Require users to choose an organisation before changing organisation settings

Posted on: 17 May 2021 Tags: user permissions

This builds on the work to give all users access to view their organisation’s users and permissions. We separated the ‘your account’ section into:

your account - the user’s profile, permissions and notification settings
organisation settings - users and organisational permissions

We will now require users to choose which organisation they want to view settings for, if they belong to more than one.

Why we’re making these changes

Combining organisation permissions and users adds complication to several pages. This includes:

showing multiple organisations in the list of users
having to hide duplicate relationships if the user belongs to both the training provider and accredited body
showing multiple pages in the user invitation journey, with the possibility of confusion about which page is for which organisation
having to indicate which permissions can be changed in a user profile, since the user viewing it may not have manage user permissions for all the organisations

This is a lot of extra complexity for the 20% of users who belong to multiple organisations. We think that this change will make it easier for those users to understand permissions.

It may also help to reinforce the principle that users should only belong to organisations they actually work for. They should use organisational permissions to set up other relationships.

What we’ve done

Organisation settings

If the user belongs to only one organisation, they will see links to the ‘users’ and ‘organisational permissions’ pages for that organisation.

If the user belongs to more than one organisation, they will see a subheading for each organisation with links to ‘users’ and ‘organisational permissions’ pages.

Users

If the user belongs to more than one organisation, the caption for the h1 heading will show which organisation they selected.

User details

In the body of the page we no longer list the organisations which the user has access to.

We’d previously introduced h2 headings to separate out personal details and permissions. That is no longer necessary as the page has been simplified.

We’ve made ‘delete user’ a link rather than a button as it’s a destructive action and rarely used. We’ve moved it to the top, just under the h1, because that’s where we normally place actions.

If the user belongs to more than one organisation, the caption for the h1 heading will show which organisation they selected.

Change permissions

We’ve taken the organisation name out of the h1 headings when users change permissions. If the user belongs to more than one organisation, we give its name in the caption. The format is ‘user name - organisation name’.