Admin: Access rights, permissions and roles in SWOOP (Teams)

Access rights

By default, anyone who can access Teams has access to SWOOP. However, it is possible to change this, and limit access to a set of named people.

As an Admin you will see an 'Admin' link on the bottom left fly-out menu of SWOOP. This is where you can change the permissions covered in this article.

Go to the Access Control option in the Admin dashboard. Here, you can do the following:

1. Add permissions
2. Remove permissions
3. Update permissions

Allow everyone access

By default, the 'Everyone' option is selected and every user can access SWOOP. Additional permissions is provided in the table below to Lite Admins, Advanced Users or Full SWOOP Admins. In the example below Sarah is a Full SWOOP Admin, Frankie has been given some additional permissions (Lite Admin), Rose is an Advanced User, and everyone else will have normal permissions. 

For more information about these roles see further below.

Note: If you have more than 1000 users, the table below will not be shown.  In this case, you can modify user permissions by uploading a spreadsheet with user email addresses and their permissions, a template is provided.
This is done by selecting: "Upload a list of email addresses..."

Allow access for named people only

It is possible to restrict access to SWOOP to a set of named users. That means that unless the person is listed in the table below it is not possible to access SWOOP.

In the example above Sarah is a Full SWOOP Admin, Frankie has been given some additional permissions (Lite Admin), Rose is an Advanced User, and Donna is a normal user (has not been given any special permissions). No one else apart from these four people can access SWOOP.

Permissions and roles

SWOOP operates with 3 different roles:

1. Normal User
2. Light Admin
3. Full Admin

In this article we'll outline what each of these roles can do.

Normal User

A Normal User can:

• Access the SWOOP dashboard available at https://[organization].swoopanalytics.com.
• Access their own Personal dashboard and see personal insights.
• Access the Segment dashboard. Search and access insights for any segment. Only see insights for data (e.g. messages) that the person already has access to.
  • Compare segments.
• Access the Teams dashboard. Search and access insights for any team. Only see insights for data (e.g. messages) that the person already has access to.
  • Compare teams.
• Access the Enterprise dashboard. Access insights for any segment. Only see insights for data (e.g. messages) that the person already has access to.

Light Admin

A Light Admin is someone who has been given access to some additional features in SWOOP by a Full SWOOP admin. These additional features include one, or more, of the following:

• Create a comparison of individuals on the Personal dashboard, and access the 'Individual Benchmarking' list on the Teams and Segment dashboards.
• Access Sentiment Analysis reports on all dashboards (if sentiment analysis has been enabled).
• Expand the list of Influential People (a 'More' button will appear).
• Activity Export (being able to export to Excel the Segment Activity and Team Activity reports on the Enterprise dashboard).

Light Admin cannot be used in selecting the visibility of dashboards, tabs or reports, or Dr SWOOP.  

Advanced User

An Advanced User is someone who has been assigned a higher tier then a Normal User. The use of being an Advanced User comes when customising the dashboard visibility settings. This gives more flexibility to admins who want to assign certain reports, tabs or whole dashboards to only be visible to a higher tiered users but not necessarily make them admins. 

For example, we know that Rose is an Advanced User. 

In the Dashboard tab of the Admin Settings we can customise certain reports to only be visible to Advanced Users and Admins (so only visible to Rose and Sarah). Meaning that Donna, as a Normal User, and Frankie, as a Lite Admin, will not be able to see certain reports. 

Full Admin

In addition to what a Light Admin can do, a Full Admin can also:

• Teams dashboard: Search for, and display the page for a private team you are not a member of.
• All dashboards and reports: Set dashboard/report display (show/hide/remove) via the 'Admin' options.
• All dashboards: Access Sentiment Analysis reports (if enabled on your site).

A Full Admin also has the ability to change a variety of other options which are available via the 'Admin' link. Only Full Admins will see the 'Admin' link, and when opened it provides the following features:

• Usage Statistics: See how many people have accessed SWOOP.
• Application: Set default attribute used by these reports: Segment Activity, Cross-Enterprise Collaboration, Network Map (default is 'department'). Also ability to determine which attributes are available for normal users (including Lite Admins and Advanced Users) versus Full Admins.
• API Tokens: Provides access to SWOOP calculations by direct API instead of interactive web interface.
• Theme Settings: Change logo and footer.
• Report/Dashboard Settings: Enable, hide or remove each dashboard and/or report.
• Miner*: Enable data mining, access data mining log detail, and upload user attribute data.
• Data export:
  • Export list of all communities. Deleted communities are excluded. Number of Posts, replies, and reactions are included for the selected date range in SWOOP.
  • Export list of nudges for all active users. Deleted/inactivated users are excluded.
  • Export list of people plus list of all activities.
• Access Control: Enable selected features for Lite Admins, Advanced User and/or add a Full Admin.

Who can see what

Searching for a team on the Teams Dashboard

What is shown in the search results when you search for a team:

Accessing a team on the Teams Dashboard

The following roles can access a Teams Dashboard:

Note: SWOOP Full Admins who are not members of a private team can access the Team Dashboard. However, the following data fields are not shown:

• Names of people
• Content of message
• Names of channels
• Names of files

Accessing insights on the Teams Dashboard: Public Teams

Accessing insights on the Teams Dashboard: Private Teams

The following roles can access various insights in a Teams Dashboard:

(Note: Non-member do not have access to private teams in SWOOP)

See names of Teams in various reports

Where names of Teams appear in SWOOP reports on various dashboards:

Adding or Changing Permissions

Only a 'Full Admin' can change permissions. If you are a Full Admin you will see an 'Admin' link in the footer of SWOOP.

• Click on the 'Admin' link in the footer
• Click on the 'Access Control' dashboard
• Add a new user by searching for the person's name, and then tick the relevant permission(s).
• Click 'Save' when done.

To change permissions select the relevant tick boxes for the person you want to change. To remove all SWOOP permissions for a person click the bin icon and save.

People who are assigned any of the following Azure Directory roles are AUTOMATICALLY assigned as Full SWOOP Admins. They will not appear in the SWOOP Access Control List, but they get access permissions same as if they were listed. To remove their Full SWOOP Admin rights you will need to remove them from the Azure Directory role.

• Global administrator
• Teams Communications Administrator
• Teams Communications Support Engineer
• Teams Communications Support Specialist
• Teams Service Administrator

See https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#role-template-ids for a full listing of all of the Azure Directory roles. This link includes the Azure Directory Template ID for each of these roles.

The listed name of some roles might change depending on language settings or because in some tenants role names have been changed, however SWOOP internally uses the well known Template ID as the definitive indicator of the role.