Giving AD and Office 365 accounts to non-employees

[Sonic3]

Like most schools, we have people working here regularly who are not actually employed by the school but "require" access to the computers and/or our MIS (SIMs) and/or their own e-mail account in our system (as if they are part of the school). Since taking over from my predecessor I'm trying to crack down on this in terms of the child protection and data protection/GDPR issues it raises, and determine how it can work with our automated account creation/synchronisation system, Salamander.

 

Right now Salamander is set to check SIMs for new staff and and new pupils and create both a new Active Directory account and an Office 365 account for them, based on the information SIMs provides. It does not, however, check for 'Outside Agency Staff/Members'.

 

From what I know right now, there are the following types of people who work here regularly but are not employed by the school:

1. Short term/emergency supply teachers
   
2. Long term supply teachers
   
3. People from outside agencies such as careers advisors
   
4. People who are employed by the LEA such as youth mentors
   

 

So my question is, how do you determine for each type whether or not they should be given AD accounts, school office 365/e-mail accounts, and/or MIS access (so they can see pupils' data), what access they should have using each (e.g. should they be allowed to e-mail pupils? Should they have access to certain shared/network folders?), and what documents/agreements they should sign before having access (if necessary)?

[Ditto]

If you can define the rules in terms of data value in SIMS (i.e. if marked as Outside Agency Staff/Members etc.), then I suggest speaking to Salamandersoft to see if they can tailor to your needs. They may even have recommendations as I would think others would have asked for this functionality in the past.