Office 365 - Do you have staff and students on the same tenant?

[tj2419]

Hi

 

Sorry yet another Office 365 question from myself.

 

Do schools that use office 365 for both students and staff have them both on the same tenant or on separate ones?

 

The reason i ask is to use sharepoint for shared resources etc it must be complicated with two tenants / not workable?

 

We currently have them separate to prevent staff accidentally emailing students. Is there a way to prevent this with them on the same tenant?

 

Kind of like a wall between the two domains to stop them emailing each other?

 

As a side not does anyone user yammer with all their staff and students on the same one?

 

Thanks

[GeekyPete]

Same tenant sure, Set up staff and student dynamic mailing lists (groups) which works well. The only issues we tend to have with people mailing the wrong person is when they have the same name. If that happens we append (pupil) to the name of the student.

[tj2419]

Same tenant sure, Set up staff and student dynamic mailing lists (groups) which works well. The only issues we tend to have with people mailing the wrong person is when they have the same name. If that happens we append (pupil) to the name of the student.

 

That's our main worry. Our staff tend to do it a lot mixing our staff up and staff at our LEA. For that it isn't too much of an issue but sending information about SEN students to a student at the school could be a major issue.

 

Thanks

[FN-GM]

We have multiple schools both staff and students on the same tenant. Create a GAL for each type of user.

[clockend25]

Same tenant. Students are listed with their full name, staff with just their first initial and second name.

[JRowley]

Same tenant. Students are listed with their full name, staff with just their first initial and second name.

 

Same as above.

[GeekyPete]

That's our main worry. Our staff tend to do it a lot mixing our staff up and staff at our LEA. For that it isn't too much of an issue but sending information about SEN students to a student at the school could be a major issue.

 

Thanks

 

Putting them on separate tenants won't solve that problem anyway. Staff will want to email students too, so the mailboxes will have to be available. As long as it's obvious which is which by either naming convention or tagging Student/Staff you've done all that you can. The rest is down to staff stupidity or in-attention.

[DCUK6]

WE put them on seperate systems.

 

Cant remember why. I know one reason is so i could give the ICT teacher access to the admin side of the pupil system.

 

There was something office 365 that students didnt get along with. They love google mail.

[gshaw]

We have them on the same tenant, a couple of insights into the pros and cons:

 

• All licensing is covered through our EES agreement, MS told me that if we had a second tenant we'd need another agreement
  
• DirSync works fine fro multiple OUs to the one tenant; the scenario of multiple OUs to different tenants via the same instance of DirSync was something MS warned me off doing as it could make a horrible mess if something goes wrong
  
• No issues with mixing staff \ students on Exchange, we've set up separate Address Book Policies for GAL separation
  
• SharePoint is a problem though, no way to separate data so any stray permissions or shared documents are potentially visible to students which is a concern. We tried restricting the search site via permissions but that seems to have reset at some point. Delve also brings another way to find documents that maybe otherwise wouldn't be seen.
  

 

No Yammer here at present, is it integrated properly now as I remember the early versions being quite clunky in terms of how it talked to the rest of O365

Edited June 9, 2015 by gshaw

[tj2419]

Out of interest then for everyone who has them all on the same tenant. Can students view your whole GAL? Could they technically email a mailing group e.g. all staff?

 

Also noticed whilst testing they could add staff calendars to their calendars and view their busy free information. Not sure this is a major issue really.

 

Cheers

[FN-GM]

Out of interest then for everyone who has them all on the same tenant. Can students view your whole GAL? Could they technically email a mailing group e.g. all staff?

 

Also noticed whilst testing they could add staff calendars to their calendars and view their busy free information. Not sure this is a major issue really.

 

Cheers

 

If you leave it as default yes. But if you make your own GAL's and address lists no.

[clockend25]

Our groups are locked down so that only certain people can send mail to them.

[Edu-IT]

If you leave it as default yes. But if you make your own GAL's and address lists no.

Any decent guides on doing this?

[mb2k01]

Same tenant, but a separate domain to staff (well, a sub-domain)

Staff have @school.net and students have @students.school.net

[The_IT_Guy]

Sorry to revive an old thread but i am currently investigating moving our students onto the same tenant as the staff.

 

So far i have disabled the yammer licence for students and blocked emails mentioning yammer to the student mailboxes to stop them signing up via the internet as staff use yammer to collaborate between departments.

 

I am going to create separate GAL's for the students and staff. One question i have. Currently all the groups etc and external contacts are in our GAL. If i create a seperate one for students can i just leave staff on the one they are on currently so they won't see any changes?

 

Sharepoint seems to be an issue. I can see how you can change permissions but i can't see any sort of deny rules, just read, edit, own etc. How have you locked down your sharepoint and delve?

 

Thanks

[gshaw]

Separate GALs in Exchange work well but SharePoint is a pain to be honest.

 

There's no way to separate content in the same manner so any rogue shares by users e.g. sharing a OneDrive file to all by mistake will be visible to students. Similarly the people picker always shows student accounts as well as staff unless you get development work done to alter the behaviour.

 

Ultimately you can set up permissions on SP site collections etc. to restrict access but the content boundary is the tenancy so the product can't be segmented as much as we'd like to.

 

All that said dual O365 tenants is an even worse scenario so it's something we've had to live with.

Edited March 16, 2016 by gshaw