Allow Totara Support user login

Why provide access?

Totara Support staff occasionally need to access Totara Cloud sites for a variety of reasons, such as verifying upgrades, troubleshooting infrastructure issues, or providing product support.

We take data protection very seriously, and have multiple layers of protection to ensure your data is safe and secure. This includes:

• Explicit customer approval before any access is permitted
• Limiting login access to only Totara staff who require access for the purposes above
• Using individual user accounts with robust onboarding/offboarding procedures to ensure that access is removed when no longer required
• Multi-factor authentication required for all support access
• Logging of both the login event and actions taken while logged in
• Customer reports detailing Totara Support login events and actions

Granting Totara Support access

To grant access to Totara Support staff, follow these steps:

1. Navigate to [yoursite]/admin/settings.php?section=local_support.
2. Enable the Allow Totara Support user login setting, then click Save changes.
3. If you wish to revoke access at any point, you can disable this setting. This will prevent Totara Support staff from accessing your site.

Viewing Totara Support access logs

All Totara Support staff activity is logged and can be viewed using reports.

You can view the logs by following these steps:

1. Navigate to Quick-access menu > Server > Logs.
2. Generate a site log for the period of interest. In the User full name column you may see records for Totara Support, along with a long identifier string for each record.
3. You can provide an identifier string to Totara, which we can then use to identify the specific Totara Support staff member who accessed the site. If you see any access that you do not expect, please raise a Totara Helpdesk ticket and quote the relevant identifier string(s).

Alternatively you can generate a specific report by following these steps:

1. Navigate to Quick-access menu > Reports.
2. Click Create report.
3. Search for and select the Support User Site Logs report source.
4. Click Create and view to generate the default report.
5. Filter by Has a support user identifier? > Has identifier to return all log entries from Totara Support staff.
6. Optionally click Save this search to create a view of this report that you can bookmark and return to later. You can customise this report to show the data you need as you would with other reports.

If the report is empty that means no Totara Support staff have logged in during the period for which your site logs are kept.

Direct infrastructure access

Since we host the underlying cloud infrastructure, Totara Cloud Engineers also have access to your data via direct access to the hosting infrastructure (for example by directly logging in to the site database). This type of access is possible even when the Allow Totara Support user login setting is disabled, and would not appear in the logs described above. However, direct access is even further restricted to a very small team of engineers, with additional controls, processes and internal logging in place to prevent abuse.