Like all other software, administrator accounts in Moodle should not be used for daily tasks. The privileged sessions feature (also known as web sudo) allows administrators to log in with their low-privilege accounts and switch to a privileged session mode when they need to manage the site.
Another use case is working around bugs in plugins and core that appear when a user has both teacher and student accounts in the same course. In these cases, it is possible to enrol the user as a normal student and switch to a privileged session only when they need to act as an editing teacher.
To further improve security, the privileged session can be protected with existing MFA factors.
- Log in as admin. (Only administrators may configure which users can use privileged sessions.)
- Navigate to "Site administration / Users / Permissions / Privileged users".
- Press "Add privileged user".
- Select the user that should be granted sudo access.
- Define the roles and contexts where the user will have privileged access. (You may find the context ID numbers in page URLs when overriding permissions.)
- Enforce multi-factor authentication for additional security, if desired.
- Log in as privileged user - use your regular, low-privilege account to log in.
- Click on user menu in top right.
- Select "Start privileged session".
- Press "Continue" or supply MFA verification code.
- Always remember to end the privileged session once your management tasks are complete.
- This plugin is internally using the Switch role feature, due to that course level privileges appear as "Switched roles" in Moodle UI.