Canvas Integrations of External Apps

Introduction

Learning Tools Interoperability (LTI) is a standard created by the IMS Global Learning Consortium. An LTI shares content, resources, and/or other information from a third-party website with a learning management system (LMS). Its primary purpose is to connect learning systems with external services. Canvas calls these integrated platforms “external apps”.

Table of Contents:

• LTI Requirements
• Approved Integrations
  • Evaluations in progress
• Request a new external app
  • Vendor Risk Review
  • Accessibility Review
  • Customer Support Review
  • ISU Systems Impact Review
• Request Form and Questions

LTI Requirements

External apps must pass the following reviews before they will be added to Canvas using LTI integration.

• Vendor Risk Review
• Accessibility Review
• Customer Support Review
• ISU Systems Impact Review

New LTI integrations must comply with the LTI version 1.3 standard. Integrations requiring unrestricted access tokens or using previous, deprecated versions of the LTI standard are not allowed. Please see the Security Update and Deprecation Schedule for Early Versions of LTI.

Existing LTI integrations that use deprecated versions of the LTI standard may temporarily remain in use while ISU works with the vendor to upgrade to LTI 1.3.

Course-level LTI integrations in Canvas by faculty are not permitted.

Approved Integrations

Evaluations in progress

Request a new external app

Each department/course-level integration request will be reviewed based on risk, accessibility, support, and impact on ISU systems. If an integration does not meet ISU expectations in any one of these areas, the request will be rejected.

The review of each integration takes at least 4 weeks from the time the request is submitted. ITRC may seek clarification from the vendor during the review process. The timeliness of vendor responses to information requests significantly influences the review timeline. Submitting the request during the first week of the semester, mid-term, or finals week may also impact the turnaround time.

Vendor Risk Review

Requestors will need to obtain a HECVAT or SOC2  from the vendor:
(If the vendor does not have either of these, the request will be rejected.)

• The Higher Education Community Vendor Assessment Toolkit (HECVAT) is a questionnaire framework specifically designed for higher education to measure vendor risk. The questionnaire confirms that information, data, and cybersecurity policies are in place to protect our sensitive institutional information and constituents' personally identifiable information (PII). 

• The System of Organization Controls Trust Services Criteria (SOC2) audit generates a comprehensive report on vendor controls on security, availability, processing integrity, confidentiality, and privacy, offering assurance regarding data processing controls. 

• [Optional] A Privacy Policy or Statement is a public information page that relays any rights users have on the platform to control their personal information.

• [Optional] A Security Policy or Statement is a public information page that relays the vendor’s ability to protect sensitive data and other information during interactions on their platform.

Based on the information provided by the vendor, ISU may approve, seek clarification, or reject the integration of the external app. Approved apps will be reviewed periodically. Notably, the timeliness of vendor responses to information requests significantly influences the approval timeline for integrations.

Accessibility Review

Requestors will need to obtain a VPAT from the vendor:

• The Vendor Product Accessibility Template (VPAT) is a document that explains how information and communication technology (ICT) products such as software, hardware, electronic content, and support documentation meet (conform to) the Revised 508 Standards for IT accessibility. If the vendor does not have this the request will be rejected.

• [Optional] An Accessibility Policy or Statement is a public information page that relays the vendor’s internal organizational policies, accessibility goals, and past successes when it comes to serving and working with people who have disabilities.

Based on the information provided by the vendor, ISU may approve, seek clarification, or reject the integration of the Learning Tools Interoperability (LTI). Approved tools will be reviewed periodically. Notably, the timeliness of vendor responses to information requests significantly influences the approval timeline for integrations.

ISU’s Electronic and Information Technology Accessibility Policy (ISUPP 1020) states that software and electronic systems must conform to Section 508 of the Rehabilitation Act of 1973, and the Americans with Disabilities Act.

Customer Support Review

Requestors will need to obtain the following from the vendor:

• Document Support site is a public information page that includes step-by-step guides or knowledge base articles.

• Customer Service Contact information provides details to whom faculty and students can contact with errors or issues when using the vendor’s platform. It may include but is not limited to phone, email, live chat, or ticket submissions and should include available support hours.

• Customer Support Representative information provides details about the integration and would be the person that ITRC can reach out to for clarification.

• [Optional] A Status page is a communication platform where users can subscribe to receive notifications about incidents or outages, eliminating the need to contact support for updates.

Based on the information provided by the vendor, ISU may approve, seek clarification, or reject the integration of the Learning Tools Interoperability (LTI). Approved tools will be reviewed periodically. Notably, the timeliness of vendor responses to information requests significantly influences the approval timeline for integrations.

While ISU enables many integrations of 3rd-party tools with the Learning Management System (LMS), ISU does not assume the support role for all of them. Please refer to the table at [insert website link/title] for support for each tool.

ISU Systems Impact Review

The requestor will need to provide the following:

• How many faculty, students, and courses are planned to use this integration?

• How is this app unique from already installed external apps or Canvas activities?

• What is the desired implementation date?

• What is the cost for students/faculty?

• Who or which department will be responsible for the associated costs?

• Who or which department will be responsible for the support?

ISU staff will identify the following:

• The external app uses which LTI Type: (clarification from the vendor/documentation)

  • LTI 1.3 (Prefered)

  • LTI 1.3 + API (requires additional configurations)

  • LTI 1.3 + Inherited (configuration is limited)

  • LTI 1.3 + Edu Apps (configuration is limited) 

  • LTI 1.1 (Rejected)

• The external app needs which placement requirements: (clarification from the vendor/documentation/testing)

  • Navigation

    • Course

    • Account

    • User

  • LTI Deep Linking

    • Homework submission

    • Editor button

    • Migration selection

    • Link Selection (Modules)

    • Assignment Selection

  • Collaboration

• The external app is equivalent to an already installed tool or Canvas activity.

Request form and questions

Canvas Integrations of External Apps Request Form

Send the following relevant questions to the vendor to help you fill out the request form.

• Requestor Name

• Requestor email

• Requestor ISU role (faculty, adjunct, admin assistant, chair, dean, other ____)

• Link to the Vendor website.

Vendor Risk Review

• Link to HECVAT or SOC2

• Link to Security Policy

• Link to Privacy Policy

Accessibility Review

• Link to VPAT

• Link to Accessibility Policy

Customer Support Review

• Link to Document Support 

• Customer Service Contact Information

• Vendor Rep. contact information

• Link to Status Page

ISU Systems Impact Review

• How many faculty are planning to use this tool during the academic year?

• How many students are anticipated to use this tool during the academic year?

• How many courses are planned to use this tool during the academic year?

• How is this app unique from already installed external app tools or Canvas activities?

• What is the desired implementation date?

• What is the cost for students/faculty?

• Who or which department will be responsible for the associated costs?

• Who or which department will be responsible for support?