idea Make ‘create group with update capabilities’ a non-admin privilege in ArcGIS Online Ideas

Make ‘create group with update capabilities’ a non-admin privilege

Caitlin_Dickinson — Fri, 08 Jan 2021 20:50:02 GMT

Currently, creating groups with update capabilities is an administrative privilege that can be assigned to a custom role. We’ve enabled our entire university community (6000+ users) to have this privilege in order to facilitate collaborative editing of StoryMaps, Web Apps, Web Maps, etc., which is a common need in class assignments and research projects (see collaboration models for ArcGIS Online). Assigning this privilege to a custom role which we automatically grant to new users relieves us of the administrative burden of creating groups for everyone that would like to collaborate on content.

There is, however, an unfortunate side effect of this being an administrative privilege. When connecting to the GIS in ArcGIS Notebooks, every user now gets a warning stating they are signed in with an administrator role, and to proceed with caution:

This is misleading and causes confusion, as our users do not have the administrator role assigned to them. Given that users without this ‘create group with update capabilities’ can be members of shared update groups, and edit content therein, I’m not sure what distinguishes this as an administrative privilege.

I’m proposing that ‘create a group with update capabilities’ be made a non-administrative privilege in order to more easily facilitate collaboration amongst users.

Re: Make ‘create group with update capabilities’ a non-admin privilege

RobertBorchert — Mon, 11 Jan 2021 12:18:31 GMT

I am confused. You wrote that you enabled 6000+ people to have administrator privilege's so they can create groups, but then you wrote the warning is misleading because they do not have administrator role.

Aren't you worried about that manty people being able to make changes to your GIS

Re: Make ‘create group with update capabilities’ a non-admin privilege

Caitlin_Dickinson — Mon, 11 Jan 2021 13:24:14 GMT

Hi @RobertBorchert,

There is a difference between a role and a privilege -- our users do not have the default administrative role assigned to them (giving them full administrative control from the entire suite of administrative privileges), simply this one privilege, which allows users to create their own Shared Update groups. Our users do not have any control over anyone else's content or the organization as a whole.

Re: Make ‘create group with update capabilities’ a non-admin privilege

RobertBorchert — Mon, 11 Jan 2021 14:23:39 GMT

They can be Creator - Publishers and create Groups

Re: Make ‘create group with update capabilities’ a non-admin privilege

JeffTimm — Mon, 11 Jan 2021 16:03:26 GMT

By giving any administrative privilege you also give them all rights to any service on a federated arcgis server. They can delete or edit any service. This is also an unfortunate side effect. I agree this makes things very difficult. It also is misleading. The fine grained permissions listed on portal do not correlate with the outdated security on the servers. I agree ESRI needs to get this fixed.

Re: Make ‘create group with update capabilities’ a non-admin privilege

Caitlin_Dickinson — Mon, 11 Jan 2021 15:48:49 GMT

@RobertBorchert Yes, you can create regular groups with the publisher role, but not shared update groups. One way in which shared update groups function differently than regular groups is that members of the group may edit the same map or app, without having to save their own copy.

'Create group with update capabilities' is the privilege that allows a user to create shared update groups, and this is what i'm asking to be made a non-admin privilege.

Re: Make ‘create group with update capabilities’ a non-admin privilege

JeffShaw — Sat, 23 Jan 2021 20:58:13 GMT

As the admin for our organization I support this idea. Another problem with adding it or any other "admin" privilege to a custom role is that the role cannot then be selected when a new account is created, and it cannot be used as a default role.

Re: Make ‘create group with update capabilities’ a non-admin privilege

AmyWork3 — Sun, 07 Jan 2024 22:14:46 GMT

I support: that ‘create a group with update capabilities’ be made a non-administrative privilege in order to more easily facilitate collaboration amongst users.

Our University struggles with the same thing. We would like this function to be part of the new member defaults, however because it is listed as a admin privilege, we cannot automatically assign this to users to enable them to "create group with update capabilities."

Our current work around is to have all members assigned a default role and then we transition them to a role that is not assigned as a new member default.

We haven't encountered the Notebook issue, but users are still ramping up on using those. Given the warning you are getting @Caitlin_Dickinson, that would confuse our users as well.

Re: Make ‘create group with update capabilities’ a non-admin privilege

JohnWeidler — Thu, 15 Apr 2021 14:13:09 GMT

I have run into this same problem. I created a custom role that I made virtually identical to the default publisher role and I added the 'create group with update capabilities' privilege. I wanted our publishers to be able to create groups so they could collaborate more easily with their users. However, I do not want publishers to be administrators. When a publisher is assigned this custom role with this 1 admin privilege they then have the ability to see every service in our entire Enterprise organization, even if it hasn't been shared with them.

Re: Make ‘create group with update capabilities’ a non-admin privilege

Anonymous User — Thu, 15 Apr 2021 14:27:25 GMT

This is a needed enhancement in both AGOL and ArcGIS Enterprise. The Admin privileges in general need an overhaul along with the inflexible server security.

Re: Make ‘create group with update capabilities’ a non-admin privilege

GeriMiller — Fri, 16 Apr 2021 18:26:49 GMT

@JohnWeidler

Once you take this approach to use "create group with update capabilities" to enable more people to easily collaborate, i.e. use a custom role with this 1 admin privilege, those users should NOT see every service in their entire organization.

They should only be able to see the services that have been shared with them explicitly, or that have been shared with organization or public.

If your users with this capability are indeed seeing this behavior (all services), please place an Esri Tech Support call.

Re: Make ‘create group with update capabilities’ a non-admin privilege

JohnWeidler — Fri, 16 Apr 2021 18:36:27 GMT

@GeriMiller I did put in a case with tech support....and they confirmed that this is expected behavior. I can get you the emails and put you in touch with the tech I worked with if you'd like.

Re: Make ‘create group with update capabilities’ a non-admin privilege

GeriMiller — Fri, 16 Apr 2021 18:52:52 GMT

@JohnWeidler

Please do share the case/put in touch.

Re: Make ‘create group with update capabilities’ a non-admin privilege

JeffShaw — Mon, 19 Apr 2021 17:47:57 GMT

Another reason for supporting this idea...

Esri recommends creating a customized Publisher role in order to grant the Create with Update Capabilities privilege to those who will be creating Hub initiatives, so they can create initiative core teams:

See: https://doc.arcgis.com/en/hub/initiatives/initiative-basics.htm

You can create initiatives (site only and content group) if you are assigned the default Publisher role. To create an initiative with engagement features, you must have a custom role based on the default Publisher role, plus the following administrative privileges:

The Create with update capabilities (Groups) privilege allows you to create a core team. The update capability means that anyone who's a member of the group (core team members) can update any item shared to the group.
The Assign Members (Groups) privilege allows you to add members directly to the core team without sending an invitation to their email. This privilege is recommended because it enables you to immediately share content with new core team or supporting team members. The next time that they sign in to ArcGIS Hub, they can read their notifications to know which team they've been added to and see any items that have been shared with the group.
The Make groups available to public (Sharing) privilege allows you to create events.

Re: Make ‘create group with update capabilities’ a non-admin privilege

JohnWeidler — Fri, 30 Apr 2021 14:11:58 GMT

@GeriMiller confirmed with the ESRI analyst I worked with that this behavior does indeed occur. When you create a custom role identical to publisher and add only the 'create with shared update' privilege the user can then see every service in the organization. Interestingly, I'm working in ArcGIS Enterprise 10.8.1 and she said this behavior doesn't occur in ArcGIS Online, go figure. Since the posts for this idea are for ArcGIS Online I created a new idea for ArcGIS Enterprise to make this privilege a non-admin privilege as well.

Re: Make ‘create group with update capabilities’ a non-admin privilege

AinhoaGonzalezDelCampo — Wed, 02 Jun 2021 16:07:45 GMT

Within our third level academic institution we are having similar issues - as a Director of GIS Teaching and Learning in one of the Schools, I do not have the admin rights to set up groups which really affects opportunities for group work and for sharing data and maps with a certain cohort of students. We have enquired this with Esri, but have not being able to find a workable solution. Enabling group creation and management for advanced licenses such as Published should be a priority to facilitate workable iterations for group-based map and WebApp creation.

We currently have to request group creation to IT services, and even doing that, we have not been able to have a joint WebMap/WebApp that is editable by those registered as group members - has anyone had the same issue?

Re: Make ‘create group with update capabilities’ a non-admin privilege

Anonymous User — Wed, 02 Jun 2021 16:26:59 GMT

Here is the Idea for Enterprise. https://community.esri.com/t5/arcgis-enterprise-ideas/make-create-with-update-capabilities-a-non-admin-privilege-in/idi-p/1053183

Please give it Kudos.

Re: Make ‘create group with update capabilities’ a non-admin privilege

JaneANol — Thu, 03 Jun 2021 11:06:51 GMT

In our university research groups need to be able to work collaboratively on the same map / app. It is inefficient that only the university Esri administrator can set up a Share Update Group, this should be something that the person who sets up the Group can do themselves.

Firstly the administrator sets up a Shared Update Group and then invites the lead researcher to be the Group Manager (it is not possible to set up this lead researcher as Group Owner). Only the administrator can see the ‘Edit Sharing’ settings while creating the Shared Update Group. The administrator has to switch this edit sharing on in order to make the maps / apps editable within this Group. The Group Manager can then invite other researchers / collaborators to the Shared Update Group.

It is not at all clear why the Shared Update Group functionality rests with the administrator, as it would be much more efficient for Group Managers / Group Owners to be able to do this themselves.

Being able to share, edit, collaborate on maps and apps is at the heart of ArcGIS Online and it should be made as easy as possible to do this effectively.

Re: Make ‘create group with update capabilities’ a non-admin privilege

ReinaCMurray — Fri, 04 Jun 2021 18:04:13 GMT

Our current workaround at our educational institution, in case it's helpful to others:

Our organization has three main roles: Administrators, Publisher+Notebook (custom role adding Esri Notebook capabilities to the default Publisher role) and Publisher+Notebook+GroupUpdate (custom role adding Esri Notebook and Group Update capabilities to default Publisher role). Because Group Update is categorized as an admin privilege, the new member default is set to Publisher+Notebook. Once a day, a script is run to turn new user accounts to Publisher+Notebook+GroupUpdate. (note: we use enterprise login with SAML, so as long as users have an authentic university ID, they are able to log in and create an account).

This removes a lot of the headaches for us, but it would be nice to just have the new member default set to include this capability.

Re: Make ‘create group with update capabilities’ a non-admin privilege

PatIampietro — Mon, 07 Feb 2022 21:47:19 GMT

I support this and like others have created a custom role with this one privilege added. But it really shouldn't be needed.

Shared update should really be switchable at any time, rather than being set in stone @ group creation. Especially since having it turned on can cause issues when trying to reassign ownership of items. I have had cases where group owners have asked for it to be turned off or on after the fact, and the only recourse is to create a new group with the requested setting.