XM Directory Lite vs. Full in Higher Education

I am also very interested in this. I just switched all my faculty and staff to a Lite directory. We were on the full implementation, but I started noticing that when others across campus added embedded fields, or when I as the admin did, those fields would show up for people that should not be seeing them. So, people who may not be provisioned for detailed data could see student identifiers because I was using those as embedded fields in certain surveys. This felt like a FERPA violation. I attempted to find the settings to minimize this and was unsuccessful. It may exist out there, but I couldn’t locate the solution and neither my rep nor the help desk answered my question when I posed it. This issue also caused problems of competing data. It made the overall Full directory very messy because things I set at the admin level were being affected by things others embedded. I have the duplication validation set, so as people uploaded new lists of students, older data was overwritten as the system recognized duplicates. It didn’t happen all the time, but enough to be annoying. 

If you know how to better manage the access, please enlighten me! I read all the help material, but did not find a solution. 

Instead, I have a Full directory available to admins and then all Faculty/Staff have the Lite versions. I keep my Full library updated with our current students for our large campaigns. Or at least intend to. I’m still figuring it all out. 

Hi ​@heatherchapman thank you for your follow up! You are definitely not alone as there are a lot of complexities when it comes to managing a Full directory for a large user base. Here are my thoughts and recommendations I often give customers: 

• If you want users to have a limited view of just their own contact lists, I recommend disabling the Manage Directories permission for users. This way, they cannot see contacts they did not upload / were not shared with them, and they only have access to their own lists. Disabling this permission will also remove their ability to manage directory settings (creating identity resolution rules, contact frequency, etc.). 
• If you don’t want users to be able to update/overwrite each others’ contacts, I recommend not having an identity resolution rule for the directory. When an identity resolution rule is in place, there is the possibility for your contacts to update embedded data on another user’s contacts, and vice versa. This is obviously a concern when it comes to PII and sensitive data that isn’t supposed to be shared.
• As you have found, you can create multiple distinct directories, and you have the ability to choose if they are built using the Full or Lite directory platform. When a directory is built using Lite, it is almost as if each user has their own personal directory -- there is no chance of merging contacts across users, and users cannot see each others’ contacts / embedded data unless a list is specifically shared with them. 
• If you have a need to create a directory for a team of users, but do not want to share the directory across the entire user base, you can create the new directory and use role based access to determine who is able to access the directory. 

Please let me know if you have any follow up questions or thoughts on these approaches!

We have lite. We purchased full in a separate brand for a specific initiative and then shut it down when finished.

We have the same concerns as Heather - because of the research studies that might include students, and other sensitive uses, it’s even not great for admins to have an easily accessed view of the participation of each user across surveys. (But it sounds like from your response, that might not be an issue if almost everyone is still creating Lite contact lists?)

At the time we used full directories, our main use case was automatically distributing surveys based on list membership. We were working with feeds of students, and when students met certain criteria they were put on a list and automatically sent a survey.

Your advice to Heather is very helpful. We don’t have another use case for full directory right now, but it’s good to know in case it comes up. 

​@jglennon all of our user types have the Manage Directories toggled off already and we were still having the issues. Looking at our settings and reading your suggestions, does it make sense then to have one full directory with identity resolution enabled for admins and then another without that feature for faculty and staff? Would those faculty and staff still have access to one another’s embedded fields and contacts in that scenario?