal feed link changes each time, or do i just need to re-fetch the .ics file?
Course Pacing and allowing students to choose the order in which they address two topics, or which of several equivalent assignments to complete? Is it possible?
We use course pacing to manage due dates, because we run ~20 something courses each quarter and manually setting due dates would be a nightmare. Several courses have two core topics. We want to allow students to choose which of these they will pursue first. Is there any way to configure multiple course paces with different…
How does "Participation: Course" + manually input start/end dates play with Course Pacing?
Hoping someone can explain for me. We're using pacing to avoid manually dating regular assignments each quarter, but the dates I see are based on when the course was instantiated, while students see dates based on when they were added to the course by [backend software I don't know anything about, presumably]. If I set…
Duplicate user being created in Canvas / Catalog
Has anyone else had issues with an influx of duplicate users in Canvas? Ours is currently in the form of an email that already exists, becoming a new user - and not automatically merging with the user ID with the same email that also is linked to our SIS ID correctly as well. For example, user 1 is xyz@gmail.com without a…