REDCap: Data Access Groups (DAGs)
Access to certain project records may be limited by using Data Access Groups (DAGs). Only users within a given Data Access Group can access records created by users within that group. This may be useful in the case of a multi-site or multi-group project that requires that groups not be able to access another group's data.
Once you have created DAGs, if you would like your users to be in multiple DAGs, you may use the optional DAG Switcher feature to allow users to move themselves in and out of specific DAGs on their own.
Setting up your DAGs & Assigning a User to a DAG
- To create DAGs, you first need to ensure a user has the Data Access Groups rights within User Rights. This user will have the ability to add & edit both the DAGs and the users that can access a DAG. This is a high level privilege, so it should only be granted to a project owner or data coordinating center staff.
- Create your DAGs (e.g. sites) by entering the group name under "Create new groups". Once a DAG is created, it will appear with a system-generated unique group name and ID number. (See the areas outlined in green below.)
- Once all your DAGs are created, assign users to a specific DAG. This will limit their access to records that have been assigned to that specific DAG. (See the areas outlined in yellow below.) In this example, John Doe will only have access to records from their Iowa site.
If a user is NOT assigned to a DAG, they will have access to ALL records.
Entering a record (assigning a record to a DAG)
Once a user is assigned to a DAG, any records they enter will automatically be assigned to the same DAG. If using the auto-numbering for records, REDCap will assign a record ID that matches the unique DAG ID number along with a sequential number. In the example below, user John Doe from Iowa has entered 2 records (21-1 & 21-2) (see areas highlighted in yellow). Iowa's group ID number is 21, so all records from Iowa start with 21.
If you are not using the auto-numbering feature, you will manually enter your record ID like normal. The system will alert you if a similar ID number is already used by another record or DAG.
If a user is not assigned to a specific DAG, any records they enter will also not be associated with a DAG. (See record #1 for user Aaron Rodgers in the above screenshot.) These records will only be seen by a user not assigned to a DAG. To assign a DAG at a later time:
- Go to the dashboard and click on the record number that should be updated.
- Select 'Choose action for record' > 'Assign to Data Access Group'.
- A new window will appear and allow you to select a DAG assignment.
DAG Switcher - Assigning a User to Multiple DAGs
Users assigned to DAGs can optionally be assigned to multiple *potential* DAGs, in which they may be given the privilege of switching in and out of specific DAGs on their own whenever they wish. This can be beneficial if a user needs the option to enter and view records from more than one DAG/site.
To assign a user to multiple DAGs, check the checkboxes for each DAG that the user will be allowed to access. At least two DAGs must be checked for a user in order for them to use the DAG Switcher. NOTE: This does not override a user's current DAG assignment, as set above or on the User Rights page.
In the example below, user 'dadams' is assigned to both Marshfield AND UW-Madison. User 'arodgers' is assigned to both [No Assignment] AND UW-Madison. Since they are assigned to [No Assignment], this user will still have access to ALL records. Setting a specific DAG within the DAG Switcher allows this user to add a new record for UW-Madison without having to manually assign the DAG.
DAG Switcher - Entering Records & Switching Groups
Users that are assigned to multiple DAGs will need to make sure which DAG they are currently in when entering a new record. At the top of the page is a blue bar that indicates the current DAG they are in. This user is first in their [No Assignment] group, but then switches to the UW-Madison DAG. Notice that the list of records changes based on the DAG the user is currently in.
Warnings and Error Messages
Restricted Message
A user may see this 'Restricted' message if they are trying to access the DAG application, but have been assigned DAG rights (within User Rights application) AND they are assigned to a specific DAG. This restriction is in place to not allow a user the ability to change their DAG assignment or the assignment of other users. Limiting a user's access by assigning them to a DAG, but also giving them full access (with DAG rights) is contradictory in most cases.
Example 1: Davante Adams is given Data Access Group access, but is only assigned to the Marshfield DAG. To fix the issue, you can remove the DAG rights within the User Rights application. The other option (only if this user should be allowed access to the DAG application and all records) is to update this users DAG assignment to [Not assigned to a group].
Example 2: Aaron Rodgers is given Data Access Group access and is also assigned to the [No Assignment] and UW-Madison DAGs via the DAG switcher. If this user tries to access the DAG application while in their UW-Madison DAG, they will see this error message. To fix the issue, this user can just switch their DAG to [No assignment] in the blue heading at the top of the page.
Error Message
The other message a user may see is an Error message. This occurs when using the DAG Switcher and a user is assigned to multiple DAGs NOT including their 'primary' DAG.
Example 1: User Jane Smith assigned to the Univ MN DAG as her 'primary' site, but is only assigned to the Iowa and Marshfield DAGs via the DAG switcher. To fix this issue, this user's DAGs should be updated to include Univ MN in the DAG switcher OR her 'primary' DAG should be changed to Iowa or Marshfield.
