Office 365 lockdown

[Simcfc73]

Morning,

 

just curious if anyone locks office 365 down to limit what the kiddies can do. I've had a look round and you can do some stuff but its quite open. Looking at stuff like stopping them doing blogs or disabling sites (think I have solved that one). Thinks like removing the newsfeed and sites at the top (did find a way to do this but it didn't work). Also them messing with their profile information. I know its built on SharePoint but really we just want SkyDrive and office 365, no interest in sites just yet.

 

Also, where is the link for downloading the software for the students. I have found it once and installed it but I can't find it again.

[Boredguy]

I've restricted out users quite considerably via the Exchange User Roles (Found in the permissions menu)

I created a new Assignment policy for Pupils that has none of the values ticked.

I also created a Outlook Web App Policy to restrict the communication & profile settings.

[Michael]

When specifying the licensing, just by ticking Exchange and nothing else will hide all the tabs you talk of. At the same time (optionally), you can enable these to all staff, or certain members of staff. Office 365 is quite flexible like this

[Simcfc73]

I don't use exchange, its just the Skydrive we want.

[bondbill2k2]

You can prevent pretty much all profile information using Manage Policies under the user profile admin pages. We had some users who had already changed their display photos so we used

Set-OwaMailboxPolicy-DefaultMailboxPlan -DisplayPhotosEnabled $false -SetPhotoEnabled $false

on our student mail policies to hide them and prevent them being changed. We disabled use of my sites for all students by Managing profile service permissions. I'm yet to find a good way to disable blog features, my sites and walls but leave skydrive. I don't think its currently possible because of its close integrated with my sites

Edited February 10, 2014 by bondbill2k2

[Edu-IT]

You can prevent pretty much all profile information using Manage Policies under the user profile admin pages. We had some users who had already changed their display photos so we used

Set-OwaMailboxPolicy-DefaultMailboxPlan -DisplayPhotosEnabled $false -SetPhotoEnabled $false

on our student mail policies to hide them and prevent them being changed. We disabled use of my sites for all students by Managing profile service permissions. I'm yet to find a good way to disable blog features, my sites and walls but leave skydrive. I don't think its currently possible because of its close integrated with my sites

How do you apply that to a particular group of users, for example your students?

[bondbill2k2]

With the policies we couldn't but I bet you could with powershell, the photo settings obviously can be done by mailbox policy so we have staff and students ones. Profile service permissions are done by groups too

[Edu-IT]

Sorry, not sure I explained myself properly. Powershell newbie. With the code you have given above, how would that be tailored to apply to just staff? Is it just a case of changing Set-OwaMailboxPolicy-DefaultMailboxPlan to match the name of the OWA policy you have created for staff? For example Set-OwaMailboxPolicy-Staff if the OWA policy is called staff?

 

Also where are the profile service permissions and what exactly does that stop?

[Roberto]

I know its built on SharePoint but really we just want SkyDrive and office 365, no interest in sites just yet.

 

Not sure how well that will work. Skydrive Pro is the user's SharePoint MySite Document Library. You might be able to lock down what they can do in sharepoint but you can't stop them from having a sharepoint site while letting them have Skydrive Pro.

[bondbill2k2]

Sorry, not sure I explained myself properly. Powershell newbie. With the code you have given above, how would that be tailored to apply to just staff? Is it just a case of changing Set-OwaMailboxPolicy-DefaultMailboxPlan to match the name of the OWA policy you have created for staff? For example Set-OwaMailboxPolicy-Staff if the OWA policy is called staff?

 

Also where are the profile service permissions and what exactly does that stop?

 

 

Yep just change it e.g.

Set-OwaMailboxPolicy staff -DisplayPhotosEnabled $false -SetPhotoEnabled $false

to disable photo uploading and displaying for all members of the staff OWA policy. profile service permissions are found under the sharepoint admin center user profiles page then select manage user permissions. You can then allow or deny permissions to Create Personal Site (required for personal storage, newsfeed, and followed content) Follow People and Edit Profile , Use Tags and Notes. The profile policies page allows you to disable individual fields on their profile such as phone number, full name and all the other fields found on the edit profile page.

[Edu-IT]

It's worth noting that Follow People and Edit Profile has no effect if the create personal site is allowed.