Office365 - Staff and Pupil email separation

[AdamCollett]

I have migrated the school staff to Office365, more specifically Exchange Online for email as they were using an old mail server on the domain controller which was overloading things and causing problems.

 

RM have now removed EasyMail for the pupils and I am tasked with finding an alternative. I thought the best option was to add a subdomain to our Exchange Online offering and register the small number of pupils that require email accounts on this system.

 

The problem we have is excluding pupils from the "All" address list and preventing them from seeing the global address list of all staff addresses.

 

I have had a crack at setting up Address Book Policies for the pupils to restrict what they see, but this doesn't seem to work and when opening their web mail they are still able to see staff addresses.

 

I followed this article GAL Segmentation in Office 365, Address Book Policy Routing | FLEXECOM to try and resolve this, but it is not working.

 

I was interested to see what others have done for free pupil email and if anyone has succeeded in splitting their Exchange Online offering into staff and pupils like I intend

 

Any help greatly appreciated

 

Adam

[5tu]

Hi Adam

 

I've done exactly as you've attempted to do, following the same user guide. Our students have a separate GAL but exist in the same Office 365 tenancy as staff. Can you give any more details as to what isn't working?

[AdamCollett]

Hi,

 

When I log in to the pupil email account (test account I created and assigned to the Address Book Policy) I can still search the staff address list. Ideally pupils should not be able to search or look up staff email addresses.

 

The only bit of the How To article I couldn't do was assigning the rule via GUID - as we only have 5 or 6 pupils that require an email address I assigned the ABP in the Exchange Control Panel under the user account.

 

The other thing is excluding the pupils from the Dynamic Distribution Group "All" that we have set up - but I think I can manage that bit by assigning them to a mail group and excluding that group from the Dynamic Distribution Group.

 

Thanks

 

Adam

[SteveM555]

We have them split up via subdomain... [email protected] for staff and [email protected]

 

Students can look up staff email addresses, our email distribution groups are set so only members of the group can email them (apart from specific groups which are private only) - So no students can email or join staff groups etc.

[Matt_Renato]

The contents of an address list aren't updated until a change is made on the account(s) that should appear on them. This article explains the issue really well, and contains a link to a Powershell scripts that can force an update on objects so that they will appear in address lists.

[AdamCollett]

Thank you all for the input - it turns out I was being a bit impatient and hadn't waited for the changes to trickle through the Microsoft systems. I have now tested the student account again and it cannot look up staff addresses.

 

I have also used the powershell command to exclude the pupil accounts from the "All" Dynamic Distribution List by setting their office location to "pupils" and then using powershell to exclude them from it as follows:

 

Set-DynamicDistributionGroup -Identity "All" -RecipientFilter {((RecipientType -eq 'UserMailbox') -and -not(Name -like 'Helpdesk')) -and (-not(Name -like 'Office Admin')) -and (-not(Office -eq 'pupil'))}

 

That command prevents our helpdesk system and the pupils from receiving messages sent to the "All" dynamic distribution group, but ensures all mail enabled users get those emails.

 

Thanks

 

Adam