Office 365 - Student Restrictions

[kennysarmy]

Can I ask anyone who is using O365 how many restrictions you impose on your students?

 

I'm migrating our on-prem email solution at Easter (Mdaemon) to O365, but see that opening up the whole of Office 365 to the students will allow them to play with a whole raft of apps; Yammer, Microsoft Teams, StaffHub, Planner etc etc.

 

Is it better to disable / turn off access to all these weird and wonderful apps until I get to grips properly with what they can do, or do people generally just leave everything on by default as not much harm can be done?

 

We've got Office 365 ProPlus for faculty and students which from reading says it comes with 1Tb of storage per user - presumably this is 1Tb per user across all the Apps? So they could have 1Tb of emails and nothing else or 500 Mb of Emails and 500 Mb of Files uploaded to a sharepoint site?

 

Thanks

[Boredguy]

We currently assign students licences for 15 out of the 18 apps available under the A1 Plus licence (Skype for Business, Yammer and Office Online being the 3 declined ones)

 

Within the Azure Active Directory -> Licences -> Products, you can assign AD groups to the different licences to automatically assign them to your users (you can not use nested groups), and turn off specific apps licences for that group, so you don't have to do it per person.

 

If you look in the Purchased Services in the 365 admin centre, and select Education, you might have access to some of the A1 licence plans which are free, and allow more features than the ProPlus one you mentioned. The best one currently, but can require a lot of hitting of MS, is the Office 365 A1 Plus for faculty/student.

 

There is some global configuration you might want to do for 365 to aid restrictions, which include disabling the ability to update their contact image. All of which can be done via powershell

[chaplic]

I would recommend disabling the licenses (as boredguy says) until you are ready to launch, as there certain governance stuff you might want to put in place.

 

Going forward, you need to consider new features rock up all the time - sometimes enabled by default- and how you are going to know this and plan for it.

[johnpd]

We had an issue in SharePoint where even though you make it private and members only - there exists a group by default called everyone - effectively allows members to accidentally open doors to private sites. The same goes for my authority/authenticated users group In SharePoint and visitors group.

 

So disabled sharepoint licence would be helpful to get things in order firstly.

Edited March 8, 2019 by johnpd

[johnpd]

Forgot to say - goto Admin centre for OneDrive and sharepoint and set to least permissive settings and disable sharing with external users. This will help with data loss policy.

[mavhc]

Once you disable external users the only real problem is kids communicating with each other, need to monitor for bullying, but point out to them that everything is recorded under their own name, so any misuse is easy to track back to them.

[kennysarmy]

OK, so the migration has gone well...

 

I've just seen that a few students have started creating "groups"!

 

Is there a way to prevent students from creating groups?

 

And staff, someone tried to create a distribution list for themselves and instead created a group with external addresses in it, even though it was private students were able to see the group and the e-mail addresses of the members.

[Boredguy]

We disable 365 group creation via powershell as our students are assigned a different mailbox policy via our licencing script (we're not using the Azure Auto assign)

Set-OwaMailboxPolicy -GroupCreationEnabled $false

 

There is also this method, but I've not tried it yet even though all our staff do have azure basic edu assigned

https://docs.microsoft.com/en-us/office365/admin/create-groups/manage-creation-of-groups?view=o365-worldwide

[kennysarmy]

We disable 365 group creation via powershell as our students are assigned a different mailbox policy via our licencing script (we're not using the Azure Auto assign)

Set-OwaMailboxPolicy -GroupCreationEnabled $false

 

There is also this method, but I've not tried it yet even though all our staff do have azure basic edu assigned

https://docs.microsoft.com/en-us/office365/admin/create-groups/manage-creation-of-groups?view=o365-worldwide

 

Very useful - many thanks, the powershell script in the link worked a treat.