Request External App in Canvas

Environment

Canvas Learning Management System
Canvas Catalog
External Web Applications

Issue

How do I request an external app for use in Canvas?

Resolution

• Check if the app you are requesting is already integrated into Canvas or a suitable alternative exists by reviewing the list of external apps.

• Complete the Request a Canvas External App form

  • To expedite your request, please attach the following:

    • VPAT or other attestation of digital accessibility.  External apps used in Canvas must meet U-M accessibility standards

    • HECVAT Lite 3.x. or higher. External apps used in Canvas must be assessed for security and data management and privacy.

    • Data Protection Addendum (DPA). If you are working with U-M Procurement, please request the supplier sign a DPA and attach a copy of the signed agreement to your request. If you are not working with U-M Procurement, ITS can assist in working with the supplier/vendor to identify the appropriate agreement. 

• Because evaluating app compliance is a time consuming process, ITS has priority dates for external app requests. All requests will be processed, but requests received by the priority dates will be processed first.

What can I expect after I place my request?

External apps must be evaluated for compliance with U-M requirements regarding:

• Accessibility

• Security

• Data privacy & protection

All requests for integrations of external apps in Canvas will undergo assessments in these three areas and final approval for integration requests is subject to the findings of the assessments.

Additional Information

External apps can be deployed in Canvas at three different levels:

• Course Level: The app is deployed to one or a few individual Canvas courses.  The app will be available for use only on that course.

• Sub-account Level: The app is deployed to the sub-account and is available for use on all courses contained within that sub-account.  These external apps are licensed and available only to courses in a given academic unit’s Canvas sub-account. Typically ITS manages the technical integration of these apps, but supplier management and end-user support is the responsibility of the unit that licenses the app.

• Account Level: The app is deployed to the top-level (root) account of Canvas and is available enterprise-wide for use on ALL courses in Canvas.  ITS licenses, maintains, and supports these apps as part of the administration of the enterprise digital learning environment.

LTI Integration Process Overview

• Requestor submits an integration request.

• Once a request has been received, the Integration coordinator will review the request and communicate with the requestor as needed to define the details and scope of the request.

• The Integration coordinator will work with the requestor, the app supplier, and other ITS teams, as needed, to perform a preliminary integration of the app, test the integration for compliance, obtain relevant installation instructions and compliance documentation, track compliance-based approval of the integration, and perform the technical work needed to complete the requested integration.

  • The integrated app will be deployed to a test course and a request filed with the ITS Accessibility team to evaluate the app for compliance with U-M accessibility standards.

  • A data protection agreement (DPA) will be sent to the supplier for signing.  When returned, the supplier-signed DPA will be provided to the ITS Purchasing team for review and countersigning. 

  • An ITS-Third Party Vendor Security and Compliance request will be submitted to the ITS information Assurance team to evaluate the security of the external app within Canvas.

• When all reviewing teams have completed their assessment of the app and approved the integration, the Integration coordinator will permanently deploy the app as requested for use in Canvas. 

• All compliance requirements relevant to the particular integration request must be met in order for the app to be approved for continued deployment in Canvas.

  • In the event that ITS is unable to secure baseline compliance regarding Accessibility, Security, and Data Protection (e.g. the supplier refuses to sign a DPA or correct security and accessibility issues within a reasonable period of time) the integration will be suspended until the external app is brought into compliance with U-M standards

For additional questions, please contact the ITS Service Center