Office 365 Education Questions

[OliverLennox]

Hi All,

 

Apologies if this has been asked a million times (I checked the stickies but couldn't see the answers I was looking for). I work for an IT solutions provider and we deal with O365 all the time but only in a commercial setting. We're currently involved in a project to roll-out O365 Education for a small school that we work with (the school itself is part of a larger care organisation) and this is new territory for us so I was trying to find some advice on it. I've done a lot of Googling but there seems to be very little information out there.

 

Some questions:

 

 

• At the moment they have a few 'all staff' SharePoints / Document Libraries accessible with the "Everyone except external users" group. As I understand it this group would also contain student users, so what's the best way to identify student vs. faculty users moving forward? are there any built-in groups for this or do you have to manually create Staff/Student groups and secure appropriately?
  
• In terms of locking things down for student users; are there any obvious gotchas here to look out for? We already restrict the ability to create new Sharepoints and new Teams Groups but are there any others?
  
• What do you guys normally do about Student email accounts? Are there any guides out there for configuring Exchange 365 to appropriately lock these down? Potentially we would only want students to be able to send emails to the teaching staff and no one else
  

 

If anyone could provide anything information on this or a link to a good admin guide then it would be much appreciated!! I figure that most of these issues will be faced by every school using the platform so I don't want to reinvent the wheel if there are easy preset configurations for all this stuff!

 

Many thanks in advance,

 

Olly

[robyholmes]

- You'll need to create staff and student groups. If your syncing with AD the school might already have a staff and student group. If not you could try using a dynamic group which looks for the licence applied to the user (Faculty Licence or Student Licence) and adds them to the group.

 

- Limit who can send emails to staff groups is a good idea. You can do this on the group itself either in AD (If you have the Exchange schema) or in Office 365

 

- We limit Year 7, 8 and 9 students to internal emails only but allow trusted sources (Education sites for example). Year 10 and Year 11 are fully open to all external. Create a bad words list using email rules to catch any 'bad words' reaching students, or even worse, students sending.

[OliverLennox]

Thanks Roby,

 

Have you had any luck with Dynamic Groups for this? I did a test run and it seemed to detect both A1 (Student) and A1 (Faculty) as the same underlying license type?

[Boredguy]

Assigning licences can done via the Azure portion of Office 365 (https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Licenses) and lets you use synchronised AD groups.

[robyholmes]

Thanks Roby,

 

Have you had any luck with Dynamic Groups for this? I did a test run and it seemed to detect both A1 (Student) and A1 (Faculty) as the same underlying license type?

I'm sure it did work but that was a number of years ago before I synced with AD.

[psydii]

Not sure it helps in this scenario but...

 

(Get-AzureADUser -SearchString USERNAME).ExtensionProperty.extension_fe2174665583431c953114ff7268b7b3_Education_ObjectType

 

Returns Teacher (if a user is a member of staff) or Student (if the user is a student) if you have used SDS.

 

The way we do it (because like most institutions we have a legacy AD) is to use Salamander to provision users and groups on prem, sync that with Azure AD Connect, and then their automations for SDS to provision classes and the extended attributes.

 

Microsoft 365 licences are deployed to groups that have synced from on Prem. At this point the "all staff" and "all students" groups are nearly 20 years old; before we had Salamander there was a rough export from the MIS to CSV and then that was sent through some VBS scripts to populate AD.

 

If you are building from an on Prem AD get Salamander - there is no point in re-inventing the wheel for the customer, and it free your people up to deliver more visible benefits to the school.

 

Locking down Teams so it remains both useful and Safe is the biggest pain. If you lock it down as per the noisiest paranoid teachers' request you break all useful functionality. If you do nothing, you are really wide open on the safeguarding front. The intended outcomes from the default secondary student policies are a great balance.

 

Risks from email and im/chat are primarily a training issue - safe online behaviours need to be embedded in the teacher training/induction and across the curriculum. Here is a selection of resources drawn from across the country by LGfL https://www.lgfl.net/online-safety/resource-centre GDPR is very important for teachers - they tend to be very sloppy with their handling of data if not regularly reminded.

 

But in general tt really does have to start with teachers ensuring students feel safe and empowered to report inappropriate behaviours, and making those inappropriate behaviours unacceptable. LGBT+ History Month, Black History Month, National e-Safety week, and anti-bullying week all echo echo each other on tolerance, acceptance and calling out inappropriate behaviours.

 

On the IT angle, teachers need to be confident of the technology and the support team behind it. We have far less strict filtering and restrictions than many schools, but combined with the culture we (IT) are able to perform rapid near-forensic analysis of incidents that took place on platforms we manage (Defender ATP makes this *much* easier that it used to be) we provide teachers with a platform that does not get in their way, while still providing a safe environment for the students.