LMS Course & Enrolment Administration (ICT Staff)

FOR ICT STAFF · lms.tangaza.ac.ke · Moodle with the eDash theme

Roles, capabilities, enrolment methods and support procedures.

This is the reference for administering course creation and enrolment on the University LMS. It is written for ICT staff who hold administrator accounts and who train and support academic staff. It assumes you already know your way around the Moodle administration tree. The companion page Adding Units and Enrolling Students covers the same ground from the lecturer's point of view.

Scope

• Google OAuth sign-in and what it means for accounts and support
• How to add and create a course/unit - the administrator route and the lecturer route
• Granting course-creation rights to lecturers and institute administrators
• The roles that exist on this LMS and what each one is for
• Configuring the enrolment plugins site-wide and per unit
• Self enrolment, enrolment keys and group keys
• Bulk enrolment: cohort sync and CSV upload
• Diagnosing enrolment complaints
• The training points that come up most often

---

1 · Reaching the administration tree

The eDash theme does not render a Site administration link in the left panel (the left panel only shows Profile, Grades, Calendar, Private files, Reports, Preferences). There are two ways in for an administrator:

• Click the red gear icon (⚙) at the top-right of the header, beside your profile picture. It is a shortcut straight into Site administration and only appears for accounts that hold site-configuration rights.
• Or go directly to the address https://lms.tangaza.ac.ke/admin/search.php

On any admin page the full tree appears in the right-hand Administration block and across the top tab bar: General, Users, Courses, Grades, Plugins, Appearance, Server, Reports, Development. Throughout this document a path written as Site administration → Plugins → Enrolments means: reach the tree by either method above and follow those links.

Why lecturers never see this: Moodle automatically filters the administration tree by capability. An account without moodle/site:config only ever sees the sections its role grants - so a lecturer sees no gear and no admin tree at all. That is by design, not a fault. Do not try to "restore" the gear for lecturers; grant them course creation at category level instead (Section 5).

2 · Authentication: Google sign-in only

The LMS authenticates through Google OAuth 2 and nothing else. There is no local Moodle username and password for staff or students, and no LMS-side password to reset. Every account is a Tangaza Google Workspace account, so LMS access follows Workspace: suspend the Workspace account and LMS access stops at the next sign-in attempt.

2.1 Where it is configured

Setting	Where	What to check
OAuth 2 authentication plugin	Plugins → Authentication → Manage authentication	Enabled. Manual accounts cannot be disabled in Moodle and stay present for the emergency administrator account.
The Google service	Server → OAuth 2 services	Client ID and secret, and that the service still shows as configured. An expired or rotated secret takes the whole site offline for logins.
Allowed domains	The Google service → edit	Set to tangaza.ac.ke so a personal Gmail cannot create an account.
Prevent account creation when authenticating	Manage authentication, common settings	Decides whether a first-time Google sign-in provisions an account automatically or is refused.
Allow users to link their login	Plugins → Authentication → OAuth 2	Leave off unless you have a specific reason — it lets an existing account attach a Google identity.

Keep a documented emergency route to a site administrator account that does not depend on Google. If the OAuth credentials fail or the consent screen is withdrawn, nobody - including you - can sign in through the normal page.

2.2 What this changes for support

• There are no LMS password resets. Every login failure is a Google Workspace matter. Do not troubleshoot it inside Moodle.
• The email address is the join key. The address on the Moodle account must match the Google account exactly. A mismatch does not fail - it silently creates a second, empty account.
• Personal Gmail sign-ins are the commonest ticket: the user lands in a brand-new account with no units and reports that their work has vanished. Setting Allowed domains prevents it outright.
• Duplicate accounts: correct the email on the account that holds the submissions and suspend the empty one. Never delete the account with the work in it.
• Offboarding happens in Workspace, not in Moodle. Suspending the Google account is what actually removes access.

2.3 Accounts must exist before they can be enrolled

An account is created the first time a person signs in with Google. Until then they do not appear in the user selector, and a lecturer trying to enrol a colleague or a late student will report that the person "is not on the system". Two ways round it:

• Ask the person to sign in once, then enrol them. Simplest for one or two people.
• Pre-create the accounts by CSV upload with the auth field set to oauth2, so a whole intake can be enrolled before teaching starts. See Section 10.2.

3 · The roles on this LMS

These are the custom roles defined on lms.tangaza.ac.ke, with the descriptions as they appear on the site. Use these names — not the generic Moodle names — when granting access or answering a ticket.

Role	Description (as on the site)	Typical holder
LMS Developer	Overall main LMS Admin; manages the entire LMS, curates courses and troubleshoots issues on the LMS.	ICT lead / super-administrator
ICT Staff Admin	Can access courses and modify them, but usually do not participate in them.	ICT support staff
Institute Admin	Can do anything within a course, including changing the activities and assigning students to courses.	School / Institute administrators
Lecturer	Can create new courses, assign students and view reports.	Lecturers and programme leaders
Student	Standard learner access within enrolled units.	Students

On this site the Lecturer role is the course-creator role: it carries moodle/course:create. Granting a lecturer the ability to create units means assigning them the Lecturer role in the right category (Section 5), not giving them any part of Site administration.

4 · How to add and create a course/unit

A unit is created inside the category it belongs to. On this LMS the top-level categories are the Institutes (Center for Leadership and Management (CLM), Institute of Communication, Journalism and Media Studies (ICJMS), Institute of Youth Studies (IYS), Institute for Social Transformation (IST), and so on), each with the sub-categories Bachelors, Masters, Diploma, PHD. There are two routes to the create screen depending on who you are.

4.1 Administrator route (ICT staff)

1. Open Site administration (gear icon or /admin/search.php) → Courses → Manage courses and categories.
2. In the left Course categories column, click the category the unit belongs to — the Institute, then the sub-category (e.g. CLM → Bachelors).
3. In the right-hand panel, click Create new course.
4. Fill in the course settings (see 4.3) and click Save and display.
5. On the enrolment screen that follows, add the lecturer(s) as Teacher.

From the same page you can also Create new category, move courses between categories, and upload courses in bulk.

4.2 Lecturer route (no admin access needed)

A lecturer who holds the Lecturer role in a category (Section 5) does not use Site administration at all:

1. Sign in and click Institutes in the top menu.
2. Open the relevant Institute, then drill down to the sub-category (e.g. Bachelors) where the unit belongs.
3. At the bottom of that category's course list, click Create a new course.
4. Fill in the settings (4.3) and save.

If the Create a new course button is not on the category page, the lecturer has not been assigned the Lecturer role in that category — grant it as in Section 5. (Note: because the site uses the customised eDash category layout, always confirm the button appears for a real lecturer after granting the role; if the capability is present but the button is still missing, the cause is the theme template, not the permission.)

4.3 Course settings that matter

Field	What to enter
Course full name	The unit title, formatted CourseCode | Course Full Name | Period, e.g. TDCT1104 Fundamentals of Coding 2025-2026A.
Course short name	The unit code in capitals with a single space, e.g. ISTP 701. Must be unique site-wide; add the intake where a code repeats (ISTP 701 2026S1).
Course category	The Institute → sub-category the unit belongs to. This decides who can find and help manage it.
Start / End date	First and last teaching day. In Weekly format the start date drives week numbering.
Course format	Weekly for a fixed timetable, Topics for theme/module organisation.
Course visibility	Leave on Hide while building; set to Show when ready to publish.

5 · Granting course-creation rights

University policy is that lecturers, programme leaders and institute administrators may create units. The mechanism is always the same: assign a role that carries moodle/course:create at the category the person is responsible for — never at the whole site.

5.1 Which role, and where

Person	Assign role	At	What they get
Lecturer	Lecturer	Their programme sub-category	Create units in that category; teach units they are enrolled in
Programme leader	Lecturer (or Institute Admin if they must also manage colleagues' units)	Their programme category	Create units; with Institute Admin, edit and manage across the programme
School / Institute administrator	Institute Admin	Their Institute category	Create, edit, enrol and manage across the whole Institute
ICT staff	ICT Staff Admin / LMS Developer	System	Site-wide administration

Do not assign Lecturer or Institute Admin at system level. A category-carrying role assigned at System applies everywhere and also surfaces a filtered Site administration → Courses entry for that user — which is exactly the "why can a lecturer see /admin" problem. Category-level assignment keeps the estate tidy and keeps lecturers out of the admin area.

5.2 Assigning it (exact path)

1. Site administration → Courses → Manage courses and categories.
2. Click the category concerned (e.g. Center for Leadership and Management (CLM), or a sub-category for tighter scope).
3. In the secondary navigation bar, open More ▾ → Permissions.
4. On the Permissions page, use the grey Permissions ▾ dropdown and choose Assign roles.
5. Click the Lecturer role (or Institute Admin).
6. In the right-hand Potential users box, search for the person, select them, and click ◄ Add so they move to Existing users. Assigning at a parent category cascades to its sub-categories.

Assigning several people at once: in the Potential users box you can hold Ctrl (or Cmd) and click multiple names, or Shift-click a range, then Add them together. For a genuinely large intake, put the lecturers in a cohort and either add them from the cohort or (if the local_cohortrole plugin is installed) have cohort membership grant the Lecturer role in the category automatically. Core Moodle has no CSV upload for category-level role assignment — the CSV Upload users tool only assigns system roles.

5.3 The capabilities behind it

Useful when debugging a "the button is not there" report. Check with Site administration → Users → Permissions → Capability overview, or the Check permissions link in the category or unit. On this site the Lecturer role is configured to allow the following (course deletion is deliberately left off).

Capability	Controls
moodle/course:create	The Create new course button in a category
moodle/course:update	Editing the settings of an existing unit
moodle/course:manageactivities	Adding, editing and deleting activities and resources
moodle/course:managefiles	Managing files in the unit
moodle/course:activityvisibility	Hiding / showing activities
moodle/course:visibility	Setting a unit to Show or Hide
moodle/course:viewparticipants	Seeing the participant list of the unit
moodle/course:enrolreview	Reviewing the unit's enrolments
moodle/course:enrolconfig	Adding and configuring enrolment methods in a unit
enrol/self:config	Editing the self enrolment method, including the key
enrol/manual:enrol	Adding users manually to a unit
moodle/role:assign	Choosing which role an enrolled user receives
moodle/category:manage	Creating and editing categories
moodle/course:delete	Deleting a unit (kept OFF for lecturers — deletion destroys submissions)
moodle/site:config	Full Site administration (ICT roles only; never for lecturers)

6 · Category structure

Enrolment problems are very often category problems, so keep the tree predictable:

Institute → Sub-category (Bachelors / Masters / Diploma / PHD) → Units

• Delegate rights at sub-category (programme) level for lecturers, and at Institute level for institute administrators.
• Hiding a category hides every unit inside it, whatever each unit's own visibility says. This is the second most common cause of "students cannot see my unit".
• Archive an intake by moving its category rather than deleting units. Deleting a unit destroys submissions and grades irreversibly.

7 · Enrolment plugins, site-wide

7.1 Which plugins are enabled

Site administration → Plugins → Enrolments → Manage enrol plugins. The eye icon controls each one. A plugin disabled here cannot be used by any unit, however that unit is configured.

Plugin	State	Note
Manual enrolments	Enabled	Required. Staff enrolment depends on it.
Self enrolment	Enabled	The method this guide is mostly about.
Cohort sync	Enabled	Needed for whole-intake enrolment.
Guest access	Disabled by default	Enable per unit only on request. See 9.4.
Category enrolments	Disabled	Deprecated behaviour; do not use.

7.2 Site defaults for self enrolment

Site administration → Plugins → Enrolments → Self enrolment. These values are inherited by units created afterwards; they do not change units that already exist.

Setting	Set to	Reason
Add instance to new courses	Yes	Every new unit has the method ready, so lecturers only switch it on.
Allow self enrolments	No	The method exists but is closed until the lecturer opens it. Fails safe.
Use enrolment key	Yes	New units default to key-protected rather than open to the whole University.
Default role assignment	Student	A self-enrolling user must never receive a teaching role.
Enrolment duration	Unlimited	Semester length is better controlled by the unit end date.
Max enrolled users	0	No cap by default; lecturers set one if they need it.
Send course welcome message	Yes	Gives the student written confirmation and cuts support calls.

8 · Self enrolment on a single unit

8.1 Where it lives

Unit → Participants → change the dropdown from Enrolled users to Enrolment methods. The eye icon activates or suspends a method; the gear icon opens its settings; the bin deletes it along with everyone it enrolled.

8.2 Every setting, and what it actually does

Setting	Effect
Custom instance name	Replaces the words "Self enrolment" on the student-facing panel. Useful for labelling intakes.
Allow existing enrolments	No suspends everyone who joined by this method without removing them or their work. The correct way to freeze a class.
Allow new enrolments	The master switch for joining. No means nobody new gets in whatever the key says.
Enrolment key	Blank means anyone with an account may join. A value restricts entry to those who know it. Case sensitive.
Use group enrolment keys	Yes makes Moodle test the typed key against every group key in the unit as well as the master key.
Default assigned role	The role granted on joining. Must be Student.
Start date / End date	The window during which joining is possible. The cleanest way to close enrolment after add-drop.
Max enrolled users	Caps the class. When reached, the enrolment panel disappears with no explanation to the student.
Only cohort members	Restricts self enrolment to members of a named cohort. Combine with a key for tight control.

8.3 Group enrolment keys

Two conditions must both hold, and the second is the one people miss:

1. Each group has its own key, set in the group settings under Participants → Groups.
2. The self enrolment method itself has Use group enrolment keys set to Yes AND a master key in its own Enrolment key field. Without a master key, group keys are ignored entirely.

Behaviour: the master key admits the student to the unit with no group; a group key admits them to the unit and places them in that group.

9 · Bulk and alternative enrolment

9.1 Cohort sync - preferred for whole intakes

A cohort is a named list of users maintained centrally. Synchronising it into a unit enrols everyone on the list and removes them when they leave the cohort. It does not depend on a key being circulated correctly, which makes it the right answer for registered intakes.

1. Site administration → Users → Accounts → Cohorts → Add new cohort. Name it for the intake, e.g. MA Peace Studies Sep 2026.
2. Add members, individually or by uploading a CSV of usernames on the Assign screen.
3. In each unit: Participants → Enrolment methods → Add method → Cohort sync.
4. Select the cohort, set Assign role to Student, and save.

Removing a user from the cohort removes them from every unit synced to it. Suspend rather than remove where a record of submitted work must be kept.

9.2 CSV upload

Site administration → Users → Accounts → Upload users. Creates accounts and enrols them in one pass. Minimum useful columns:

Column	Contents
username	Lower case, no spaces. Match the convention already in use on the site.
firstname / lastname	As registered.
email	Must be unique across the site, and must match the person's Google account exactly.
auth	Must be oauth2. Accounts authenticate through Google, so no password column is used.
course1, course2, …	The unit SHORT name, exactly as it appears in the unit settings.
role1, role2, …	student, editingteacher or teacher.
group1, …	The group name, which must already exist in that unit.
cohort1	The cohort ID number, to add the user to a cohort.

• Always run the preview step and read the report before committing.
• Save the file as UTF-8 CSV. Excel's default encoding mangles accented names.
• Keep the source spreadsheet. It is your audit trail if an intake has to be reversed.

9.3 Manual enrolment

Unit → Participants → Enrol users. The right tool for staff, for a handful of latecomers, and for anyone who must be given a non-student role. It is also the only method that lets you set an individual enrolment start date and duration.

9.4 Guest access is not enrolment

Guests are not participants. They can read but cannot submit, post, be grouped or be graded, and they leave no record. Enable it only for genuine showcase units, and never as a shortcut when self enrolment is misbehaving.

10 · Diagnosing enrolment complaints

Work down this list in order. The cause is almost always in the first three rows.

Symptom	Check	Fix
Students cannot see the unit	Unit visibility, then category visibility	Settings → Course visibility → Show. Unhide the category if needed.
Unit visible, no enrolment panel	Is Self enrolment present and active, and Allow new enrolments = Yes?	Activate the method; set Allow new enrolments to Yes.
Panel present, key refused	Reveal the key with the eye icon; ask whether the student pasted it	Re-issue the key. Advise typing rather than pasting.
Group keys ignored	Master key present on the method?	Add a master key to the self enrolment method itself.
Panel vanished for later students	Max enrolled users, and the method End date	Raise the cap or extend the window.
Everyone in the University joined	Key field left blank	Set a key, then remove those who should not be there.
Self enrolment missing from Add method	Plugin disabled site-wide	Manage enrol plugins → enable Self enrolment.
Staff member has no Create new course button	Role assigned at the category, not the site?	Assign Lecturer (or Institute Admin) at the correct category.
A setting change had no visible effect	Caching	Site administration → Development → Purge caches, then re-test in a private window.
A user is not in the enrol selector	They have never signed in, so no account exists	Ask them to sign in once with Google, or pre-create by CSV with auth = oauth2.
"All my units have disappeared"	Signed in with a personal Gmail; they are in a new empty account	Sign out fully, sign in with the tangaza.ac.ke address. Suspend the stray account.
One user has two accounts	Email mismatch between Moodle and Google	Fix the email on the account holding the work; suspend the empty one.
Nobody at all can sign in	OAuth client secret expired, consent withdrawn, or the service misconfigured	Server → OAuth 2 services. Use the emergency administrator route while you fix it.
Who did what, and when	Site administration → Reports → Logs, filtered to the unit	Enrolment events are logged with actor, target and timestamp.

11 · Standing training outline

The points below generate repeat support calls. Cover all of them in every staff induction session.

Point	Why it matters
Show and enrolment are two separate switches	Half of all "students cannot get in" tickets are one of the two left undone.
Short names must be unique and carry the intake	Duplicate short names block course creation and confuse searching.
Category placement decides who can find the unit	Units created in the wrong category are effectively lost.
A blank key is not a closed unit	Staff routinely clear the key intending to close enrolment — it opens the unit to everyone.
Change the key every intake	Old keys circulate between year groups indefinitely.
Group keys need a master key too	The single most common misconfiguration.
Suspend rather than delete	Deleting an enrolment destroys submissions and grades.
Import, do not rebuild	Saves a day of work per unit each semester.
ICT does not hold enrolment keys	Sets student expectations and stops keys leaking through the service desk.
Login is Google only, with no LMS password	Stops staff sending students to a password reset that does not exist.
A person must sign in once before they can be enrolled	Explains most "this person is not on the system" reports.

12 · Quick reference

To do this	Go here
Reach the admin tree on eDash	Gear icon (top-right) or lms.tangaza.ac.ke/admin/search.php
Grant course-creation rights	Manage courses and categories → category → More → Permissions → Assign roles
Create a unit (admin)	Manage courses and categories → category → Create new course
Create a unit (lecturer)	Institutes → Institute → sub-category → Create a new course
Enable or disable an enrolment plugin	Plugins → Enrolments → Manage enrol plugins
Set defaults for all new units	Plugins → Enrolments → Self enrolment
Configure a unit's enrolment	Unit → Participants → Enrolment methods
Set or reveal an enrolment key	Unit → Participants → Enrolment methods → Self enrolment (gear)
Create a cohort	Users → Accounts → Cohorts
Bulk create and enrol from CSV	Users → Accounts → Upload users
See who enrolled whom	Reports → Logs
Check the Google login service	Server → OAuth 2 services
Purge caches	Development → Purge caches

13 · Known issues & quirks on this LMS

Findings from setup and testing (as of August 2026). Keep this list current as items are fixed.

Issue	Detail & workaround	Status
“Create a new course” button hidden on category pages	Lecturers do hold moodle/course:create (verified — /course/edit.php?category=76 opens the create form for a lecturer), but the eDash category template does not render the button, so lecturers cannot self-create from the category page and were falling back to /admin. Workarounds: the direct link /course/edit.php?category=ID, the Site administration route, or Course requests. Permanent fix: a child-theme renderer override that adds a capability-guarded button (see the separate developer hand-off).	Open - theme fix pending
No Site administration link in the left panel	eDash does not show it in the left nav. Reach the tree via the red gear (top-right, admins only) or /admin/search.php. Lecturers never see it — Moodle capability-filters the admin tree, by design.	By design
Edit mode toggle sits bottom-left	eDash places the Edit mode switch at the bottom-left of the page, not top-right as in stock Moodle 4. A common “where is Edit mode?” question from staff.	By design (theme)
Teaching role is “Lecturer”	This site uses custom roles: LMS Developer, ICT Staff Admin, Institute Admin, Lecturer, Student. There is no stock “Teacher” / “Non-editing teacher”. Use Lecturer when enrolling teaching staff.	By design
Assign course roles at category level, not system	A Lecturer or Institute Admin role assigned at System level applies everywhere and surfaces a filtered Site administration → Courses entry for that user (the “why can a lecturer reach /admin” problem). Always assign at the category.	Guidance
Front-end menus / blocks cannot be role-gated	Custom menu items and HTML blocks show to all users, including students. A create-course button therefore cannot be added, restricted to staff, from the admin UI — it requires the theme/plugin code change.	Moodle limitation
eDash theme settings are cosmetic only	The eDash settings page covers logos, colours, banners and login/social/footer — nothing for course creation or menus. Not the place to look for the button fix.	Note
No bulk category-level role assignment in core	The Assign roles screen is multi-select only (Ctrl / Shift-click). CSV Upload users assigns system roles only. For true bulk category-level assignment, install local_cohortrole — cohort membership then grants the role in a chosen category automatically.	Moodle limitation
Course requests: enabled	enablecourserequests is on; staff can request a unit at /course/request.php. Approvers need moodle/site:approvecourse. Confirm a default request category and a notification recipient are set so requests are not missed.	Active
Lecturer role missing teaching capabilities (empty activity chooser)	The Lecturer role was built from the Course creator archetype, so it can create a course shell but lacks the editing-teacher capabilities: add activities/resources (0/26), grading (0/49), question bank (0/18), enrolment (1/37), reports (0/18), backup/restore/import (1/19). Symptom: the Add an activity or resource chooser opens empty and throws toggleFocusableChooserOption … querySelector null. Fix: reset the role to the Teacher (editing) archetype and re-add course creation — see Section 14.	Fix documented (Section 14)

Maintained by the ICT Department. LMS support and academic staff training: Maureen and Onesmus.

14 · Fixing the Lecturer role — adding teaching capabilities

The "Lecturer" role was created from the Course creator archetype, which lets a person create a course but not teach in one. So lecturers can make an empty unit but cannot add activities, grade, enrol students, use the question bank, run reports, or import a previous unit. The tell-tale symptom is the Add an activity or resource dialog opening empty with a JavaScript error.

14.1 What the role has versus needs

Capability area	Granted / total
Add an activity or resource (mod/*:addinstance)	0 / 26
Grading & gradebook	0 / 49
Question bank	0 / 18
Enrolment	1 / 37
Reports	0 / 18
Backup / restore / import	1 / 19

It does already have: create a course, edit settings, manage files, set visibility, turn on Edit mode and reorder existing items, view participants, and review enrolments.

14.2 The fix — reset to editing-teacher, then re-add create

Site administration → Users → Permissions → Define roles → click Lecturer. The role page has Edit and Reset buttons. Do these in order — order matters, because Reset uses whatever archetype is currently set.

1. Set the archetype. Click Edit, change Role archetype from "Course creator" to Teacher (editing), then Save changes. (This alone does not change any capability — it only tells Reset which defaults to use.)
2. Reset. Back on the role page, click Reset and confirm. This applies the full editing-teacher set: add activities, grading, question bank, enrolment, reports, backup/restore/import, groups and sections.
3. Re-add what Reset drops. Click Edit again. In the Filter box, tick Allow on moodle/course:create and moodle/category:viewcourselist (and moodle/course:request if you use course requests). Then scroll to Context types where this role may be assigned and make sure Category is still ticked — the reset usually unticks it (editing teachers default to Course + Activity), and you need Category for the category-level create assignment. Save changes.
4. Test. As a lecturer, open a course → Add an activity or resource → the chooser should be full, and grading, enrolment and import should now work too.

Two cautions. This edits the Lecturer role site-wide, so it affects every lecturer at once. And because one role now does both jobs, anyone assigned at a category gets editing-teacher power over every course in that category — if that is too broad for shared categories, enrol lecturers as Lecturer in their own course for teaching and reserve category-level assignment for the create right only.