Office 365 - Governors Use

[Aldmi]

At the start of term we moved all our governor paperwork onto sharepoint rather then printing it all out for them.

 

I then created generic accounts for governors to login and access sharepoint online to view the documents.

 

However our head has now said governor should not be able to access the schools directory which has the school email address's of students and staff!

 

Does anyone know if there is a way of preventing access to the school directory, but still allowing access to sharepoint?

[TechMonkey]

Do they need email? If not remove the license for Exchange and I think that is the only place it is.

 

For example we have given our Governors SharePoint access but no email as they were concerned about remembering to check a second email account. So the Clerk sends out an email to their usual personal email accounts to inform them that documents are available but nothing gets sent to their email.

[elsiegee40]

Do they need email? If not remove the license for Exchange and I think that is the only place it is.

 

For example we have given our Governors SharePoint access but no email as they were concerned about remembering to check a second email account. So the Clerk sends out an email to their usual personal email accounts to inform them that documents are available but nothing gets sent to their email.

 

Governor hat on: Yes they definitely need email! GDPR, confidentially....

[psydii]

Never tried it, but this might help: https://community.spiceworks.com/topic/1945287-separate-staff-and-student-email-addresses-in-gal

 

I strongly suspect that query may have originated from a member here!

[Wubbalubbadub]

Governor outrank headteacher..

 

Why on earth is it an issue that they can see the school directory!..

Edited January 13, 2020 by Wubbalubbadub

[Aldmi]

I have removed the exchange permissions with removes outlook and the directory.

 

However now noticed that if in sharepoint they type a name and search, it comes up with a list of people?

[MYK-IT]

@Aldmi

 

Further discussions in this thread, including my own findings (that I'm still working on!) (http://www.edugeek.net/forums/data-protection-information-handling/211699-generic-emails-governors-3.html#post1812012)

[Aldmi]

Governor out ranks headteacher..

Why on earth is it an issue that they can see the school directory!..

 

Our head is an Inspector as well and has it in her head that if a governor chose to, they could take contact a student and groom them by having access to their email accounts

[Wubbalubbadub]

Our head is an Inspector as well and has it in her head that if a governor chose to, they could take contact a student and groom them by having access to their email accounts

 

Some people need a cold hard reality check!

 

At the end of the day, if they have suspicions don't appoint them as a governor!

 

Until then.. some professional trust wouldn't go a miss!

[LTurner3692]

Playing Devil's advocate here, But what stops a teacher doing this?

[Aldmi]

Playing Devil's advocate here, But what stops a teacher doing this?

 

Apparently governors don't go through the full checks teachers do!

 

I did point out that given all email address's are created the same (initial, surname, domain) that anyone could guess student emails anyway

[Wubbalubbadub]

Apparently governors don't go through the full checks teachers do!

 

I did point out that given all email address's are created the same (initial, surname, domain) that anyone could guess student emails anyway

Where is he when you need him...

Edited January 13, 2020 by Wubbalubbadub

[TechMonkey]

Governor hat on: Yes they definitely need email! GDPR, confidentially....

 

Not being awkward, but if the email being sent is a message to say the new documents are available on the portal how does that affect confidentiality or GDPR? No documents are sent, no information is in the email.

[Jawloms]

Don't know if you can do it with O365, but with our on-site exchange we just set the student accounts to bounce emails sent from the Governors.

[Katy]

Not being awkward, but if the email being sent is a message to say the new documents are available on the portal how does that affect confidentiality or GDPR? No documents are sent, no information is in the email.

Depends how well trained you have them, but I wouldn't be surprised if governors with no school issued address are sending school data between themselves as "it's easier" than doing it via Sharepoint/Teams. Saying that even with school issued addresses we had a hard time convincing them to use them.

"It might take a bit longer but it's the law" plus the size of GDPR fines finally got it through to them I think!

[chaplic]

I suppose I have a unique viewpoint as I'm chair of governors and an IT bod,

 

So, to answer the question, assuming we are talking email, then it's possible to have a separate global address list for selected audiences.

 

But overall, this is a concocted nonsense

[Mr.Ben]

In my previous role at a L.A, we had exactly this conundrum, but with a single O365 tenancy it was significantly more complicated (90 schools, governors, staff and students).

 

GAL segregation is possible (plenty of info on the web on how to do it).

 

 

We came up with the following scheme:

 

Governors can see every adult across all schools.

 

Staff can see all adults and the Students from only their school.

 

Students can only see staff from their site.

 

Governors cannot email student accounts directly through our system.

 

One thing did trip me up......'Tickling'

 

In on prem exchange, there is a command to force an update of address lists that doesn't exist in exchange online.

 

To get round this I wrote a quick scrip to change an attribute of all user accounts each evening, which forces the update.

[elsiegee40]

Apparently governors don't go through the full checks teachers do!

 

I did point out that given all email address's are created the same (initial, surname, domain) that anyone could guess student emails anyway

 

Yes they do. We governors have to have Enhanced DBS and Section 128 checks just like school staff. It’s all set out in KCSIE.

 

Governors are also bound to have regular Safeguarding training must like school staff.

 

There is no need for governors to have access to student email and I would argue that it should be removed if at all possible. Otherwise, this is managed by risk assessment and training.

[elsiegee40]

Not being awkward, but if the email being sent is a message to say the new documents are available on the portal how does that affect confidentiality or GDPR? No documents are sent, no information is in the email.

 

Because, inevitably, some things are discussed without documents.

 

For example, a pupil exclusion panel being put together. Passing the name of the student to those that are available is normal practice so that governors can decide whether they are without taint. If it turns out the child concerned is your next door neighbour, or you work with the parent then you cannot be part of the panel.

 

Subject access requests are well nigh impossible without school email.

[elsiegee40]

I suppose I have a unique viewpoint as I'm chair of governors and an IT bod,

 

So, to answer the question, assuming we are talking email, then it's possible to have a separate global address list for selected audiences.

 

But overall, this is a concocted nonsense

 

Not so unique... there are a few of us on here

[FN-GM]

Speaking as a UK school governor myself (and have been or a number of years) email would be useful but not necessary. An online portal would be sufficient where documents can be loaded, open, group and private discussions can be held. The software could be SharePoint or something else. Teams might be useful as governors outside of the room can join in via video conference.

 

There is a system called Governor Hub. Although I am not familiar with it.

[mavhc]

So a system where each person has their own login, and can send messages to the other people, in an async fashion...