Giving 3rd party companies admin logins to your Google Apps / Office 365 Environment?

[flyinghaggis]

Our SLT are keen to find a way of syncing our MIS database (SIMS / WCBS) to our Google Apps domain so that pupil/staff timetables can be auto-populated and Google classes/groups are automatically created based the information contained with our MIS database. We've been approached by a small company who've offered to sync these two systems.

 

I'm slightly apprehensive about the whole process as they've asked for a Google Super-Admin account in order to run their nightly sync between the two systems. Most of our other Google Service providers/partners just use an app which can be approved through the admin console for the specific areas it needs access to. I queried them on this but they stated they have to run several processes as part of the sync which could only be carried out with a super-admin account.

 

I fear giving them a super-admin accounts robs us of any visibility/accountability of what they're doing within the domain and it gives us no visibility of the sync itself. I worry the sync may not run correctly and could bulk update users Google accounts with incorrect information/appointments/permissions or create spurious Classrooms/Groups in our Google domain.

 

Has anyone else been in this position of being asked to provide a 3rd party company with admin logins to their cloud systems?

[BKGarry]

We do this with Salamander, but as the username and password are in config files saved here onsite it is not an issue.

 

They have their own App for publishing it and we give the password for Office365.

 

TBH it is the best money I spend all year, saves so much work, not just for us but for teachers and other support staff as well.

[flyinghaggis]

We do this with Salamander, but as the username and password are in config files saved here onsite it is not an issue.

 

Thanks for the suggestion. In terms of the sync itself what actually happens to the data once it is extracted from the MIS system? Do you have access to a console which is installed on a local server so you can see what the sync is going to do and setup how it will work? Or is there a website login?

[BKGarry]

It is essentially a bunch of scripts that sit on your server and extracts the data from SIMS nightly and pushes it to where you want.

 

It has loads of functionality, I get emailed when a new student is sync'd from SIMS.

It saves logs files on the server where it runs. Their support is also awesome, I email them and I have someone on my server within an hour modifying things, making new groups based on lots of items from SIMS. It can also sync the students photos from SIMS to G Suite and O365

 

Have a look here, there are tones of people on here that use them, there is even a thread purely singing their praises

 

SalamanderSoft Limited

[Roberto]

We're doing something similar to O365 as a new customer of Salamander and it works well enough.

 

I think you're right to show concern and want to do due diligence of the process any supplier would use, I certainly wouldn't have been keen to do something with a new supplier that I had never heard of as we have potentially given Salamander a high level of access to data and services. However, they have a good reputation here and behaved with the utmost professionalism in how they approached rolling out their service with us.

 

I would suggest if you use another supplier for a sync service that you do the same: fine one with a pedigree you can trust and ensure that they can demonstrate good working practice. Do not share credentials with them, so that if there are issues you can check which actions were taken by the 3rd party's staff and/or service.

[flyinghaggis]

That's what worried me really. The company we'd been asked to look at initially was a very small (2-man AFAIK) one which had only been started about 6 months ago so references were hard to come by and they had no previous experience of the MIS we're currently using. Given the level of access they were requesting it made me very nervous.

 

In terms of the way Salamander sync's do you have visibility of which user details/groups/classrooms/etc it's going to update and modify when it runs the sync. That was another concern I had with the original company as once we extracted our MIS information exported it via GroupCall we had no visibility or control over the Google Apps sync process itself until it actually runs. And the sync was running remotely on this companies system rather than our own.

[BKGarry]

I am afraid it does tend to just run for us but they can do a log only run I do believe. You may be best contacting them.

[Roberto]

we had no visibility or control over the Google Apps sync process itself until it actually runs. And the sync was running remotely on this companies system rather than our own.

 

Ok, i wouldn't be happy with that. It's your data, you own it, you're responsible for its use. I would want visibility myself, and that's one of the good things about what we're doing, it runs on _our_ servers.

[jmak]

Groupcall have a similar offering and again, their software sits on one of our DCs. It needs admin rights to run, but I didn't have to share account details with them (it's hashed in the application) and there's also a log.

[markwilfan]

+1 for salamander. Amazing software and support is incredible