Access Control

Evaly provides multiple layers of access control to ensure only authorized participants can take your tests. Combine these methods to create the exact security level you need.

Access Control Methods

You can use one or more of these methods simultaneously:

Private Access

Restrict to specific participants by email or group

Password Protection

Require a password to access the test

Email Domain Filtering

Allow only specific email domains

IP Whitelisting

Restrict access to specific IP addresses

Private vs Public Access

The foundation of access control is choosing between private and public access.

Public Access

Anyone with the test link can attempt to access it. Characteristics:

No participant pre-registration needed
Participants create accounts or sign in
Can still add passwords or other restrictions
Test link can be shared freely

Best For:

Open practice tests
Public demonstrations
Marketing quizzes
Anonymous surveys
Self-enrollment courses

Example Use Case:

Scenario: Open practice test for certification preparation

Settings:
- Access: Public
- Password: None
- Anyone can take it
- Results shown immediately for self-study

Private Access

Only explicitly added participants can access the test. Characteristics:

Must add participants via email or group
System verifies participant email at access
More control over who takes the test
Prevents unauthorized access

Best For:

Formal exams
Graded assessments
Confidential tests
Restricted courses
Corporate training

Example Use Case:

Scenario: Final exam for enrolled students

Settings:
- Access: Private
- Participants: Added via student email list
- Only enrolled students can access
- Results withheld until grading complete

Managing Participants

When using private access, you must specify who can take the test.

Adding Individual Participants

Navigate to Access Control

Go to your test and click the Share or Access tab

Add Participants Section

Find the “Individual Participants” section

Enter Email Address

Type the participant’s email address and click Add

Repeat or Bulk Add

Add more participants individually or use bulk import

Email Validation:

Emails must be valid format ([email protected])
Duplicate emails are prevented
Case-insensitive matching

Bulk Adding Participants

Add multiple participants at once:

Click Bulk Add
Paste email addresses (one per line or comma-separated)
Click Import
Review results showing successful and failed imports

Example Format:

[email protected]
[email protected]
[email protected]

[email protected], [email protected], [email protected]

Using Participant Groups

Create reusable participant lists for efficiency.

Creating Participant Groups

Navigate to User Groups in the sidebar
Click Create Group
Name the group (e.g., “Biology 101 - Fall 2024”)
Add members via email
Save the group

Assigning Groups to Tests

Go to test Access/Share settings
Find “Participant Groups” section
Click Add Group
Select the group from your list
All group members can now access the test

Benefits:

Create once, use many times
Update membership in one place
Organizational structure (classes, departments, teams)
Faster test setup

Example Structure:

Group: "Math 101 - Section A"
Members: 30 students

Group: "Math 101 - Section B"
Members: 28 students

Test: "Midterm Exam"
Assigned Groups: Section A, Section B
Total Participants: 58 students

Removing Participants

You can remove participants or groups at any time:

Individual participants: Click the X next to their email
Groups: Click the X next to the group name
Soft delete: Can be restored if removed by mistake

Removing a participant who has already started or completed the test does not delete their attempt or results. It only prevents future access.

Password Protection

Add a password requirement to any test (public or private).

Setting a Password

Open Access Settings

Navigate to test Settings or Share tab

Enable Password

Toggle “Require Password” or find the password field

Enter Password

Type a password participants must enter

Save Settings

Password takes effect immediately

How It Works:

Participants see password prompt before starting test
Must enter correct password to access questions
Password is case-sensitive
Can be changed at any time

Best Practices:

Use memorable but not obvious passwords
Share password through secure channel (not email)
Change password if compromised
Document where password was shared

Example Scenarios:

In-Person Exam
Time-Limited Access

Access: Public (anyone with link)
Password: "Exam2024!"

Workflow:
1. Share test link before exam
2. Display password on screen during exam
3. Students enter password to begin
4. Password prevents early access

Access: Private (student list)
Password: Changes daily

Workflow:
1. Announce password at class start
2. Test available for 24 hours
3. New password next day
4. Limits when students can take it

Email Domain Filtering

Restrict access to specific email domains (e.g., only @school.edu addresses).

Configuring Domain Filters

Open Access Settings

Go to test Settings or Access tab

Add Allowed Domains

Find “Allowed Email Domains” section

Enter Domains

Add domains one at a time (e.g., “school.edu”)

Save

Restrictions apply immediately

How It Works:

System checks participant email during login
Rejects emails not matching allowed domains
Works with both public and private access
Case-insensitive matching

Domain Format:

✅ Correct: school.edu
✅ Correct: university.org
✅ Correct: company.com

❌ Incorrect: @school.edu
❌ Incorrect: *.school.edu
❌ Incorrect: [email protected]

Multiple Domains: You can add multiple domains:

Allowed Domains:
  - university.edu
  - university-staff.org
  - alumni.university.edu
  
Result: Users with any of these domains can access

Use Cases:

Institution-Only Access

Limit to your organization:

Access: Public
Allowed Domains: ["schoolname.edu"]

Result: Anyone with the link AND a @schoolname.edu email can access

Multi-Institution

Allow partner organizations:

Access: Public
Allowed Domains: [
  "university-a.edu",
  "university-b.edu",
  "partner-org.com"
]

Combined with Private Access

Double verification:

Access: Private
Participant List: 100 students
Allowed Domains: ["school.edu"]

Result: Must be on list AND have @school.edu email

IP Address Whitelisting

Restrict test access to specific IP addresses or ranges.

Configuring IP Restrictions

Open Access Settings

Navigate to test Settings or Access tab

Add Allowed IPs

Find “Allowed IP Addresses” section

Enter IP Addresses

Add IP addresses or CIDR ranges

Save and Test

Verify access works from allowed locations

IP Format:

✅ Single IP: 192.168.1.100
✅ IP Range (CIDR): 192.168.1.0/24
✅ Multiple IPs: Add each separately

How It Works:

System checks participant’s IP address on access
Rejects access from non-whitelisted IPs
Applies before password prompt
Works with VPNs (checks VPN IP)

Common Use Cases:

On-Campus Testing

Require students to be on campus:

Access: Public
Allowed IPs: ["10.0.0.0/8"]  # Campus network range
Password: "CampusTest2024"

Result: Must be on campus network to access

Testing Center

Restrict to computer lab:

Access: Private
Participant List: Students enrolled in course
Allowed IPs: [
  "192.168.50.10",
  "192.168.50.11",
  "192.168.50.12"
]  # Lab computers

Result: Must be in testing center on specific computers

Remote Proctoring

Allow specific locations:

Access: Private
Allowed IPs: [
  "203.0.113.0/24",      # Main campus
  "198.51.100.0/24",     # Satellite campus
  "192.0.2.50"           # Proctoring service
]

IP Whitelisting Limitations:

Mobile networks have changing IPs
Home networks may have dynamic IPs
VPNs change the visible IP
Best for controlled environments

Combining Access Controls

Layer multiple restrictions for maximum security:

Security Level Examples

Low Security
Medium Security
High Security
Maximum Security

Public Practice Test

Access: Public
Password: None
Email Domains: None
IP Whitelist: None

Use Case: Open practice, learning resources

Course Quiz

Access: Private
Participants: Student email list
Password: Announced in class
Email Domains: ["university.edu"]
IP Whitelist: None

Use Case: Regular course assessments

Proctored Exam

Access: Private
Participants: Enrolled students only
Password: Unique per session
Email Domains: ["university.edu"]
IP Whitelist: ["Testing center IPs"]

Use Case: Final exams, high-stakes testing

Certification Exam

Access: Private
Participants: Pre-registered candidates
Password: Unique per candidate
Email Domains: Verified domains
IP Whitelist: Proctoring center only
Scheduled: Specific time window
Monitoring: Real-time proctoring

Use Case: Professional certifications

Scheduling & Access Control

Combine time-based access with other restrictions:

Scenario: Midterm Exam

Access Control:
  - Access: Private (250 students)
  - Password: "Midterm2024"
  - Email Domains: ["university.edu"]

Scheduling:
  - Start: March 15, 2024 at 9:00 AM
  - End: March 15, 2024 at 11:00 AM
  - Duration: 2 hours

Result:
  - Only enrolled students can access
  - Only between 9 AM - 11 AM on March 15
  - Must have university email
  - Must know password

Access Denied Messages

Participants see clear messages when access is denied: Private Test (Not on List):

“This test is private. You are not authorized to access it. Please contact the test administrator.”

Wrong Email Domain:

“Access restricted to @university.edu email addresses. Please sign in with an authorized email.”

IP Not Allowed:

“This test can only be accessed from authorized locations. Please contact your administrator.”

Wrong Password:

“Incorrect password. Please try again or contact the test administrator.”

Best Practices

Choose Appropriate Level

Don’t over-restrict:

Practice tests: Minimal restrictions
Quizzes: Moderate restrictions
Exams: High restrictions
Certifications: Maximum restrictions

Test Access Before Launch

Verify:

Test login from participant perspective
Try wrong passwords/emails
Check from different networks
Ensure help resources available

Communicate Requirements

Tell participants:

Where to access test
What email to use
Where to find password
What to do if access fails
Who to contact for help

Document Settings

Keep record of:

Access control settings
Passwords used
Where passwords shared
IP addresses allowed
Schedule/time windows

Troubleshooting Access Issues

Participant Can't Access Test

Check:

Is test published?
Is participant on the list (private access)?
Are they using correct email address?
Is email domain allowed?
Are they within scheduled time window?
Is IP address whitelisted?
Did they enter correct password?

Too Many Access Requests

Solutions:

Verify participant list is correct
Check for typos in email addresses
Ensure clear communication about requirements
Consider loosening restrictions if appropriate
Provide support contact information

Security Concerns

Actions:

Change password immediately
Review participant access logs
Add IP restrictions if needed
Switch to private access
Reset test if necessary
Notify affected participants

Next Steps

User Groups

Manage participant groups

Monitoring

Watch test progress in real-time

Test Settings

Configure other test options

Sharing Tests

Learn how to distribute test links

Overview

For Educators

For Students

Organizations

Access Control

Access Control Methods

Private Access

Password Protection

Email Domain Filtering

IP Whitelisting

Private vs Public Access

Public Access

Private Access

Managing Participants

Adding Individual Participants

Bulk Adding Participants

Using Participant Groups

Removing Participants

Password Protection

Setting a Password

Email Domain Filtering

Configuring Domain Filters

IP Address Whitelisting

Configuring IP Restrictions

Combining Access Controls

Security Level Examples

Scheduling & Access Control

Access Denied Messages

Best Practices

Choose Appropriate Level

Test Access Before Launch

Communicate Requirements

Document Settings

Troubleshooting Access Issues

Next Steps

User Groups

Monitoring

Test Settings

Sharing Tests

Build docs developers (and LLMs) love

Overview

For Educators

For Students

Organizations

​Access Control Methods

Private Access

Password Protection

Email Domain Filtering

IP Whitelisting

​Private vs Public Access

​Public Access

​Private Access

​Managing Participants

​Adding Individual Participants

​Bulk Adding Participants

​Using Participant Groups

​Removing Participants

​Password Protection

​Setting a Password

​Email Domain Filtering

​Configuring Domain Filters

​IP Address Whitelisting

​Configuring IP Restrictions

​Combining Access Controls

​Security Level Examples

​Scheduling & Access Control

​Access Denied Messages

​Best Practices

Choose Appropriate Level

Test Access Before Launch

Communicate Requirements

Document Settings

​Troubleshooting Access Issues

​Next Steps

User Groups

Monitoring

Test Settings

Sharing Tests

Build docs developers (and LLMs) love

Access Control Methods

Private vs Public Access

Public Access

Private Access

Managing Participants

Adding Individual Participants

Bulk Adding Participants

Using Participant Groups

Removing Participants

Password Protection

Setting a Password

Email Domain Filtering

Configuring Domain Filters

IP Address Whitelisting

Configuring IP Restrictions

Combining Access Controls

Security Level Examples

Scheduling & Access Control

Access Denied Messages

Best Practices

Troubleshooting Access Issues

Next Steps