I am using Moodle 4.1.13+ (Build: 20240910) as the LMS which will redirect to an external tool with the LTI 1.3 standard. The redirection works successfully, and the external tool is able to send grades and feedback to the LMS gradebook without issues.

For each new course, I restore it from a backup file of a previous course. The backups were created in a different site, with the tool being defined at site level. However, I have observed that the id_token in the launch request does not include the NRPS claim (https://purl.imsglobal.org/spec/lti-nrps/claim/namesroleservice). I confirmed that in the external tool configuration, the IMS LTI Names and Role Provisioning Service is set to "Use this service to retrieve members' information as per the privacy settings”.

Interestingly, the NRPS claim becomes available only when I perform a content selection to add another exercise to the course. Once the exercise is removed, the NRPS claim is no longer present in the launch request.

I updated my Moodle version to the latest version of Moodle 4.5.1+ (Build: 20241213) but the NRPS claim is still missing in the launch request. I also compared the .mbz backup files of a course with the NRPS claim and one without it but could not identify any significant differences.

Clarifications:

• Where can I find the privacy setting mentioned in the configuration?
• Are there any settings that I missed or have to set during the restore in the restore settings?

Replication steps:

1. Create a site-level 1.3 tool in Site A, making sure to enable the Names and Roles service
2. Create a course in site A
3. Using deep linking, create a link to the tool in the course
4. Backup the course, using "Jump to final step"
5. Download the backup mbz
6. Go to Site B
7. Create a site level tool configuration for the same tool as was used in Site A
8. Now, restore the backup into a new course. You should see the single LTI link activity
9. Click the activity to launch into the tool
   Expected: The JWT contains the namesroleservice claim
   Actual: The JWT doesn't contain the namesroleservice claim