Student email restrictions

[DavePa]

Having finally (hopefully) resolved the email address problem with AD Connect I now need to decide how to give students email addresses - what naming format, what domain, what rules and restrictions and so on. I worked with a secondary school who restricted students from sending email to each other (bullying) and to the outside world (bringing the school into disrepute). The only people they could send email to was the staff group. The opposite was also true - students could only receive email from staff. Whilst that approach worked it was quite restrictive and may not be suitable here. We are an FE college and students want to be able to get student discount cards and contact potential employers as well as send/receive email from their personal accounts etc.

 

I've considered creating a new .co.uk domain - but that might give them problems with student discount cards if that has to be .ac.uk

I've considered requiring approval for all messages but can see that would require a full time member of staff and wouldn't sit within IT anyway.

 

I'd be interested in knowing how others (particularly FE/HE) approach this - no restrictions at all, some restrictions or totally locked down as in my school example?

 

As always, thanks in advance

[DavePa]

I looked into the NUS card over the weekend and it appears that a .ac.uk is not required - I was able to go through the process (although I didn't go as far as the purchasing screen) using a googlemail.com address. The other benefit we are asked about is Amazon Student Prime which, by default asks for a .ac.uk address but accepts other forms of proof - including a scanned image of a NUS card

 

We allow students to access their personal email accounts through the college anyway so in some ways I am wondering if giving students email addresses is actually something we need to do!

[DavePa]

I'm hoping that this saga is now coming to an end - we *do* need to give students email addresses but we want to keep them off of SharePoint as out SharePoint site is old, not very developed and not very secure as well as having information on it that, although not confidential, is not required for students to be able to view (expenses forms, overtime forms and the like). Unfortunately of course the 'everyone' group within SharePoint has read only access by default and the only way that I know to prevent this is to create subsites with specific permissions which is what we do now. I can probably fix the main SharePoint given enough time but that's something I never seem to have!

 

I've tried not licencing students for SharePoint but cannot find a combination that prevents them from accessing it. Given that we are very likely to register a new domain exclusively for student email use is there an easy way to prevent an entire domain from accessing SharePoint or is it going to be a case of converting all the non subsites into subsites and setting permissions?

[nadeem]

Why not just use a subdomain for the students?

 

As it happens I'm in HE, and I use 2 different .ac.uk domains, one for staff and one for students

[DavePa]

@nadeem Thanks for the suggestion - but as soon as I bring any new domain onto our Offie365 tenancy the students have access to SharePoint don't they? Of course, having a second Office tenancy would be the best answer, is that what you have or are both domains on the same tenancy? I woudn't even need a 2nd .ac.uk, I'm quite happy to register a .co.uk

[nadeem]

I have the one tenancy, but (I did have another tenancy with Sharepoint, but we scrapped that, so my knowledge might be a little outdated) can't you just then modify the Sharepoint permissions to be everyone with SCHOOLDOMAIN.ac.uk has read only, but no one else and then the students with DIFFERENTDOMAIN.co.uk won't be able to access the Sharepoint?

[DavePa]

I have the one tenancy, but (I did have another tenancy with Sharepoint, but we scrapped that, so my knowledge might be a little outdated) can't you just then modify the Sharepoint permissions to be everyone with SCHOOLDOMAIN.ac.uk has read only, but no one else and then the students with DIFFERENTDOMAIN.co.uk won't be able to access the Sharepoint?

 

From what I can make out, everybody is automatically member of the 'everybody' group and by default this group has read-only access to SharePoint. Our SharePoint was created 5 years ago when we gave no thought to students ever needing email addresses and had no understanding or knowledge of SharePoint. As a result the early content (HR/Accounts/IT etc.) was setup as folders so anybody could read them. Later on we started to look at making new parts more secure and ended up using subsites so we could remove the 'everybody' group and create 'visitor', 'member' and 'owner' groups instead. For subsites it's not such an issue but for many parts of the site I need to change permissions to prevent students from accessing them - the problem being that these are not subsites so there will be some jiggery-pokery to do and I don't have a lot more SharePoint knowledge than I did 5 years ago

 

Have you tried connecting to SharePoint as a student? I would expect read-only access to any non-subsite although if your site was properly planned (mine wasn't!) then you may be using subsites with 'everybody' removed already

 

I reaslised after approaching Microsoft and asking about having a 2nd tenancy on the same subscription (which they won't do) that it wouldn't help anyway as Azure AD Connect will only talk from AD to a single o365 tenancy and having a 2nd means I would need to manually create either students or staff but couldn't do both!

 

In summary, thanks for the input - but it looks as if modifying SharePoint to ensure everything is in subsites is the way forward