The LMS and Studio Django Admin Interfaces#
Both major Open edX services — the LMS and Studio (CMS) — are built on the Django web framework. Django provides a built-in, automatically generated administrative interface, commonly called the Django admin, that lets authorized users view and edit application data directly. Because the LMS and Studio are separate Django applications, each one exposes its own, independent Django admin:
The LMS Django admin, served from your LMS domain at
/admin/.The Studio (CMS) Django admin, served from your Studio domain at
/admin/.
Each admin only exposes the applications installed in that service, so the set of available tools differs between the two. An app that appears in one admin is not necessarily present in the other. For example, the Course Creators app used to grant course creation access exists only in the Studio admin, not the LMS admin. When following a how-to that references the Django admin, be sure to use the correct service’s admin.
What the Django Admin Is For#
The Django admin is intended for administrative tasks that require elevated privileges and are not exposed through the normal LMS or Studio user interfaces. Site operators and other trusted administrators use it to inspect and adjust platform data and configuration — for example, managing feature toggles and waffle flags, reviewing or editing user records, and changing settings that are deliberately kept out of the day-to-day authoring and learning experiences.
Access to the Django admin is restricted to users with staff
(is_staff) or superuser permissions. Because these interfaces can read
and modify sensitive data across the platform, admin accounts should be granted
sparingly and treated as high-security credentials.
Security Considerations#
The Django admin is a powerful, high-privilege interface. To reduce risk, when possible you should protect the LMS and Studio admin interfaces from open access over the public internet — for example, by restricting them to trusted networks or a VPN, placing them behind additional authentication, or otherwise limiting who can reach them. Combined with granting admin privileges only to the users who genuinely need them, this helps limit the impact of compromised credentials.
For more detail on how the admin works and how it can be configured and secured, see the official Django documentation:
See also
Maintenance chart
Review Date |
Working Group Reviewer |
Release |
Test situation |
2026-08-14 |
Ty Hob |
Verawood |
Pass |