Office 365 - How do you separate teachers and students

[tj2419]

Hi

 

I currently have students and staff on separate tenants. We are looking to merge them all onto one tenant soon. Both using different domains.

 

What i am interested in is how you have segregated certain areas of Office 365 to prevent students seeing things the staff do not want to e.g. documents, sharepoint sites yammer.

 

Could you please add any information you think is relevant to below on what you have put in place?

 

Plan

Email - Create separate GAL for students, Prevent students emailing to groups.

Yammer - Unassigned licence from student accounts, set up a mail flow rule to stop any emails containing the word yammer.

People - Should be fixed by the separate GAL to prevent students looking up staff.

Calendars - Will the GAL change stop students adding staff calendars to see busy / non busy time?

Delve - Is there a way to turn this tile off? Or prevent students finding staff documents using this?

Sharepoint - This is the main issue. I am yet to find an easy way to lock this down. If anyone can share what they have done i would be eternally grateful.

 

Also staff keep creating groups that show up in sharepoint. Is there a way to stop this?

 

Thanks

[snagrat]

Well Sharepoint is built on permissions so if the Pupils don't have permission to see the site then they won't be able to.

 

Similar to Delve. Delve will only show documents the user has permission to see - it won't just so all the staff files.

[tj2419]

Well Sharepoint is built on permissions so if the Pupils don't have permission to see the site then they won't be able to.

 

Similar to Delve. Delve will only show documents the user has permission to see - it won't just so all the staff files.

 

I see there are only three levels of permissions View, Edit, Owner. If I just don't assign them any does that mean they cannot access it?

 

Cheers

[xlandhenry]

GAL separation can only stop students from looking up staff and distribution groups. It will not stop them from sending emails or adding calendar if they know the address.

You can turn off Delve by turning off Office Graph in SharePoint I believe, but that's not recommended because it will break a lot of other things. Not sure why you want to disable Delve though, students won't see on Delve what they don't have permission to.

For SharePoint you can turn off the Sites tile, and site owners can set site permission to allow only the people he/she wants to have access.

As for groups? You've got to have some guidelines for creating those? Or if you want to disable group creation for some people it can be done using PowerShell. See https://support.office.com/en-us/article/Use-PowerShell-to-manage-Office-365-Groups-Admin-help-aeb669aa-1770-4537-9de2-a82ac11b0540?ui=en-US&rs=en-US&ad=US

[Tefters]

Why would you want to stop students emailing teachers? I'm usually overprotective too but there is a need for teachers and students to communicate, if they abuse it then block email for a week or two.

Blocking Send permissions to groups is easy via dist group properties.

[tj2419]

Why would you want to stop students emailing teachers? I'm usually overprotective too but there is a need for teachers and students to communicate, if they abuse it then block email for a week or two.

Blocking Send permissions to groups is easy via dist group properties.

 

I am trying to persuade the powers that be that it would be better to have staff and students be able to email each other too. It was blocked a while back but now Office 365 is used more and more it makes more sense to use it. But need to have the restriction in place for now. Have managed to achieve it with mail flow rules.

[Tefters]

I am trying to persuade the powers that be that it would be better to have staff and students be able to email each other too. It was blocked a while back but now Office 365 is used more and more it makes more sense to use it. But need to have the restriction in place for now. Have managed to achieve it with mail flow rules.

 

That was going to be my advise.

 

As a tip for you - If you want an easy way to block students from email for a week or two (swearing, bullying etc...) then create a simple mail flow rule saying any mails sent from or received to "insert naughty pupil user" then send an auto-response saying "I've been a naughty student and the IT department have blocked me for misusing email", a lot more effective then removing and re-adding licenses and makes them look stupid when they keep trying to send/receive emails and then see the auto-response