Keep learner data where your policies say it goes

Sign-in and identity

You add a SAML identity provider by importing its metadata. LMS Advisor verifies the signature on every response, allows two minutes of clock skew, and records each assertion ID so a captured response cannot be replayed. A second certificate slot lets you rotate the IdP certificate without an outage. You decide whether unknown users are created at first sign-in, whether profile fields refresh on each login, and how directory groups map to roles. When a person sits in several mapped groups the most privileged role wins, but nothing mapped from a directory can go above admin. Single logout is not implemented yet.

Each SCIM connection gets its own bearer token, which you can rotate. People are matched on the directory’s externalId before email, which avoids duplicate accounts when an address changes. A delete from the directory deactivates the account.

For local sign-in, you can require authenticator-app 2FA for chosen roles (super admin and admin by default). The settings screen shows how many people in each role have already enrolled, so you know who will be sent to setup before you enforce it. Each user gets eight single-use backup codes, and an authenticator code that has been accepted once cannot be used again. People can tick “remember this device” to skip the second step on a trusted computer for 15 days by default (you can set anything from 1 to 90), on up to 10 devices each. On the web there is also a code-by-email option: a 6-digit code that expires after 10 minutes. Repeated failed sign-ins lock the account for a set period, five attempts and 15 minutes unless you change them.

Least privilege for people and integrations

The role ladder stops anyone granting a role at or above their own, including through bulk import and the API. API tokens carry scopes (read, write, sso, admin), an optional IP allowlist and an expiry date. Only a hash of each token is stored, and the value is shown once. Stored secrets such as 2FA seeds and LRS credentials are encrypted with AES-256-GCM.

Evidence you can review

Sensitive actions go to the audit log, including refused privilege changes, token creation, bulk imports and impersonation sessions. Impersonation is limited to admins and super admins, cannot be nested, and a super admin cannot become another super admin. The scanner runs in short batches so it finishes on shared hosting. It compares code files against an integrity baseline and malware signatures, looks for executable files in upload folders, scans stored HTML for injected scripts and iframes, audits configuration (exposed .env files, debug mode, leftover dev files), and lists admin accounts created in the last 30 days for you to confirm.

For a single account, the user history view shows the last 30 days of sign-ins with IP address, location and device, plus the pages that person opened. It is often the quickest way to answer “was this really them?”

Retention

Under Legal Pages you set retention in days for audit logs, session history, analytics events, sent email, read notifications, proctoring snapshots, exam audio, AI tutor chats and inactive student accounts, which are anonymized (off by default). Enrollments, attempts, grades and certificates are deliberately outside these rules, because regulated training records often have to be kept for years.