Access rights

By default anyone who can access Workplace has access to SWOOP. However, it is possible to change this, and limit access to a set of named people.

Allow everyone access

By default the 'Everyone' option is selected, and everyone can access SWOOP. 'Everyone' refers to people who have a Microsoft Teams licence and is on the Microsoft tenant is connected to. Guests who have been added to Microsoft Teams can not access SWOOP for Teams.

Additional permissions is provided in the table below to SWOOP Lite Admins or Full SWOOP Admins. In the example below Rose is a Full SWOOP Admin, Frankie has been given one of the Lite Admin permissions and Sarah has been given two. Everyone else are Normal Users.

For more information about these roles see further below.

Allow access for named people only

It is possible to restrict access to SWOOP to a set of named users. That means that unless the person is either listed in the table below, or an Azure admin (see below) it is not possible to access SWOOP.

In the example below Rose is a Full SWOOP Admin whereas Frankie and Sarah are Normal User (has not been given any special permissions). No one else can access SWOOP other than both these three people listed, and the Azure admins.

Note: People who are Microsoft Teams admins in Azure Active Directory will always be Full SWOOP Admins. See more about the specific Azure Directory roles further below.

Permissions and roles

SWOOP operates with 3 different roles:

1. Normal User
2. Light Admin
3. Full Admin

In this article we'll outline what each of these roles can do.

As a Full Admin you will see an 'Admin' link in the footer of SWOOP, and this is where you can change the permissions covered in this article:

Normal User

A Normal User can:

• Access the SWOOP dashboard available at https://[organization].swoopanalytics.com. A Normal User can also add SWOOP for Teams as a tab in Microsoft Teams for a team the person is a member of.
• Access their own Personal dashboard and see personal insights.
• Access the Segment dashboard. Search and access insights for any business unit. Only see insights for data (e.g. messages) that the person already has access to.
  • Compare business units.
• • Compare topics.
• Access the Teams dashboard. Search and access insights for any public team or any private team the person is a member of. Only see insights for data (e.g. messages) that the person already has access to.
  • Compare Teams the person is a member of
• Access the Enterprise tab. Access insights for any the whole organisation. Only see insights for data (e.g. messages) that the person already has access to.

Light Admin

A Light Admin is someone who has been given access to some additional features in SWOOP by a Full SWOOP admin. These additional features include one, or more, of the following:

• Create a comparison of individuals on the Personal dashboard, and access the 'Individual Benchmarking' list on the Teams and Segment dashboards.
• Access Sentiment Analysis widgets on all dashboards (if sentiment analysis has been enabled).
• Expand the list of Influential People (a 'More' button will appear).
• Activity Export (being able to export to Excel the Segment Activity and Team Activity reports on the Enterprise tab).

Full Admin

In addition to what a Light Admin can do, a Full Admin can also:

• Teams dashboard: Search for a private team you are not a member of.
• All dashboards and reports: Set tab/widget display (show/hide/remove) via the 'Admin' options.
• All dashboards: Access Sentiment Analysis widgets (if enabled on your site).

A Full Admin also has the ability to change a variety of options which are available via the 'Admin' link shown in the footer of SWOOP. Only Full Admins will see the 'Admin' link, and it provides the following features:

• Usage statistics: See how many people have accessed SWOOP.
• Application settings: Set default attribute used by these widgets: Segment Activity, Cross-Team Collaboration, Network Map (default is 'department'). Also ability to determine which attributes are available for normal users (including Lite Admins) versus Full Admins.
• Access control: Enable selected features for Lite Admins and/or add a Full Admin.
• Theme settings: Change logo.
• Widget/tab display settings: Enable, hide or remove each tab and/or widget.
• Nudge export: Export list of nudges for all active users. Deleted/inactivated users excluded.

Finally, a Full Admin also is provided access to the SWOOP data mining application. The link to access the SWOOP data miner can be found in the Admin area on the 'Data Miner' tab. Via the SWOOP data miner the Full Admin can:

• Enable data mining.
• Access data mining log detail.
• Upload user attribute data.
• Enable/disable data collection flags (e.g. Department, Job Title, Group Names, etc).

Who can see what

Searching for a team on the Teams Dashboard

What is shown in the search results when you search for a team:

Accessing a team on the Teams Dashboard

The following roles can access a Teams Dashboard:

Note: SWOOP Full Admins who are not members of a private team can access the Team Dashboard. However, the following data fields are not shown:

• Names of people
• Content of message
• Names of channels
• Names of files

Accessing insights on the Teams Dashboard: Public Teams

Accessing insights on the Teams Dashboard: Private Teams

The following roles can access various insights in a Teams Dashboard:

(Note: Non-member do not have access to private teams in SWOOP)

See names of Teams in various reports

Where names of Teams appear in SWOOP reports on various dashboards:

Adding or Changing Permissions

Only a 'Full Admin' can change permissions. If you are a Full Admin you will see an 'Admin' link in the footer of SWOOP.

• Click on the 'Admin' link in the footer
• Click on the 'Access Control' tab
• Add a new user by searching for the person's name, and then tick the relevant permission(s).
• Click 'Save' when done.

To change permissions select the relevant tick boxes for the person you want to change. To remove all SWOOP permissions for a person click the bin icon and save.

People who are assigned any of the following Azure Directory roles are AUTOMATICALLY assigned as Full SWOOP Admins. They will not appear in the SWOOP Access Control List, but they get access permissions same as if they were listed. To remove their Full SWOOP Admin rights you will need to remove them from the Azure Directory role.

• Global administrator
• Teams Communications Administrator
• Teams Communications Support Engineer
• Teams Communications Support Specialist
• Teams Service Administrator

See https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#role-template-ids for a full listing of all of the Azure Directory roles. This link includes the Azure Directory Template ID for each of these roles.

The listed name of some roles might change depending on language settings or because in some tenants role names have been changed, however SWOOP internally uses the well known Template ID as the definitive indicator of the role.