TU Systems Guides Guides to the systems staff use every day - the Learning Management System (lms.tangaza.ac.ke), online classes (bbb.tangaza.ac.ke) and the Staff Portal (staff.tangaza.ac.ke). Each system has a guide for lecturers and administrators, and a separate guide for ICT staff. TU Staff Portal Guide ℹ️ New here? Sign in with your Staff Number and password, then use the sections below to find any task. IN THIS GUIDE 🚀 Getting Started🗂 Management🎓 Academics🧾 Requisitions⭐ Appraisals📊 Reports✅ Approvals👤 Account & Profile 🚀 Getting Started 1. Logging In Go to staff.tangaza.ac.ke. Enter your Staff Number in the “Staff No” field. Enter your password in the “Password” field. Optionally check “Remember me” to stay signed in on this device. Click “Log In” to access your dashboard. 2. Resetting a Forgotten Password From the login page, click “Forgot your password?” Enter your staff username (Staff No) in the field provided. Click “Reset Password”. A password reset link will be sent to your registered email address. Click “Login” to return to the sign-in screen. Enter a new password and ensure it meets the password policy: at least 12 characters long, including uppercase and lowercase letters, a number, and a special character, and must not contain your name. 3. Dashboard Overview After logging in, you land on the Dashboard, showing your photo, name, staff number, department, job title, and available balance. Click “Change Photo” to upload a new profile picture. Click the “Bio-Data” card to expand personal details (National ID, gender, marital status, birth date, nationality, county). Click “Contact Info” for mobile number, personal/company email, address, and postal code. Click “Employee Details” for job title, department, joining date, contract dates, and probation period. Click “Financial & Statutory Information” for bank details, KRA PIN, NSSF, NHIF, and SHIF numbers. Click “View Qualifications” to see recorded academic qualifications. Scroll to “Internal Communications” to view and download circulars or notices using the “Download” button. 🗂 Management 4. Viewing the Programme List Under “Management”, click “HOD/DEAN Section” to expand it. Click “Programme List”. Browse the table of all university programme codes and descriptions. Use “Search” to filter, or “Copy”, “Excel”, or “PDF” to export. 5. Viewing the Lecturer List Under “HOD/DEAN Section”, click “Lecturer List”. Browse lecturer records (PF number, name, phone, gender, email). Use “Search” to filter, or “Copy”, “Excel”, or “PDF” to export. 6. Viewing Vote Book Balance Under “HOD/DEAN Section”, click “Vote Book Balance”. View your department’s budget/vote book balance. A “table IDs do not match” notice may appear if no data is linked to your account yet. 🎓 Academics 7. Allocated Units Under “Academics”, click “Allocated Units”. View units allocated to you as a lecturer, with columns for Code, Stage, Semester, Unit, Unit Name, Campus, and Class. Click “Assign Marks” to enter or manage marks for a unit. Click “Print Class List” to generate a printable class list. Click “Print Exam Attendance” to generate a printable exam attendance sheet. 8. MyLoft, Moodle, Staff Links, and Turnitin Under “Academics”, click “MyLoft” to open the MyLoft e-learning platform. Click “Moodle” to open the university’s Moodle LMS. Click “Staff Links” to open a page of useful staff resource links. Click “Turnitin” to open the Turnitin plagiarism-checking login page. 🧾 Requisitions 9. Leave Requisition Under “Requisitions”, click “Leave Requisition”. Review the summary counters at the top: Draft/Open, Pending Approval, Approved, Posted, and Rejected. Browse your leave history table below. Click “Select” next to an entry, then use “View Document”, “Send Approval Request”, “Cancel Approval Request”, or “Document Approval Trail” as needed. Click “+ New Leave Request” to open the application form. Choose a “Leave Type” and number of “Applied Days”. Choose a “Reliever” (the colleague covering for you). Enter the “Start Date” (the End Date and Return Date calculate automatically). Select a “Responsibility Center”, optionally attach a “Hand-Over Report” file, and add “Remarks/Purpose” and “Handover Remarks”. Submit the form to raise your leave request. Use “Document Approval Trail” at any time to see the full approval chain for a request, including which approvers have and have not yet approved it. 10. Purchase Requisition Under “Requisitions”, click “Purchase Requisition”. Review the summary counters: Open Documents, Pending Approval, Released, Posted, Rejected. Click “+ New Purchase Request” to open the request form. Enter a “Reason” for the purchase. Choose “Institute/Campus”, “Department”, and “Responsibility Center”. Optionally attach a supporting file. Click “+ Add Item Line” to add the items you want to purchase. Submit the form to raise the purchase requisition. From the list, select an existing requisition to view its document, send or cancel an approval request, or check “Document Approval Trail” to see who has and has not approved it yet. 11. Store Requisition Under “Requisitions”, click “Store Requisition”. Click “New Request” to raise a request for items from the store. Use “View Document”, “Send Approval Request”, “Cancel Approval Request”, and “Document Approval Trail” to manage existing requests, listed with Request Date, Required Date, Description, Function Name, Budget Center Name, and Status. 12. Imprest Requisition Under “Requisitions”, click “Imprest Requisition”. Click “New Request” to request an imprest (cash advance). Review existing requests and their status in the table, and use the toolbar buttons to view documents, send or cancel approval requests, or check the approval trail to see outstanding approvers. 13. Imprest Surrender Under “Requisitions”, click “Imprest Surrender”. Click “New Surrender” to account for or surrender a previously issued imprest. Review past surrenders in the table, showing Surrender Date, Imprest Issue Doc No, Function Name, Budget Center Name, Amount, and Status. 14. Staff Claim Requisition Under “Requisitions”, click “Staff Claim Requisition”. Click “New Request” to submit a claim, such as a reimbursement. Review past claims in the table and manage them with the toolbar buttons, including “Document Approval Trail” to track pending approvers. ⭐ Appraisals 15. Appraisal Requisition Under “Appraisal Section”, click “Appraisal Requisition”. Click “Create Appraisal Document” to start a new self-appraisal. Use “View Document”, “Send Approval Request”, “Cancel Approval Request”, and “Print Report” to manage existing appraisals listed with Appraisal Code, Staff Name, Appraisal Period, Appraisal Type, Supervisor, and Open To. 16. Supervisor Review List Under “Appraisal Section”, click “Supervisor Review List” (visible if you supervise other staff). Click “View Document” to review a subordinate’s appraisal. Click “Send Back to Appraisee” to return it for revision, or “Send to HR” to forward it once your review is complete. 📊 Reports 17. Payslip Under “Reports”, click “Payslip”. Select the “Year” and “Month” you want to view. Click “View Payslip” to generate your payslip for that period. When prompted for a password to open the payslip document, enter your National ID Number or Passport Number. 18. P9 Tax Document Under “Reports”, click “P9”. Select the “Year”. Click “View P9 Document” to generate your annual P9 tax deduction certificate. ✅ Approvals 19. Pending Approval Under “Approvals”, click “Pending Approval”. Review the list of documents or requisitions awaiting your action as an approver. If there is nothing to approve, you will see “All Caught Up!”. 20. Approved Documents Under “Approvals”, click “Approved Documents”. Review the history of documents you have approved. 21. Rejected Documents Under “Approvals”, click “Rejected Documents”. Review the history of documents you have rejected. 👤 Account & Profile 22. Account Settings Under “Settings”, click “change password”, or use the profile menu at the top-right and select “Change Password”. Enter your new password, then confirm it. Ensure it meets the password policy: at least 12 characters long, including uppercase and lowercase letters, a number, and a special character, and must not contain your name. Click “Change Password” to save. The profile dropdown at the top-right also offers quick links to “Dashboard”, “Change Password”, and “Logout”. Tangaza University - Staff Portal Guide. Keep this guide handy when navigating the portal.  Adding Units and Enrolling Students FOR LECTURERS, SCHOOL ADMINISTRATORS AND PROGRAMME LEADERS · lms.tangaza.ac.ke Creating your units, opening enrolment and managing your class list. ℹ️  New here? The first time, work top to bottom — create the unit, let students in, then keep the class list clean. After that, use the list below to find what you need. Tangaza University runs a single Learning Management System at lms.tangaza.ac.ke. Every taught unit is a separate course on that system, with its own materials, activities and participant list. Lecturers, school administrators and programme leaders may all create units. This guide covers creating a unit, letting students in, and keeping the class list clean. In this guide 📖  The words used here 📘  Part 1 - Creating a unit 🧱 Part 2 - Building the unit 🔑  Part 3 - Letting students in 👥  Part 4 - Managing your class list ✅  Start-of-semester checklist 🛠  If something goes wrong 💬  Support and training 📖  The words used here Term Meaning Unit A course on the LMS. One taught unit, one course. Category The folder a unit sits in School, then programme, then academic year. Enrolment method How people get into a unit: you add them (manual), they add themselves (self enrolment), or a whole intake is synchronised in (cohort sync). Enrolment key A short password a student types once, at the moment of joining, to prove they belong in that class. Role What a person may do inside the unit: Lecturer or Student. 📘  Part 1  ·  Creating a unit Create the unit once, at the start of the semester, and reuse it in later intakes by copying it rather than building it again. 1.1 Create it Sign in at lms.tangaza.ac.ke using the Google sign-in button and your Tangaza staff account. Google is the only login route there is no separate LMS password. Click Institutes in the top menu, open your Institute, then open the sub-category (Bachelors, Masters, Diploma or PHD) your unit belongs to. There is no gear or Site administration button for lecturers - going in through Institutes is your route to creating a unit. Confirm you are in the right category (Undergraduate, Diploma, Certificate etc.). Get this right: it decides where students will look for the unit and which colleagues can help manage it. At the bottom of that category’s course list, click Create a new course. If that button is not showing, use one of the three methods in the box just below - they all open the same New course form. Enter the Course full name: the unit title as it appears in the programme document, for example Foundations of Peacebuilding. Enter the Course short name: the unit code, for example ISTP 701. This must be unique across the whole University, so add the intake where a code repeats: ISTP 701 2026S1. Set the Course start date to the first teaching day and the Course end date to the last. In weekly format the start date drives the week numbering, so a wrong date shifts your whole outline. Choose the Course format: Weekly if you teach to a fixed timetable, Topics if you organize by theme or module. Leave Course visibility set to Hide while you build the unit. Click Save and display. On the screen that follows, add yourself as Lecturer, together with any co-lecturer or teaching assistant. Three ways to open the New course form — use whichever fits your access. Whichever you use, once the form opens, fill in the details in the steps below. Via Site administration (if you have admin access). Go to lms.tangaza.ac.ke/admin/search.php, then Courses → Manage courses and categories → click your category → Create new course. Direct link (any lecturer, instant). Open lms.tangaza.ac.ke/course/edit.php?category=ID in your browser, replacing ID with your programme category’s number (ICT can give you yours). This drops you straight onto the New course form. Request a course (goes to ICT for approval). Open lms.tangaza.ac.ke/course/request.php, enter the unit’s full name, short name and category, then submit. ICT or your Institute Administrator approves it and the unit is created for you. 1.2 Naming conventions Please follow these. They are what make units findable and sortable for everyone. Short name = the unit code in capitals with a single space: ISTP 701, BUS 204. Full name = Course name should contain: CourseCode|CourseFullname|CoursePeriod. E.g. TDCT1104 Fundamentals of Coding 2025-2026A 1.3 Add your colleagues Anyone who will teach, upload or mark in the unit must be enrolled in it with a teaching role. Open the unit and go to Participants. Click Enrol users. Type the surname or staff email address and select the person. Choose Lecturer for a colleague who will teach, edit content and grade. Click Enrol selected users and cohorts. You cannot add yourself as a lecturer to a unit. That is deliberate. If you have inherited a unit from a colleague, ask the institute admin to enrol you. 🧱 Part 2 · Building the unit Do this while the unit is still set to Hide. Students see nothing until Part 3. 2.1 Turn on Edit mode Open the unit from My Courses. Switch on Edit mode using the toggle at the bottom left of the page. Nothing can be added or moved until this is on. Turn it off when you have finished so you see the unit as students do. 2.2 Name your sections In weekly format the sections are dated automatically from your course start date. In topics format they are headings you name yourself. Name them before you start adding. Click the pencil icon beside Topic 1 and give it something meaningful - Conflict Analysis, not Topic 1. A unit with named sections is navigable; one with fifteen numbered topics is not. 2.3 Prepare your files first Rename files properly on your computer before uploading. If you drag several in at once, Moodle names each resource after the filename, and ISTP701lec3finalFINAL.pptx becomes what students see. Keep files small. A student on a phone with limited data may never open a 40 MB PowerPoint. Export slides to PDF where you can. 2.4 Add a single file With Edit mode on, click Add an activity or resource at the bottom of the section. Choose File. Drag your document into the Select files box, or click the file-picker icon and choose Upload a file. Wait for the thumbnail before continuing. Enter the Name. This is the link students click, so make it descriptive: Week 3 - Conflict Analysis Frameworks. Use Description for anything they need before opening it - the reading it accompanies, or what to prepare. Tick Display description on course page if it should show without clicking through. Click Save and return to course. 2.5 Choose the right type Use When File A single document: slides, PDF notes, a worksheet Folder Several files that belong together, such as one week's readings Page Notes typed straight into Moodle - no download, opens instantly on a phone URL A link to something hosted elsewhere, including Google Drive or a video Book Longer notes split into chapters with their own contents menu Prefer Page over File for anything short. It opens instantly, works on any phone, and you can edit it without re-uploading. Use Folder rather than fifteen separate files in one week. Students get one link that expands instead of an outline they have to scroll past. 2.6 Add several files at once With Edit mode on, drag files straight from your desktop onto a section. Moodle creates a File resource for each, named after the filename — so either name the files properly first, or rename each resource afterwards. 2.7 Hide material until you are ready Every item has its own visibility, separate from the unit's. Open the item's Edit settings. Under Common module settings, set Availability: Show on course page - students can see and open it. Make available but don't show on course page - reachable only by direct link. Hide from students - you see it, they do not. Remember to reveal it. A hidden item looks perfectly normal to you. 2.8 Release material by date If you would rather not remember to unhide things: Open the item's Edit settings and expand Restrict access. Click Add restriction → Date. Set from the date the material should appear. Click the eye icon beside the restriction to hide the item entirely until then, rather than showing it greyed out. 2.9 Naming your materials The same discipline as unit names, for the same reason — a unit is navigable in week nine or it is not. Lead with the week or theme: Week 3 - Conflict Analysis Frameworks. Say what the item is where it is not obvious: Reading, Slides, Worksheet. Never leave a filename as the name. Never put the file format in the name. Moodle shows that already. 🔑  Part 3  ·  Letting students in A unit is invisible to students until two separate things are true: the unit is set to Show, and an enrolment method is open. Doing only one of the two is the single most common reason students report that they cannot get in. 3.1 Publish the unit In the unit, go to Settings. Set Course visibility to Show. Save and display. 3.2 Decide how students will join Method Use it when Effort Self enrolment with a key Normal taught units. You keep control of who joins by controlling the key. Set once, announce the key in class Manual enrolment Adding a lecturer You add each person Cohort sync A whole registered intake that should be added and removed together. Ask ICT to set up the cohort 3.3 Open self enrolment Open the unit and go to Participants. At the top of the page there is a dropdown reading Enrolled users. Change it to Enrolment methods. If Self enrolment (Student) is listed but greyed out, click the eye icon to activate it, then the gear icon to edit it. If it is not listed at all, choose Self enrolment from the Add method dropdown. Set Allow new enrolments to Yes. Set Default assigned role to Student. Never anything else. Set or clear the enrolment key as described below. Click Save changes. 3.4 Self Enrolment with a key (recommended) In the self enrolment settings, click into the Enrolment key field and type your key. Click the eye icon beside the field to reveal what you typed and check it. Save changes. Announce the key in the first class and put it on your unit notice or WhatsApp group. Choosing a good key: Easy to say aloud and to type on a phone. Unit code plus intake works well: ISTP701-Sep26. Change it every intake. If you do not, last year’s class can still let people in. Never use one of your own passwords as an enrolment key. Understand what this does: any person with an LMS account can now join without asking anyone. That is fine for an induction unit. For a unit that carries marks, either use a key or close enrolment once the add-drop period ends. 3.5 Group enrolment keys If your unit has tutorial groups or streams, a group key sorts students into the right group at the moment they join, so you do not have to move anyone by hand. Create the groups first: Participants → Groups → Create group. Open each group, put a different Enrolment key in its settings, and save. Go to Participants → Enrolment methods → Self enrolment (gear icon). Set Use group enrolment keys to Yes. Make sure the method’s own Enrolment key field also has a key in it. This is the master key, and group keys will not work without it. Save changes, then give each group its own key. A student who types the master key joins the unit but no group. A student who types a group key joins the unit and that group. 3.6 Close enrolment after add-drop Participants → Enrolment methods → Self enrolment (gear icon). Set Allow new enrolments to No, or put an End date two weeks into the semester. Leave Allow existing enrolments as Yes so your current class is not affected. Save changes. Do not close a unit by deleting the key. Clearing the key field does the opposite of what you intend — it opens the unit to the entire University. 👥  Part 4  ·  Managing your class list 4.1 See who is in Participants shows everyone in the unit, their role, the method that brought them in, when they joined and when they last accessed the unit. Use the filters at the top to show only students, only a group, or only people enrolled by a particular method. 4.2 Remove or suspend someone You want to Do this Effect Remove a student who joined the wrong unit Participants → the bin icon on their row They lose access. Their submissions and marks are removed with them. Stop access without losing the record Participants → edit icon on their row → set Status to Suspended They cannot enter, but everything they submitted is kept. Remove everyone who self enrolled Enrolment methods → Self enrolment → delete the method Use with great care. This removes all their work as well. 4.3 Reusing a unit next intake Do not build the unit again. Ask ICT to copy the previous unit, or use Course reuse → Import to bring last intake’s materials into a new empty unit. Then change the dates, change the enrolment key, and check that no student from the previous intake has come across. ✅  Start-of-semester checklist # Check 1 Unit exists in the correct School → programme → year category 2 Short name carries the unit code and the intake 3 Start and end dates match the teaching calendar 4 You and any co-lecturer are enrolled with a teaching role 5 Course visibility is set to Show 6 Self enrolment is active and Allow new enrolments is Yes 7 A new enrolment key has been set for this intake 8 Default assigned role is Student 9 The key has been announced to the class 10 Enrolment is closed again once add-drop ends 🛠  If something goes wrong Students report Cause Fix They cannot see the unit at all Course visibility is Hide, or the category is hidden Settings → Course visibility → Show. If it is still missing, the category is hidden — ICT. No Enrol me panel on the unit Self enrolment is disabled or missing Participants → Enrolment methods → activate or add Self enrolment. The key is refused Wrong capitals, a trailing space, or an old key Reveal the key with the eye icon and re-issue it. Ask them to type rather than paste. Group keys do nothing No master key on the method itself Put a key in the self enrolment method as well as in each group. Students from other programmes have joined The key field was left blank Set a key, then remove those who should not be there. A change you made had no effect Pages are cached Sign out and in again. If it persists, ask ICT to purge caches. A student sees an empty account with no units They signed in with a personal Gmail rather than their university Google account Have them sign out completely and sign in again with their tangaza.ac.ke address. You cannot find a colleague when enrolling them They have never signed in, so no account exists yet Ask them to sign in once with Google, then enrol them. 💬  Support and training LMS support and staff training are provided by the Institute Administrator in your respective department. Contact them for: Course creation rights in your School or programme category Copying a unit from a previous intake Setting up cohort sync for a whole registered intake Bulk enrolment from a spreadsheet One-to-one or departmental training on the LMS Google sign-in and account problems for staff or students Accounts are created by Google sign-in. A colleague or student who has never signed in does not yet exist on the LMS and cannot be enrolled. Ask them to sign in once, then add them. Enrolment keys are yours to set and issue. ICT does not hold them and cannot give them to students. LMS Course & Enrolment Administration (ICT Staff) FOR ICT STAFF · lms.tangaza.ac.ke · Moodle with the eDash theme Roles, capabilities, enrolment methods and support procedures. This is the reference for administering course creation and enrolment on the University LMS. It is written for ICT staff who hold administrator accounts and who train and support academic staff. It assumes you already know your way around the Moodle administration tree. The companion page Adding Units and Enrolling Students covers the same ground from the lecturer's point of view. Scope Google OAuth sign-in and what it means for accounts and support How to add and create a course/unit - the administrator route and the lecturer route Granting course-creation rights to lecturers and institute administrators The roles that exist on this LMS and what each one is for Configuring the enrolment plugins site-wide and per unit Self enrolment, enrolment keys and group keys Bulk enrolment: cohort sync and CSV upload Diagnosing enrolment complaints The training points that come up most often 1 · Reaching the administration tree The eDash theme does not render a Site administration link in the left panel (the left panel only shows Profile, Grades, Calendar, Private files, Reports, Preferences). There are two ways in for an administrator: Click the red gear icon (⚙) at the top-right of the header, beside your profile picture. It is a shortcut straight into Site administration and only appears for accounts that hold site-configuration rights. Or go directly to the address https://lms.tangaza.ac.ke/admin/search.php On any admin page the full tree appears in the right-hand Administration block and across the top tab bar: General, Users, Courses, Grades, Plugins, Appearance, Server, Reports, Development. Throughout this document a path written as Site administration → Plugins → Enrolments means: reach the tree by either method above and follow those links. Why lecturers never see this: Moodle automatically filters the administration tree by capability. An account without moodle/site:config only ever sees the sections its role grants - so a lecturer sees no gear and no admin tree at all. That is by design, not a fault. Do not try to "restore" the gear for lecturers; grant them course creation at category level instead (Section 5). 2 · Authentication: Google sign-in only The LMS authenticates through Google OAuth 2 and nothing else. There is no local Moodle username and password for staff or students, and no LMS-side password to reset. Every account is a Tangaza Google Workspace account, so LMS access follows Workspace: suspend the Workspace account and LMS access stops at the next sign-in attempt. 2.1 Where it is configured Setting Where What to check OAuth 2 authentication plugin Plugins → Authentication → Manage authentication Enabled. Manual accounts cannot be disabled in Moodle and stay present for the emergency administrator account. The Google service Server → OAuth 2 services Client ID and secret, and that the service still shows as configured. An expired or rotated secret takes the whole site offline for logins. Allowed domains The Google service → edit Set to tangaza.ac.ke so a personal Gmail cannot create an account. Prevent account creation when authenticating Manage authentication, common settings Decides whether a first-time Google sign-in provisions an account automatically or is refused. Allow users to link their login Plugins → Authentication → OAuth 2 Leave off unless you have a specific reason — it lets an existing account attach a Google identity. Keep a documented emergency route to a site administrator account that does not depend on Google. If the OAuth credentials fail or the consent screen is withdrawn, nobody - including you - can sign in through the normal page. 2.2 What this changes for support There are no LMS password resets. Every login failure is a Google Workspace matter. Do not troubleshoot it inside Moodle. The email address is the join key. The address on the Moodle account must match the Google account exactly. A mismatch does not fail - it silently creates a second, empty account. Personal Gmail sign-ins are the commonest ticket: the user lands in a brand-new account with no units and reports that their work has vanished. Setting Allowed domains prevents it outright. Duplicate accounts: correct the email on the account that holds the submissions and suspend the empty one. Never delete the account with the work in it. Offboarding happens in Workspace, not in Moodle. Suspending the Google account is what actually removes access. 2.3 Accounts must exist before they can be enrolled An account is created the first time a person signs in with Google. Until then they do not appear in the user selector, and a lecturer trying to enrol a colleague or a late student will report that the person "is not on the system". Two ways round it: Ask the person to sign in once, then enrol them. Simplest for one or two people. Pre-create the accounts by CSV upload with the auth field set to oauth2, so a whole intake can be enrolled before teaching starts. See Section 10.2. 3 · The roles on this LMS These are the custom roles defined on lms.tangaza.ac.ke, with the descriptions as they appear on the site. Use these names — not the generic Moodle names — when granting access or answering a ticket. Role Description (as on the site) Typical holder LMS Developer Overall main LMS Admin; manages the entire LMS, curates courses and troubleshoots issues on the LMS. ICT lead / super-administrator ICT Staff Admin Can access courses and modify them, but usually do not participate in them. ICT support staff Institute Admin Can do anything within a course, including changing the activities and assigning students to courses. School / Institute administrators Lecturer Can create new courses, assign students and view reports. Lecturers and programme leaders Student Standard learner access within enrolled units. Students On this site the Lecturer role is the course-creator role: it carries moodle/course:create. Granting a lecturer the ability to create units means assigning them the Lecturer role in the right category (Section 5), not giving them any part of Site administration. 4 · How to add and create a course/unit A unit is created inside the category it belongs to. On this LMS the top-level categories are the Institutes (Center for Leadership and Management (CLM), Institute of Communication, Journalism and Media Studies (ICJMS), Institute of Youth Studies (IYS), Institute for Social Transformation (IST), and so on), each with the sub-categories Bachelors, Masters, Diploma, PHD. There are two routes to the create screen depending on who you are. 4.1 Administrator route (ICT staff) Open Site administration (gear icon or /admin/search.php) → Courses → Manage courses and categories. In the left Course categories column, click the category the unit belongs to — the Institute, then the sub-category (e.g. CLM → Bachelors). In the right-hand panel, click Create new course. Fill in the course settings (see 4.3) and click Save and display. On the enrolment screen that follows, add the lecturer(s) as Teacher. From the same page you can also Create new category, move courses between categories, and upload courses in bulk. 4.2 Lecturer route (no admin access needed) A lecturer who holds the Lecturer role in a category (Section 5) does not use Site administration at all: Sign in and click Institutes in the top menu. Open the relevant Institute, then drill down to the sub-category (e.g. Bachelors) where the unit belongs. At the bottom of that category's course list, click Create a new course. Fill in the settings (4.3) and save. If the Create a new course button is not on the category page, the lecturer has not been assigned the Lecturer role in that category — grant it as in Section 5. (Note: because the site uses the customised eDash category layout, always confirm the button appears for a real lecturer after granting the role; if the capability is present but the button is still missing, the cause is the theme template, not the permission.) 4.3 Course settings that matter Field What to enter Course full name The unit title, formatted CourseCode | Course Full Name | Period, e.g. TDCT1104 Fundamentals of Coding 2025-2026A. Course short name The unit code in capitals with a single space, e.g. ISTP 701. Must be unique site-wide; add the intake where a code repeats (ISTP 701 2026S1). Course category The Institute → sub-category the unit belongs to. This decides who can find and help manage it. Start / End date First and last teaching day. In Weekly format the start date drives week numbering. Course format Weekly for a fixed timetable, Topics for theme/module organisation. Course visibility Leave on Hide while building; set to Show when ready to publish. 5 · Granting course-creation rights University policy is that lecturers, programme leaders and institute administrators may create units. The mechanism is always the same: assign a role that carries moodle/course:create at the category the person is responsible for — never at the whole site. 5.1 Which role, and where Person Assign role At What they get Lecturer Lecturer Their programme sub-category Create units in that category; teach units they are enrolled in Programme leader Lecturer (or Institute Admin if they must also manage colleagues' units) Their programme category Create units; with Institute Admin, edit and manage across the programme School / Institute administrator Institute Admin Their Institute category Create, edit, enrol and manage across the whole Institute ICT staff ICT Staff Admin / LMS Developer System Site-wide administration Do not assign Lecturer or Institute Admin at system level. A category-carrying role assigned at System applies everywhere and also surfaces a filtered Site administration → Courses entry for that user — which is exactly the "why can a lecturer see /admin" problem. Category-level assignment keeps the estate tidy and keeps lecturers out of the admin area. 5.2 Assigning it (exact path) Site administration → Courses → Manage courses and categories. Click the category concerned (e.g. Center for Leadership and Management (CLM), or a sub-category for tighter scope). In the secondary navigation bar, open More ▾ → Permissions. On the Permissions page, use the grey Permissions ▾ dropdown and choose Assign roles. Click the Lecturer role (or Institute Admin). In the right-hand Potential users box, search for the person, select them, and click ◄ Add so they move to Existing users. Assigning at a parent category cascades to its sub-categories. Assigning several people at once: in the Potential users box you can hold Ctrl (or Cmd) and click multiple names, or Shift-click a range, then Add them together. For a genuinely large intake, put the lecturers in a cohort and either add them from the cohort or (if the local_cohortrole plugin is installed) have cohort membership grant the Lecturer role in the category automatically. Core Moodle has no CSV upload for category-level role assignment — the CSV Upload users tool only assigns system roles. 5.3 The capabilities behind it Useful when debugging a "the button is not there" report. Check with Site administration → Users → Permissions → Capability overview, or the Check permissions link in the category or unit. On this site the Lecturer role is configured to allow the following (course deletion is deliberately left off). Capability Controls moodle/course:create The Create new course button in a category moodle/course:update Editing the settings of an existing unit moodle/course:manageactivities Adding, editing and deleting activities and resources moodle/course:managefiles Managing files in the unit moodle/course:activityvisibility Hiding / showing activities moodle/course:visibility Setting a unit to Show or Hide moodle/course:viewparticipants Seeing the participant list of the unit moodle/course:enrolreview Reviewing the unit's enrolments moodle/course:enrolconfig Adding and configuring enrolment methods in a unit enrol/self:config Editing the self enrolment method, including the key enrol/manual:enrol Adding users manually to a unit moodle/role:assign Choosing which role an enrolled user receives moodle/category:manage Creating and editing categories moodle/course:delete Deleting a unit (kept OFF for lecturers — deletion destroys submissions) moodle/site:config Full Site administration (ICT roles only; never for lecturers) 6 · Category structure Enrolment problems are very often category problems, so keep the tree predictable: Institute → Sub-category (Bachelors / Masters / Diploma / PHD) → Units Delegate rights at sub-category (programme) level for lecturers, and at Institute level for institute administrators. Hiding a category hides every unit inside it, whatever each unit's own visibility says. This is the second most common cause of "students cannot see my unit". Archive an intake by moving its category rather than deleting units. Deleting a unit destroys submissions and grades irreversibly. 7 · Enrolment plugins, site-wide 7.1 Which plugins are enabled Site administration → Plugins → Enrolments → Manage enrol plugins. The eye icon controls each one. A plugin disabled here cannot be used by any unit, however that unit is configured. Plugin State Note Manual enrolments Enabled Required. Staff enrolment depends on it. Self enrolment Enabled The method this guide is mostly about. Cohort sync Enabled Needed for whole-intake enrolment. Guest access Disabled by default Enable per unit only on request. See 9.4. Category enrolments Disabled Deprecated behaviour; do not use. 7.2 Site defaults for self enrolment Site administration → Plugins → Enrolments → Self enrolment. These values are inherited by units created afterwards; they do not change units that already exist. Setting Set to Reason Add instance to new courses Yes Every new unit has the method ready, so lecturers only switch it on. Allow self enrolments No The method exists but is closed until the lecturer opens it. Fails safe. Use enrolment key Yes New units default to key-protected rather than open to the whole University. Default role assignment Student A self-enrolling user must never receive a teaching role. Enrolment duration Unlimited Semester length is better controlled by the unit end date. Max enrolled users 0 No cap by default; lecturers set one if they need it. Send course welcome message Yes Gives the student written confirmation and cuts support calls. 8 · Self enrolment on a single unit 8.1 Where it lives Unit → Participants → change the dropdown from Enrolled users to Enrolment methods. The eye icon activates or suspends a method; the gear icon opens its settings; the bin deletes it along with everyone it enrolled. 8.2 Every setting, and what it actually does Setting Effect Custom instance name Replaces the words "Self enrolment" on the student-facing panel. Useful for labelling intakes. Allow existing enrolments No suspends everyone who joined by this method without removing them or their work. The correct way to freeze a class. Allow new enrolments The master switch for joining. No means nobody new gets in whatever the key says. Enrolment key Blank means anyone with an account may join. A value restricts entry to those who know it. Case sensitive. Use group enrolment keys Yes makes Moodle test the typed key against every group key in the unit as well as the master key. Default assigned role The role granted on joining. Must be Student. Start date / End date The window during which joining is possible. The cleanest way to close enrolment after add-drop. Max enrolled users Caps the class. When reached, the enrolment panel disappears with no explanation to the student. Only cohort members Restricts self enrolment to members of a named cohort. Combine with a key for tight control. 8.3 Group enrolment keys Two conditions must both hold, and the second is the one people miss: Each group has its own key, set in the group settings under Participants → Groups. The self enrolment method itself has Use group enrolment keys set to Yes AND a master key in its own Enrolment key field. Without a master key, group keys are ignored entirely. Behaviour: the master key admits the student to the unit with no group; a group key admits them to the unit and places them in that group. 9 · Bulk and alternative enrolment 9.1 Cohort sync - preferred for whole intakes A cohort is a named list of users maintained centrally. Synchronising it into a unit enrols everyone on the list and removes them when they leave the cohort. It does not depend on a key being circulated correctly, which makes it the right answer for registered intakes. Site administration → Users → Accounts → Cohorts → Add new cohort. Name it for the intake, e.g. MA Peace Studies Sep 2026. Add members, individually or by uploading a CSV of usernames on the Assign screen. In each unit: Participants → Enrolment methods → Add method → Cohort sync. Select the cohort, set Assign role to Student, and save. Removing a user from the cohort removes them from every unit synced to it. Suspend rather than remove where a record of submitted work must be kept. 9.2 CSV upload Site administration → Users → Accounts → Upload users. Creates accounts and enrols them in one pass. Minimum useful columns: Column Contents username Lower case, no spaces. Match the convention already in use on the site. firstname / lastname As registered. email Must be unique across the site, and must match the person's Google account exactly. auth Must be oauth2. Accounts authenticate through Google, so no password column is used. course1, course2, … The unit SHORT name, exactly as it appears in the unit settings. role1, role2, … student, editingteacher or teacher. group1, … The group name, which must already exist in that unit. cohort1 The cohort ID number, to add the user to a cohort. Always run the preview step and read the report before committing. Save the file as UTF-8 CSV. Excel's default encoding mangles accented names. Keep the source spreadsheet. It is your audit trail if an intake has to be reversed. 9.3 Manual enrolment Unit → Participants → Enrol users. The right tool for staff, for a handful of latecomers, and for anyone who must be given a non-student role. It is also the only method that lets you set an individual enrolment start date and duration. 9.4 Guest access is not enrolment Guests are not participants. They can read but cannot submit, post, be grouped or be graded, and they leave no record. Enable it only for genuine showcase units, and never as a shortcut when self enrolment is misbehaving. 10 · Diagnosing enrolment complaints Work down this list in order. The cause is almost always in the first three rows. Symptom Check Fix Students cannot see the unit Unit visibility, then category visibility Settings → Course visibility → Show. Unhide the category if needed. Unit visible, no enrolment panel Is Self enrolment present and active, and Allow new enrolments = Yes? Activate the method; set Allow new enrolments to Yes. Panel present, key refused Reveal the key with the eye icon; ask whether the student pasted it Re-issue the key. Advise typing rather than pasting. Group keys ignored Master key present on the method? Add a master key to the self enrolment method itself. Panel vanished for later students Max enrolled users, and the method End date Raise the cap or extend the window. Everyone in the University joined Key field left blank Set a key, then remove those who should not be there. Self enrolment missing from Add method Plugin disabled site-wide Manage enrol plugins → enable Self enrolment. Staff member has no Create new course button Role assigned at the category, not the site? Assign Lecturer (or Institute Admin) at the correct category. A setting change had no visible effect Caching Site administration → Development → Purge caches, then re-test in a private window. A user is not in the enrol selector They have never signed in, so no account exists Ask them to sign in once with Google, or pre-create by CSV with auth = oauth2. "All my units have disappeared" Signed in with a personal Gmail; they are in a new empty account Sign out fully, sign in with the tangaza.ac.ke address. Suspend the stray account. One user has two accounts Email mismatch between Moodle and Google Fix the email on the account holding the work; suspend the empty one. Nobody at all can sign in OAuth client secret expired, consent withdrawn, or the service misconfigured Server → OAuth 2 services. Use the emergency administrator route while you fix it. Who did what, and when Site administration → Reports → Logs, filtered to the unit Enrolment events are logged with actor, target and timestamp. 11 · Standing training outline The points below generate repeat support calls. Cover all of them in every staff induction session. Point Why it matters Show and enrolment are two separate switches Half of all "students cannot get in" tickets are one of the two left undone. Short names must be unique and carry the intake Duplicate short names block course creation and confuse searching. Category placement decides who can find the unit Units created in the wrong category are effectively lost. A blank key is not a closed unit Staff routinely clear the key intending to close enrolment — it opens the unit to everyone. Change the key every intake Old keys circulate between year groups indefinitely. Group keys need a master key too The single most common misconfiguration. Suspend rather than delete Deleting an enrolment destroys submissions and grades. Import, do not rebuild Saves a day of work per unit each semester. ICT does not hold enrolment keys Sets student expectations and stops keys leaking through the service desk. Login is Google only, with no LMS password Stops staff sending students to a password reset that does not exist. A person must sign in once before they can be enrolled Explains most "this person is not on the system" reports. 12 · Quick reference To do this Go here Reach the admin tree on eDash Gear icon (top-right) or lms.tangaza.ac.ke/admin/search.php Grant course-creation rights Manage courses and categories → category → More → Permissions → Assign roles Create a unit (admin) Manage courses and categories → category → Create new course Create a unit (lecturer) Institutes → Institute → sub-category → Create a new course Enable or disable an enrolment plugin Plugins → Enrolments → Manage enrol plugins Set defaults for all new units Plugins → Enrolments → Self enrolment Configure a unit's enrolment Unit → Participants → Enrolment methods Set or reveal an enrolment key Unit → Participants → Enrolment methods → Self enrolment (gear) Create a cohort Users → Accounts → Cohorts Bulk create and enrol from CSV Users → Accounts → Upload users See who enrolled whom Reports → Logs Check the Google login service Server → OAuth 2 services Purge caches Development → Purge caches 13 · Known issues & quirks on this LMS Findings from setup and testing (as of August 2026). Keep this list current as items are fixed. Issue Detail & workaround Status “Create a new course” button hidden on category pages Lecturers do hold moodle/course:create (verified — /course/edit.php?category=76 opens the create form for a lecturer), but the eDash category template does not render the button, so lecturers cannot self-create from the category page and were falling back to /admin. Workarounds: the direct link /course/edit.php?category=ID, the Site administration route, or Course requests. Permanent fix: a child-theme renderer override that adds a capability-guarded button (see the separate developer hand-off). Open - theme fix pending No Site administration link in the left panel eDash does not show it in the left nav. Reach the tree via the red gear (top-right, admins only) or /admin/search.php. Lecturers never see it — Moodle capability-filters the admin tree, by design. By design Edit mode toggle sits bottom-left eDash places the Edit mode switch at the bottom-left of the page, not top-right as in stock Moodle 4. A common “where is Edit mode?” question from staff. By design (theme) Teaching role is “Lecturer” This site uses custom roles: LMS Developer, ICT Staff Admin, Institute Admin, Lecturer, Student. There is no stock “Teacher” / “Non-editing teacher”. Use Lecturer when enrolling teaching staff. By design Assign course roles at category level, not system A Lecturer or Institute Admin role assigned at System level applies everywhere and surfaces a filtered Site administration → Courses entry for that user (the “why can a lecturer reach /admin” problem). Always assign at the category. Guidance Front-end menus / blocks cannot be role-gated Custom menu items and HTML blocks show to all users, including students. A create-course button therefore cannot be added, restricted to staff, from the admin UI — it requires the theme/plugin code change. Moodle limitation eDash theme settings are cosmetic only The eDash settings page covers logos, colours, banners and login/social/footer — nothing for course creation or menus. Not the place to look for the button fix. Note No bulk category-level role assignment in core The Assign roles screen is multi-select only (Ctrl / Shift-click). CSV Upload users assigns system roles only. For true bulk category-level assignment, install local_cohortrole — cohort membership then grants the role in a chosen category automatically. Moodle limitation Course requests: enabled enablecourserequests is on; staff can request a unit at /course/request.php. Approvers need moodle/site:approvecourse. Confirm a default request category and a notification recipient are set so requests are not missed. Active Lecturer role missing teaching capabilities (empty activity chooser) The Lecturer role was built from the Course creator archetype, so it can create a course shell but lacks the editing-teacher capabilities: add activities/resources (0/26), grading (0/49), question bank (0/18), enrolment (1/37), reports (0/18), backup/restore/import (1/19). Symptom: the Add an activity or resource chooser opens empty and throws toggleFocusableChooserOption … querySelector null. Fix: reset the role to the Teacher (editing) archetype and re-add course creation — see Section 14. Fix documented (Section 14) Maintained by the ICT Department. LMS support and academic staff training: Maureen and Onesmus. 14 · Fixing the Lecturer role — adding teaching capabilities The "Lecturer" role was created from the Course creator archetype, which lets a person create a course but not teach in one. So lecturers can make an empty unit but cannot add activities, grade, enrol students, use the question bank, run reports, or import a previous unit. The tell-tale symptom is the Add an activity or resource dialog opening empty with a JavaScript error. 14.1 What the role has versus needs Capability area Granted / total Add an activity or resource ( mod/*:addinstance) 0 / 26 Grading & gradebook 0 / 49 Question bank 0 / 18 Enrolment 1 / 37 Reports 0 / 18 Backup / restore / import 1 / 19 It does already have: create a course, edit settings, manage files, set visibility, turn on Edit mode and reorder existing items, view participants, and review enrolments. 14.2 The fix — reset to editing-teacher, then re-add create Site administration → Users → Permissions → Define roles → click Lecturer. The role page has Edit and Reset buttons. Do these in order — order matters, because Reset uses whatever archetype is currently set. Set the archetype. Click Edit, change Role archetype from "Course creator" to Teacher (editing), then Save changes. (This alone does not change any capability — it only tells Reset which defaults to use.) Reset. Back on the role page, click Reset and confirm. This applies the full editing-teacher set: add activities, grading, question bank, enrolment, reports, backup/restore/import, groups and sections. Re-add what Reset drops. Click Edit again. In the Filter box, tick Allow on moodle/course:create and moodle/category:viewcourselist (and moodle/course:request if you use course requests). Then scroll to Context types where this role may be assigned and make sure Category is still ticked — the reset usually unticks it (editing teachers default to Course + Activity), and you need Category for the category-level create assignment. Save changes. Test. As a lecturer, open a course → Add an activity or resource → the chooser should be full, and grading, enrolment and import should now work too. Two cautions. This edits the Lecturer role site-wide, so it affects every lecturer at once. And because one role now does both jobs, anyone assigned at a category gets editing-teacher power over every course in that category — if that is too broad for shared categories, enrol lecturers as Lecturer in their own course for teaching and reserve category-level assignment for the create right only. Running Online Classes with BigBlueButton IN THIS GUIDE 📖 The words used here 📘 Part 1 · Creating a room for your unit ⚙️ Part 2 · The settings that matter 📅 Part 3 · Scheduling the class in Google Calendar ▶️ Part 4 · Running the session 🎥 Part 5 · Recordings 🎓 Part 6 · Running the class from inside the LMS ✅ Start-of-semester checklist 🛠 If something goes wrong 💬 Support 📖 The words used here Room A permanent online classroom with its own link. One unit, one room. Session One live class held in that room. The room is reused; each session is separate. Moderator Can start the session, mute others, share the screen and record. You. Viewer Can watch, speak when unmuted, and use chat. Your students. Access code A short code typed once when joining. Optional, and separate from signing in. Recording A saved copy of a session. Recordings belong to the room, not the session. 📘 Part 1 · Creating a room for your unit 1.1 Sign in Go to bbb.tangaza.ac.ke and click Sign in. You will be sent to the University sign-in page and then to Google. Use your tangaza.ac.ke account. Personal Gmail accounts are refused. Your account is created the first time you sign in. A colleague who has never signed in does not exist on the system yet and cannot be added to anything. 1.2 Create one room per unit You start with a single room named after you. Do not use it for everything a lecturer teaching two units at the same hour will collide with themselves, and students will see the wrong class. Click + New Room. Name it after the unit, using the unit code first: ISTP 701 Foundations of Peacebuilding. Click Create Room. Repeat for each unit you teach. If + New Room does nothing, you have reached your room limit. Ask ICT to raise it rather than deleting a room you still need. 1.3 Naming Same discipline as the LMS, for the same reason. Lead with the unit code, then the unit name: ISTP 701 - Foundations of Peacebuilding. Add the intake where a code repeats across semesters. ⚙️ Part 2 · The settings that matter Open the room and go to the Settings tab. Set these once, when you create the room. Setting Set to What it does Require users to be signed in before joining On Only people with a Tangaza account can enter your class. Standard for all teaching rooms. Allow any user to start this meeting Off Students cannot open the room. They wait until you start the class. Leave this off. Mute users when they join On Stops forty microphones opening at once. Require moderator approval before joining On for exams, vivas and interviews A waiting room - you admit each person yourself. Too slow for a normal class. All users join as moderators Off On would let any student mute you or end the class. Allow room to be recorded Your choice Enables the record button during the session. It does not record automatically. ⚠️ Require users to be signed in before joining is the setting that keeps your classroom to Tangaza people. Without it, anyone holding the link can walk into your class without identifying themselves. Turn it on. 2.1 Access codes On the same tab you can generate an access code for viewers. Use one for anything sensitive - an exam, a viva, a staff meeting. Put the code in the Calendar invitation, never in a public timetable. Change it each intake, exactly as you change an LMS enrolment key. 📅 Part 3 · Scheduling the class in Google Calendar BigBlueButton has no calendar of its own. Google Calendar supplies the schedule, the invitation and the reminder; the room supplies the address. Open the room and click Copy Join Link. In Google Calendar, create an event for the class. Set the day and time, and set it to repeat weekly for the semester. Paste the link into Location. Paste it into Description too, with the access code if you set one. Add your class under Guests, or invite the class Google Group. Save and send the invitations. Wording that prevents most first-week questions: Join the class here: [link] Access code: [code, if any] Sign in with your Tangaza email - personal Gmail will not work. The room opens when the lecturer starts the class. If you arrive early you will see a waiting screen; keep the tab open. Do not use Google Calendar's Add Google Meet video conferencing button. It creates a second, different meeting and half your class will end up in the wrong one. ▶️ Part 4 · Running the session Open bbb.tangaza.ac.ke a few minutes before the class. Open the unit's room and click Start Meeting. Students waiting on the link enter automatically once you do. Choose Microphone when asked, and run the echo test. To record, click Start recording at the top of the meeting. Tell the class you are recording. Share slides with the + button, or upload them beforehand on the room's Presentation tab. End the class from the ⋮ menu → End meeting. Closing the browser tab leaves the session running without you. 4.1 Sharing a room with a colleague The Access tab lets you share the room with a co-lecturer, so either of you can start the class. Do this wherever one person being stuck in traffic would cancel a session. 🎥 Part 5 · Recordings Recordings appear on the room's Recordings tab a few minutes after the session ends - a long class can take longer to process. Because recordings belong to the room, every week of the semester lands in the same list. Rename each one as soon as it appears: ISTP 701 - Week 3 - 8 Sep 2026. Leave it a month and nobody will know which is which. Each recording can be set Public or Unlisted. Unlisted means only people with the link can watch. Share the link through the LMS unit, not on a public page. FOR LECTURERS AND SCHOOL ADMINISTRATORS · bbb.tangaza.ac.ke Creating a room, scheduling the class in Google Calendar, and running the session. ℹ️ New here? Work top to bottom the first time create a room for your unit, set it up once, then schedule it in Calendar. After that you only ever do Part 3 and Part 4. Tangaza University runs its own online-class system at bbb.tangaza.ac.ke. It is not Zoom and it is not part of the LMS, but it is where live classes happen. You sign in with the same Tangaza Google account you use for the LMS and for email there is no separate password. One thing to understand before you start. A room is a permanent address, not a single meeting. The same link works all semester, every week, for that unit. Nothing happens inside it until you press Start Meeting. That is why the schedule lives in Google Calendar and the room lives here. 🎓 Part 6 · Running the class from inside the LMS Instead of pasting a link into Google Calendar, you can add the class as an activity inside your Moodle unit at lms.tangaza.ac.ke. Students click it from the course page like any other activity, and the session appears in the course calendar automatically. ℹ️ This is the better option for a taught unit. You get open and close times, the session in the Moodle calendar, and recordings listed in the course. Use Google Calendar (Part 3) for meetings that are not tied to a unit — staff meetings, interviews, supervision. 6.1 Add the activity Open your unit on lms.tangaza.ac.ke and switch on Edit mode. In the week or topic where the class belongs, click Add an activity or resource. Choose BigBlueButton. Give it a name students will recognise: Week 3 Live Class — Conflict Analysis. Use the description for anything they should prepare beforehand. The integration is switched on and pointed at the University’s own server, so the activity is there for every unit. If you cannot see BigBlueButton in the list, check that Edit mode is on before contacting ICT. 6.2 Set the schedule This is the part Google Calendar cannot do. In the activity settings, open Schedule for session: Setting What it does Join open The earliest students may enter. Set it 5 or 10 minutes before the class. Join closed After this time the link stops working. Useful for a class nobody should wander into three days later. Both dates appear in the Moodle calendar and in students' upcoming-events block, so you are not relying on anyone reading an email. 6.3 Room settings, the LMS equivalents The same protections from Part 2, under different names: In the LMS activity Set to Same as Wait for moderator Yes Allow any user to start this meeting being off Session can be recorded Your choice Allow room to be recorded Mute all participants on join Yes Mute users when they join Role assigned during live session Lecturer → Moderator, Student → Viewer Moderator and viewer roles You do not need an access code here. Only people enrolled in the unit can see the activity, so enrolment is the access control — which is why this route is safer than a link that can be forwarded. 6.4 Recordings Recordings from an LMS session are listed on the activity itself, inside the unit, visible only to that class. No copying links, and no risk of sending Week 3 to the wrong cohort. 6.5 Which route to use Use the LMS activity when Use Google Calendar when It is a taught unit with enrolled students The meeting is not tied to a unit You want open and close times You are inviting people from outside the unit You want recordings kept with the course Attendees are staff, or external guests You would rather students never handle a link A one-off: interview, viva, supervision, staff meeting ✅ Start-of-semester checklist # Check 1 A room exists for each unit you teach, named with the unit code 2 Require users to be signed in before joining is On 3 Allow any user to start this meeting is Off 4 Mute users when they join is On 5 An access code is set, if the unit needs one, and it is new this intake 6 A co-lecturer has been given access to the room 7 The Calendar event repeats for the whole semester 8 The join link is in both Location and Description 9 The link is also posted in the LMS unit 10 You have run one test session with audio before week one 🛠 If something goes wrong Students report Cause Fix "It says the meeting has not started" Normal. You have not pressed Start Meeting yet. Nothing. They enter automatically when you start. They are refused at sign-in They used a personal Gmail Sign out of Google completely, sign in again with the tangaza.ac.ke account. An empty class started without you Allow any user to start this meeting is On Turn it off on the room's Settings tab. Strangers joined the class Sign-in not required, and the link has been shared Turn on Require users to be signed in before joining and set an access code. Nobody can hear the lecturer Joined as Listen only, or the wrong microphone Leave the audio, rejoin with the headphone icon and choose Microphone. The recording has not appeared Still processing Wait - a two-hour class can take a while. If it is missing the next day, contact ICT. The recording does not exist at all Recording was never started, or the room does not allow it Recording is a button you press each session. It is never automatic. The class ran on after the lesson The tab was closed instead of ending the meeting Always use ⋮ → End meeting. 💬 Support Online-class support is provided by ICT. Contact them for: Raising your room limit if you teach many units Rooms for graduations, guest lectures and other large events Recordings that have not appeared, or need removing Google sign-in problems for staff or students Accounts are created by signing in. A colleague or student who has never signed in cannot yet be given access to a room — ask them to sign in once, then add them. Access codes are yours to set and issue. ICT does not hold them and cannot give them to students. BigBlueButton Administration (ICT Staff) FOR ICT STAFF · bbb.tangaza.ac.ke · BigBlueButton 3.0 with Greenlight and Keycloak How the online-class system is put together, who can sign in, and what to do when it breaks. ℹ️ Lecturer-facing instructions are in Running Online Classes with BigBlueButton. This page is the administrator's side: sign-in policy, roles, and server operations. IN THIS GUIDE 🧩 How the system fits together 🔐 Part 1 · Who can sign in 👤 Part 2 · Roles, room limits and users 🎨 Part 3 · Site settings and branding 🖥 Part 4 · Server operations ⚠️ Part 5 · The upgrade rule 🎓 Part 6 · The LMS integration 🛠 Troubleshooting 💬 Escalation 🧩 How the system fits together Four moving parts. Knowing which one is broken saves most of the diagnosis time. Part What it is Where BigBlueButton The meeting engine - audio, video, screen share, recording. Installed on the server itself Greenlight The website staff and students see: rooms, recordings, settings. Docker container Keycloak The sign-in broker. Passes staff to Google and enforces the domain rule. Docker container, at /keycloak Google Workspace Where the account actually lives. Same account as email and the LMS. Google A user signing in travels left to right: Greenlight → Keycloak → Google, and back again. A failure at any point looks the same to the user, so always establish which stage failed before changing anything. 🔐 Part 1 · Who can sign in Access is restricted to tangaza.ac.ke accounts by three independent controls. They are deliberately redundant — any one of them can be misconfigured without opening the door. # Control Where it is set 1 OAuth consent screen set to Internal Google Cloud Console, in the project that owns the OAuth client 2 Hosted Domain = tangaza.ac.ke Keycloak → realm greenlight → Identity providers → google 3 Allowed Domains = tangaza.ac.ke Greenlight → Administrator Panel → Site Settings → Registration ⚠️ Control 2 is the one that does the work. If Hosted Domain is ever cleared, any personal Gmail account can sign in and will look like a legitimate user. Check it after any Keycloak change. 1.1 Joining a class is separate from signing in Requiring a Tangaza account to have an account is not the same as requiring one to join a meeting. That second control lives on each room: Require users to be signed in before joining. It is off by default. Standard practice for teaching rooms is on - the lecturer guide says so. 1.2 Break-glass access The ordinary Sign in button goes to Keycloak. The original username-and-password form still exists at /signin. Keep exactly one local administrator account, with its password in the University password manager, for the day Keycloak or Google is unavailable. Do not use it for daily work. 👤 Part 2 · Roles, room limits and users Everything here is under Administrator Panel (top-right menu → Administrator Panel). Task Where Promote someone to Administrator Manage Users → the user → Role Raise how many rooms a role may create Roles → the role → Room Limit Assign roles automatically by email suffix Site Settings → Registration → Role Mapping Stop self-registration of local accounts Site Settings → Registration → Registration Method → Invite ⚠️ Role Mapping applies only when an account is first created. Set it before a group of new staff sign in, not after — existing accounts keep whatever role they already have, and you will be promoting people by hand. Roles cannot be read from Google or Keycloak. Email-suffix mapping is the only automatic mechanism available. 2.1 Lecturers who teach many units One room per unit is the documented convention, so a lecturer with six units needs six rooms. If they report that + New Room does nothing, raise the Room Limit on their role rather than telling them to share one room. 🎨 Part 3 · Site settings and branding Administrator Panel → Site Settings controls the whole site: the Tangaza crest, the primary colour, links to the University's acceptable-use policy and privacy policy, and the maintenance banner. The maintenance banner is the fastest way to tell everyone something — use it before planned downtime and clear it afterwards. Host the crest on this server rather than an external site, so branding does not break when something outside the University moves. 🖥 Part 4 · Server operations Greenlight, Keycloak, PostgreSQL and Redis run as Docker containers from a single directory on the server. BigBlueButton itself runs as ordinary system services managed with bbb-conf. Task Command See what is running docker compose ps in the Greenlight directory Greenlight logs docker compose logs --tail 100 greenlight-v3 Restart Greenlight docker compose up -d --force-recreate greenlight-v3 Check BigBlueButton bbb-conf --check Restart BigBlueButton bbb-conf --restart Confirm the API is healthy curl -s https://bbb.tangaza.ac.ke/bigbluebutton/api — expect SUCCESS ℹ️ After restarting Greenlight the site returns 502 Bad Gateway for 60 to 90 seconds while it rebuilds its assets. This is normal. Wait for Listening on in the logs before concluding anything is wrong. 4.1 Before you change anything Take a database backup first. It covers Greenlight's rooms and recordings index and Keycloak's realm in one file, and it is the only thing that makes a bad change reversible. ⚠️ Part 5 · The upgrade rule 🚫 Never run apt upgrade on this server without immediately running bbb-conf --restart afterwards. BigBlueButton is a dozen coupled services. A package upgrade replaces their program files on disk but leaves the old processes running against files that no longer exist. The result is a server that looks completely healthy - every service shows as active, the website loads, users can sign in - while every attempt to start a meeting fails with an internal server error. This has already happened once, on 14 August 2026. Diagnosis took far longer than the fix, which was a single restart. Plan operating-system upgrades as maintenance windows, and reboot afterwards if the kernel, glibc, OpenSSL or Docker were among the packages upgraded. 🎓 Part 6 · The LMS integration Lecturers can add a live class as an activity inside a Moodle unit, giving them open and close times, calendar entries and recordings kept with the course. This is already configured and working. What follows is the current state, plus what to do if it ever has to be rebuilt. 6.1 Current state Checked 15 August 2026 on lms.tangaza.ac.ke: Item Value Assessment Plugin mod_bigbluebuttonbn, enabled ✅ Server URL https://bbb.tangaza.ac.ke/bigbluebutton/ ✅ our server, not the public demo Shared secret Set ✅ Checksum algorithm SHA1 Works. SHA256 is stronger — change both ends together if you switch. Activities in courses 1 Configured, but barely used yet Plugin release 3.0.9 (version 2021101017) ⚠️ see 6.2 6.2 Known issue: the plugin is the old contributed one ⚠️ Every other activity module on the LMS reports version 2025041400, matching Moodle 5.0. BigBlueButton reports 2021101017 — release 3.0.9, published October 2021. Moodle core's own BigBlueButton module has been displaced by the older Blindside Networks contributed plugin of the same name. Why it matters: the plugin is around four and a half years older than the Moodle it runs on. It misses upstream fixes, sits outside Moodle's testing for this release, and is a likely casualty of the next Moodle upgrade. Why now is the moment: one activity exists across all courses. The blast radius will never be smaller than this. After a semester of lecturers using it, this becomes a much bigger job. The fix, in outline — maintenance window, database and moodledata backup first: Record the current server URL and shared secret. Find the one existing activity and its course, so you can test it afterwards. Replace mod/bigbluebuttonbn with the copy from the matching Moodle 5.0 release package. Run the upgrade at Site administration → Notifications. Re-check the server URL and secret rather than assuming they survived. Test the existing activity, then a fresh one in a sandbox course. 6.3 Rebuilding the integration from scratch Get the values from the BigBlueButton server: bbb-conf --secret Then in the LMS, Site administration → Plugins → Activity modules → BigBlueButton: Setting Value BigBlueButton Server URL https://bbb.tangaza.ac.ke/bigbluebutton/ — keep the trailing slash BigBlueButton Shared Secret The Secret line from bbb-conf --secret 🚫 A fresh Moodle points this at Blindside Networks' public test server. Sessions created before it is changed run on someone else's infrastructure with a 60-minute cap. Check this setting after any Moodle rebuild or restore. ⚠️ The shared secret is a credential, not a setting. Anyone holding it can create, join and end meetings on our server. It is the same secret Greenlight uses. If exposed, rotate it with bbb-conf --setsecret and update both the LMS and Greenlight — changing one breaks the other. 6.4 Which route should lecturers use Route Best for Access control LMS activity Taught units with enrolled students Course enrolment — strongest, nothing to forward Greenlight room + Google Calendar Staff meetings, interviews, supervision, guests Sign-in requirement and access code Sessions started from the LMS still run on this server and still consume its capacity. The integration changes who schedules a class and how students reach it, not where it runs. 6.5 The LMS itself The LMS runs Moodle 5.0 (Build 20250414). Point releases to 5.0.9 have since been published carrying security fixes, and Moodle's notifications page also flags development directories ( /vendor, /node_modules) present on the public site. Both are LMS-side jobs rather than BigBlueButton ones, but they affect the same service as far as a lecturer is concerned. 🛠 Troubleshooting Symptom Likely cause Fix Site shows 502 Bad Gateway Greenlight is still starting Wait 90 seconds. If it persists, check the container logs. Site loads, but no meeting will start BigBlueButton API returning 500 — usually packages upgraded without a restart bbb-conf --restart, then confirm the API returns SUCCESS. Sign-in ends on "Invalid redirect uri" The Keycloak client is missing a redirect or post-logout URI Keycloak → Clients → greenlight → add the site address with a trailing /* to both fields. A personal Gmail account signed in Hosted Domain has been cleared Reset it on the google identity provider, then audit recently created users. A returning user has lost their rooms Their sign-in was not matched to their existing account Do not create them a new account — contact the Greenlight administrator, the accounts can be re-linked. New staff land on the wrong role Role Mapping was set after they first signed in Fix the role by hand in Manage Users, and correct the mapping for the next intake. Recordings never appear Recording processing has stalled Check disk space, then the recording services with bbb-conf --check. 💬 Escalation Before escalating, collect: what the user saw, their email address, the room name, the time, and whether curl -s https://bbb.tangaza.ac.ke/bigbluebutton/api returns SUCCESS. That last one separates "BigBlueButton is down" from everything else and is worth ten minutes of guessing. Sign-in problems that affect every user at once are almost always Keycloak or the Google OAuth client, not Greenlight. Setting Up Online CATs and Exams FOR LECTURERS AND SCHOOL ADMINISTRATORS · lms.tangaza.ac.ke Building timed CATs and exams on the LMS, and what can honestly be done about students switching tabs. ℹ️ New here? Build the question bank first (Part 1), then the quiz. Parts 2 to 4 are the settings every CAT needs. Part 5 is the one people ask about most, and the one with the most misunderstanding around it. A CAT on the LMS is a Quiz activity. Moodle's quiz is capable of running a serious timed assessment, but it runs inside a web browser on a device the University does not control — and that single fact shapes everything below. IN THIS GUIDE 📖 The words used here 📘 Part 1 · Build the question bank first ⏱ Part 2 · Timing 🧭 Part 3 · Layout and navigation 🔀 Part 4 · Making copying difficult 🔒 Part 5 · Stopping tab switching — what works and what does not 📱 Part 6 · Phones, connections and fairness 🚨 Part 7 · On the day ✅ CAT setup checklist 🛠 If something goes wrong 🧑‍💻 For ICT staff 💬 Support 📖 The words used here Quiz The activity type used for a CAT, test or exam. Attempt One student's run through the quiz. For a CAT, allow exactly one. Question bank A store of questions belonging to the unit, separate from any quiz. Questions live here and are used by quizzes. Random question A slot that pulls a different question from a bank category for each student. Override A change to dates, time limit or attempts for one student or group, without touching the quiz for everyone else. Safe Exam Browser (SEB) A separate application students install that locks down their computer during the exam. 📘 Part 1 · Build the question bank first Resist the temptation to type questions straight into the quiz. Questions built in the unit's question bank can be reused, randomised and shared with a co-lecturer; questions typed into a quiz are stuck there. Open the unit and go to More → Question bank. Create a category per topic: Week 1–3 Concepts, Case Analysis, and so on. Add questions into the right category. Aim for three to four times as many questions per category as any one student will see. Ten slots drawn from forty questions means two students beside each other share very few items. This is the single most effective integrity measure available to you, and it needs no software, no lockdown and no cooperation from the student's device. ⏱ Part 2 · Timing In the quiz settings, open Timing. Setting Set to Notes Open the quiz The exact start time Enable the checkbox, or it is ignored. Close the quiz Start time + time limit + a small buffer A 45-minute CAT opening at 10:00 should usually close around 11:00, not 10:45 — late starters and reconnections need the room. Time limit e.g. 45 minutes The countdown starts when the student starts, not at the open time. When time expires Open attempts are submitted automatically The other options lose student work. Use this one. Then in Grade, set Attempts allowed = 1. ⚠️ Open and close times are not the same as the time limit. A student who starts at 10:40 on a 45-minute quiz that closes at 11:00 gets 20 minutes, not 45. Make the close time late enough to hold a full attempt for anyone starting near the end — or tell students plainly that the last start time is 10:15. 🧭 Part 3 · Layout and navigation Under Layout: New page → Every question. Each answer is saved as the student moves on, so a dropped connection costs one question rather than the paper. Navigation method → Sequential if you do not want students moving back and forth. Be deliberate: sequential prevents skipping and returning, which some students rely on legitimately. One question per page is worth doing on every CAT, regardless of anything else in this guide. On an unreliable connection it is the difference between losing one answer and losing forty minutes of work. 🔀 Part 4 · Making copying difficult Under Question behaviour, set Shuffle within questions to Yes so answer options appear in a different order for each student. Then build the quiz from random questions rather than fixed ones: in the quiz, Add → a random question, choose the bank category, and repeat for each slot. Every student receives a different paper drawn from the same bank, at the same difficulty. Under Review options, uncheck everything in the Immediately after the attempt and Later, while the quiz is still open columns except the mark. If students can see correct answers while their classmates are still sitting the CAT, the paper is public within minutes. 🔒 Part 5 · Stopping tab switching — what works and what does not 🚫 No setting in Moodle can prevent a student from switching tabs. Anyone who tells you otherwise is describing a deterrent. The browser does not give a website the power to control the rest of the device, and this is by design. What is actually available, in ascending order of strength: Option Where What it really does Full screen pop-up with some JavaScript security Extra restrictions on attempts → Browser security Opens the quiz in a stripped-down pop-up window and blocks right-click and copy/paste. A visible signal that the rules are different. Defeated by Alt-Tab, a second device, or disabling JavaScript. Require password Extra restrictions on attempts Stops anyone starting before you read the password out. Does nothing once the attempt is running. Require network address Extra restrictions on attempts Restricts the quiz to an IP range — the computer lab. Genuinely strong, but only for supervised on-campus sittings. Safe Exam Browser Its own section in the quiz settings Real lockdown: no other tabs, applications, screenshots or virtual machines. Requires the student to install the SEB application first. 5.1 Why Safe Exam Browser is not a blanket answer at Tangaza SEB runs on Windows, macOS and iOS. There is no Android version. Students sitting a CAT on an Android phone cannot install it, so requiring SEB does not lock those students down — it locks them out. Since our students sit CATs on a mix of laptops and phones, requiring SEB across the board would exclude part of every class. That makes it a tool for specific, planned, supervised assessments rather than a default. 5.2 The workable policy Type of assessment What to use Routine CATs, any device Random questions from a large bank, shuffled options, one question per page, tight time limit, browser-security pop-up, review options closed. Accept that lockdown is not available and design the paper accordingly. High-stakes exams Sit it in a University lab: SEB plus Require network address plus invigilation. Announce the venue requirement when the exam is scheduled, not the week before. Take-home or open-book Do not pretend to lock it down. Set questions where looking things up does not help — application, analysis, and answers specific to the student's own work. A tight time limit does more real work than any browser restriction. If a student has 90 seconds per question, searching for an answer costs more time than it saves. 📱 Part 6 · Phones, connections and fairness Under Extra restrictions on attempts, set Allow quiz to be attempted offline using the mobile app to No. A timed CAT and offline attempts do not mix. Use Overrides (in the quiz, More → Overrides) to give extra time to students entitled to it, without changing the quiz for everyone. An override is also the correct fix when one student's connection fails mid-attempt — extend their close time or grant a second attempt for that student alone. Tell students in advance: one question per page means answers are saved as they go, and if they are disconnected they should sign in again and resume the same attempt. 🚨 Part 7 · On the day Open the quiz yourself a few minutes early and check it looks right. Read out the password, if you set one. Watch Results during the sitting — it shows who has started, who is still in progress, and how long each has taken. Handle problems with an override for that student. Do not change the quiz settings mid-sitting; that affects everyone, including those who have finished. After the close time, check for attempts left In progress and finish them if your grading needs it. ✅ CAT setup checklist # Check 1 Question bank has at least three times the questions the paper needs 2 Quiz built from random questions, not fixed ones 3 Shuffle within questions is Yes 4 Open and close times set, with room for a late starter 5 Time limit set, and When time expires submits automatically 6 Attempts allowed = 1 7 New page every question 8 Review options closed while the quiz is open 9 Offline attempts in the mobile app set to No 10 Overrides in place for any student entitled to extra time 11 You have sat the quiz yourself as a test student Point 11 is not optional. Preview it as a student before the class does. 🛠 If something goes wrong Students report Cause Fix They cannot see the quiz The activity is hidden, or the open time has not arrived Check visibility and the Timing dates. "The quiz is not available" Password, network-address restriction, or a Restrict access rule Check Extra restrictions. A network-address rule blocks anyone off campus. A student lost their connection mid-attempt Network They resume the same attempt. Answers up to the last page they submitted are saved. Extend their time with an override if needed. The timer ran out while a student was answering Working past the limit Nothing to fix if submitted automatically is set — the work is captured. Every student saw the same questions The quiz uses fixed questions Rebuild the paper with random questions from a bank category. Students saw answers immediately Review options left at default Close them for Immediately after the attempt and Later, while the quiz is still open. A student on Android cannot start an SEB quiz Safe Exam Browser has no Android version Expected. Reserve SEB for lab-based exams — see Part 5. 🧑‍💻 For ICT staff Site-level items behind this guide: Safe Exam Browser must be enabled site-wide before the section appears in quiz settings: Site administration → Plugins → Activity modules → Quiz → Safe Exam Browser access rules. Nothing changes for lecturers until it is on. Quiz defaults can be set once for the whole site under Site administration → Plugins → Activity modules → Quiz, so every new quiz starts with sensible timing, one attempt and closed review options. Cheaper than correcting fifty lecturers. Lab IP ranges should be documented and given to anyone setting an invigilated exam, for the Require network address field. Logs: a quiz attempt's activity is visible under the attempt itself and in the course logs. Useful when investigating a reported irregularity — but note it records interactions with Moodle, not what the student did in another tab. Advise Schools before exam season: SEB has no Android client, so any SEB-based assessment implies a venue with University computers. 💬 Support LMS support and training come from the Institute Administrator in your department. Contact ICT for site-level settings, lab IP ranges, Safe Exam Browser, and investigating a suspected irregularity. Build and preview the CAT at least a day before the sitting. Almost every problem reported on the day is something a five-minute preview would have caught.