Gsuite - block pupils from emailing groups

[sjpf]

Has anyone got any suggestions for blocking pupils from emailing groups? I know you can setup message restrictions but this would involve maintaining a list of approved people pupils can send to. Group posting permissions aren't helpful either. The only thing I can think of is to use content compliance in the admin console and setup expressions so that the Pupil OU has a rule applied which says that any emails going to a particular address are blocked.

 

Thanks

Simon

[ChrisMiles]

Yeah this is quite a common requirement but unfortunately you cannot do it with group permissions.

 

Another option is enabling message moderation, which is what we use for parent groups, but I realise this is too inconvenient for some types of group.

[Primus]

You can use a routing policy to prevent them emailing the mailing lists.

[TwistedHelixis]

You can use a routing policy to prevent them emailing the mailing lists.

 

I was just about to say that :-P

[jthompson]

All our staff groups have an address starting "staff." (e.g. staff.slt@school.org). In the G Suite advanced settings, we have a content compliance rule enabled on student OUs that rejects any emails with recipients matching staff group address. One content compliance rule therefore covers all our staff groups.

 

 

You could probably get away with just having Internal - sending ticked here. It does mean that a message addressed to a staff group and also to individuals will be rejected outright and not delivered to any of them, but the rejection message makes this clear.

Edited June 28, 2019 by jthompson

[sjpf]

Thanks. A routing policy would work fairly similarly to how I have content compliance currently setup. Just trying to figure out the expression I need because regex is so bloody complicated! Most of our groups begin within "all" for example, "allyear8" so I need something like all*@!!

[Arthur]

Just trying to figure out the expression I need because regex is so bloody complicated! Most of our groups begin within "all" for example, "allyear8" so I need something like all*@!!

The following regex should do what you need. Just replace example.net with your actual domain.

 

https://regex101.com/r/ZD9Of4/1

 

^all.+@example\.net$

 

Edited June 28, 2019 by Arthur

[jthompson]

With a routing setting, how would you match only against student senders?

 

- Edit. Ignore, I'm looking in the wrong place!

Edited June 28, 2019 by jthompson

[sjpf]

only apply the routing rule to the student OU

[sjpf]

Thanks for everyone's help. I have setup a routing rule applied only to the Pupil OU which rejects messages when the expression is matched.

[keyboards]

We've got it so pupils only see their bit, ie they can only see other pupils

[sjpf]

We've got it so pupils only see their bit, ie they can only see other pupils

 

Did you do that with custom directories?

[keyboards]

Did you do that with custom directories?

 

Off the top of my head, I think so, if not I think we've got it students can't see anyone bar themselves at primary's

[sjpf]

Custom directories sound like what you have done as I am not aware of any other way of doing it. Even doing that wouldn't work for us because the pupils know some of the group email addresses so they'd still be able to email them, just not look them up in the directory. I spoke to a company who provide Gsuite support and the routing rule was going to be their suggestion.

Routing rules are pretty good if you have a naming convention