Restricted branches and user access in TalentLMS

Restricted branches let you keep users within specific training environments and control their access to your main TalentLMS portal.

How restricted branches work

When you create a branch, the Restricted branch option is enabled by default. To view or change this setting:

1. Sign in to your TalentLMS account as an Administrator and go to Home > Branches, select the branch you want to edit, and go to Info (1).
2. Under Identity (2), locate the option Restricted branch (3).
3. Enable (4) the option to restrict users assigned to the branch from accessing the main portal, and click Save (5).

A user’s access depends on their branch assignments:

If a user belongs only to one or more restricted branches, they can access TalentLMS through those branches but not through the main domain.
If a user belongs to a non-restricted branch, including users who belong to both restricted and non-restricted branches, they can also access the main domain.
If a user is not assigned to any branch, the main domain is used as their default access point.

When adding or editing a user, under the user’s Info tab, scroll down to manage these assignments from the Access to branches (1) section, where restricted and non-restricted branches are displayed separately.

Notes:

Removing a user from their last restricted branch or deactivating that branch can grant the user access to the main domain. To prevent this, deactivate the user or assign them to another restricted branch.
To keep your sub-portals fully independent, we recommend leaving the Restricted branch option enabled.

How restricted branches affect different user types

SuperAdmins and Administrators

When a SuperAdmin or Administrator-type user accesses a branch, they operate as a branch Administrator, with administrative access limited to that branch.

Branch Administrators can view and manage users, courses, and reports available within the branch, based on their user type permissions. However, they cannot access administrative features that are available only through the main portal.

As a result, features such as Notifications, Automations, Categories, Import-Export, Course Store, Account & Settings, and Subscription are not available from within a branch. These features are available through the main portal.

Notes:

Playground can be available within a branch, depending on the branch settings. Its availability for the branch is configured through the main portal and cannot be changed while operating within the branch.
User type permissions don’t override branch-level restrictions. Features that aren’t available within a branch remain inaccessible to branch Administrators regardless of their user type permissions. If a branch Administrator needs access to main portal features, make the user a SuperAdmin or make the branch non-restricted. In both cases, the user can access the main domain, where these features are available.

Instructors and Learners

Instructors and Learners can view all courses assigned to them on their dashboard, regardless of whether the courses belong to the branch they are currently accessing.

This means that users who belong to multiple branches do not need to switch between branches to find their assigned courses. However, they will only be viewing the course catalog of the branch they are logged into.

How users sign in to restricted branches

The sign-in flow depends on how many restricted branches a user can access and whether they use SSO.

A. Users with access to one restricted branch

When a user with access to only one restricted branch attempts to sign in through the main domain with their TalentLMS credentials, TalentLMS redirects them to their branch URL.

For users signing in with SSO, TalentLMS redirects them to the branch and initiates SSO authentication for that branch.

B. Users with access to multiple restricted branches

When a user with access to multiple restricted branches attempts to sign in through the main domain, TalentLMS prompts them to choose (1) the restricted branch they want to access.

For users signing in with SSO, selecting a branch initiates SSO authentication for that branch.

C. Users accessing the wrong restricted branch

When an SSO user with access to only one restricted branch attempts to sign in through another non-restricted branch URL, TalentLMS redirects them to their assigned branch and initiates SSO authentication there.

If a user with access to multiple restricted branches attempts to sign in through a branch they do not have access to, they are prompted to choose one of the restricted branches available to them.

Notes:

The above scenarios apply provided that the user is a member in the IdP's applications for SSO.
Each branch can have its own SSO configuration, which can differ from the authentication method used on the main domain or other branches.
Branches are available on paid plans.