Groups - add filter for "update capability enabled"

[MegHoole]

Administrators would find it useful to be able to view a members groups by filtering on "update capability enabled".  When downgrading a member's User Type from "Creator" to "Viewer", I have to find and remove the user from all groups with the "update capability enabled" before I can change the user type to "Viewer".  Currently I have to open each group to determine if the group has the capability enabled.  It would be much easier to manage, if there was a filter to list only groups the member belongs to with "update capability enabled".  A complementary idea would be to have an option for AGO to remove the member from such groups automatically when attempting to downgrade user type to viewer i.e ask admin question "This member belongs to groups with update capability enabled.  Do you want to automatically remove them from said groups? Yes, No".

[PaulHoefflerGISS]

These types of groups create all sorts of limitations and issues, some of which are undocumented and some of which are scattered within Esri's online documentation (Create groups—ArcGIS Online Help | Documentation, Share items—ArcGIS Online Help | Documentation, Take web maps offline—ArcGIS Online Help | Documentation (as of 11/18/2019 the information pertaining to update-all groups on this page is incorrect and has been reported to Esri), etc.).

This Idea is a good idea and would be helpful.

Further because this group attribute doesn't seem to be documented in the ArcGIS APIs! (as of 11/18/2019):

Using Admin Tools for ArcGIS Online & Portal‌ Groups Export tool on groups with and without group members able to update all items it appears that there is a "capability" group attribute that is set to [] for regular groups and to ["updateitemcontrol"] (JSON) for groups with the member update capabilities.

To my knowledge group attributes cannot be directly examined using ArcGIS Online Assistant, either.

Implementing this Idea would be helpful.

Exposing and/or documenting this in the APIs seems as though it should already be done (please correct me if I've missed it).

The complimentary idea is also a good one, and we have many others to go along with this type of group and the complications and limitations that they bring...

[MegHoole]

The functionality that these groups provide are certainly useful.  However, on the admin side, transferring content to new owners is also painful (i.e. need to remove the items from the group, transfer the items to new owner, then re-add the items to the group.  As an admin - I can't even do that unless i'm a member of the group... and seems like sometimes I have to make myself the owner of the group... too tricky! ... thought I had asked for enhancements to this in the past... will have a look....

[PaulHoefflerGISS]

I agree that it's not reasonable. I raised the issue in the past with Esri Technical Support, and again in the last week.

We've been attached to BUG-000089698: Unable to change the owner of any item in ArcGIS Online when shared with a group with the 'Members can update all items in this group' option selected while creating the group.

But it has a Closed status and notes from Development set as: We don't allow to change ownership of item that is shared in group with update capability. We have implemented an error message for when this is attempted.

I've been told this won't be supported, but something needs to change.

Between two ArcGIS Online organizations that I'm familiar with (admin/used to admin) we have nearly 14,000 user accounts and well over 70,000 items - with a handful of admins between the two and the proliferation of groups with update-all capabilities enabled this is a problem that will only grow.

[PaulHoefflerGISS]

There are a couple situations where sharing with this type of group appears successful and is not - and unless you go back and check it you won't know otherwise; I think that's one of your points, Meg Hoole. Here are two BUGs on those problems:

BUG-000126856: No error occurs when unsuccessfully trying to share content to a group when the content owner is not a group member.
BUG-000126857: No error occurs when unsuccessfully trying to share content to a group when the content owner is not a group manager or owner and the group is set to contributors: managers or owner only.

[MegHoole]

@PaulHoefflerGISS  can you confirm if you're still having this problem?  We are (although there appears to be some situations where an item will transfer to another user despite being shared to a group with update capability).     I believe I also run into the two bugs above that you mentioned, on a regular basis when transferring content shared to 'update' groups between owners.

[PaulHoefflerGISS]

@MegHoole, we still cannot change ownership of items shared with groups that have the shared update capability. We do get a message stating as such, though.

We've also found that we cannot change ownership of web maps with map areas defined, and we cannot delete map areas, even as Administrators, without deleting hidden items and editing the web map item's JSON - quite convenient. BUG-000129268 It is not possible to change the owner of a web map when a preplanned offline map area has been created.

I've encountered numerous other bugs with ArcGIS Online, where we keep getting new features with more defects. Transferring items between two users who are members of different groups can put items in an inconsistent sharing state. I believe Esri declined to log that, and I ran into it again recently, although it could be captured in one of our BUGs - it's hard to keep them straight, especially since we have to monitor them for years on end, as the list gets longer. Unfortunately, we don't get much engagement or movement on ArcGIS Online-related defects, despite their impacts to users and administrators.

Some related information:
#BUG-000089698 Unable to change the owner of any item in ArcGIS Online when shared with a group with the 'Members can update all items in this group' option selected while creating the group. from 2015, was Closed as Implemented with the Explanation of "We don't allow to change ownership of item that is shared in group with update capability. We have implemented an error message for when this is attempted." and a listed Workaround of "1. Unshare the item with the group.
2. Change the owner of the item." - so the "implementation" is, you can't do it, we added an error message. When I try to change ownership of an item that is shared with this type of group, I am presented with "Error: Unable to change the owner of items that are shared to a group with the update capability"

Here's an "enhancement request" on the other side of that issue: ENH-000135849 Organization admin should have privileges to change ownership of items shared in groups with shared update capabilities enabled.

BUG-000126856 No error returns when the attempt to share content to a group is unsuccessful if the content owner is not a group member. from late 2019, Closed as Implemented. There are no details provided by Esri, aside than that they state it was fixed at ArcGIS Online version 7.4.

BUG-000126857 No error returns when the attempt to share content to a group is unsuccessful if the content owner is not a group manager or owner, and the group is set to contributors: manager or owner only. - exact same as above BUG.

BUG-000136043 When changing the ownership of an item in ArcGIS Online, the item remains shared to groups the new owner is not a part of despite the new owner removing all sharing of the item.

BUG-000135883 Publishers set as a group manager are unable to share items to a shared update group if only group owners and managers can contribute content.

BUG-000129158 Administrators are unable to share items they do not own with groups they do not belong to, although the message indicates it is successful.

Here's our most recent, related ArcGIS Online defect:
BUG-000141611 The Group icon does not display in the edit sharing window for Group Members and Group Managers - the groups that an item are shared with are displayed inconsistently depending upon where you are viewing this information - it's unsettling, and difficult for Administrators.

Also logged a week ago:
BUG-000141606 Group Managers are unable to share data to groups in which the Group Owner and Managers can only contribute content.

We're now looking into another case of item/data corruption which was logged in a data-specific defect as BUG-000132998 Exporting a hosted feature layer with a date field as a file geodatabase from ArcGIS Online results in the attribute table being empty when viewing this file geodatabase in ArcGIS Pro.

ENH-000135798 When changing ownership of an item in ArcGIS Online, the item is removed from the groups it is shared with without notification to the user.

Somewhat off-topic, but ArcGIS Online:

BUG-000138428 The transfer content feature in ArcGIS Online does not maintain the folder structure of the previous owner.

BUG-000141547 Metadata Editor prompts saving changes when none have been made

BUG-000139880 Legend in current Map Viewer in ArcGIS Online appears to separate similar attributes

BUG-000134628 Required fields are not honored when adding a new feature in Map Viewer, ArcGIS Collector, and Field Maps in a feature layer published from ArcGIS Pro because ArcGIS Pro assigns default values for the fields in the feature template.

ENH-000139462 Provide users with the ability to filter ArcGIS Online content by the 'Form' type

BUG-000136919 The 'Privilege compatibility' slider resets to View when only the View level privileges are set in the 'Create role' page for a custom role causing all other privileges to be disabled.

I have more, but that's probably too many already. 🙂

[MegHoole]

Thanks @PaulHoefflerGISS ... sounds familiar unfortunately.   Lots of good stuff about AGO, its uber popular in our Org, and that popularity means more and more content getting shared to groups with update capabilities (Hub sites being the newest culprit - autocreates the required groups with update capability).

I've opened a new ticket with Esri Canada today to see if we can get some traction to address the content ownership changing issues for items shared to udpate groups....  We'll also possibly be looking at creating a script internally to help solve the problem.   GeoJobe's Admin Tools Pro for AGO app has some good tools, but it also falls short for this problem.

[PaulHoefflerGISS]

@MegHoole please do share what you hear and fine. We limit the creation of such groups to administrators, due to the implications, and even at that have over 100 shared update groups. Other orgs are in far worse shape on this point.

The Hub site wrinkle is news to me, thank you for sharing that. We have found that we can't limit users from creating Hub sites, so now they can also created shared-update groups. Administration keeps getting more difficult, and as you noted it's incredibly popular and widely used. Thanks for checking in on this, and sharing anything you find.

[MegHoole]

cheers @PaulHoefflerGISS