Google Admin Console

[mikeishere555]

I know I could search the internet high and low for suggestions, but I was wondering if there are any settings, app-level or global, that you have discovered on your travels that you would consider essential for your Google Apps. From my own experience there have definitely been a few things we have found out the hard way! I’ve included a couple of examples below to kick things off:

 

1) Release Track

https://support.google.com/a/answer/172177?hl=en

The default setting for when users receive new features is scheduled release, at least 1 week after release. With Google adding new features all the time (particularly to Meet) I have changed this to ‘rapid release’ to get the latest updates asap. I have had several colleagues asking me why/how we managed to get [feature] before their friend’s school which always makes you look good!

 

2) Google Meet - Telephony

https://support.google.com/meet/answer/9518557?hl=en-GB

This is a classic example of something that I wish I had come across as a pre-emptive strike rather than finding out the hard way. We had a student who was having technical issues so she dialled the (US) number on the Google Meet page on all her lessons for a whole week and ran up a huge (£2,000+) phone bill! This was as much the fault of the mobile provider IMO for waiting until the bill was this massive before contacting, and they have subsequently waved the bill, but we have now turned this feature off to avoid any further dramas.

 

There’s dozens more examples I could share and I may well do if there’s an obvious demand but I’m interested to know what you have discovered on your travels and what you think would be an essential setting change for all schools using Google Apps. I look forward to hearing your responses

[gh5000]

Think this is all updated to more obvious settings now but when the android play store was added to Chromebooks there was an obscurely worded tickbox that allowed students to add a personal account to the play store and download whatever they want. Took me a while to sort that one out. Definitely disable secondary accounts

[jthompson]

A big one to change from the default setting is to restrict API access.

 

Admin -> Security -> API Controls -> Manage Google Services -> Change them all to Restricted and go from there. You'll need to maintain whitelists for any third-party apps, extensions and add-ons that you want people to be able to use.

 

Another one to check is whether regular users are prevented from enrolling Chrome devices into the domain (I can't remember what the default is). You'll want to prevent them from enrolling new devices in case your newly purchased £20/£30 Chrome upgrade licenses get used up enrolling somebody's personally owned Chromebook, rather than the device it was intended for.

[TwistedHelixis]

Admin -> Security -> API Controls -> Manage Google Services -> Change them all to Restricted and go from there.

So you suggest changing them all, I was told to only change Drive & Email, although cant remember why.

[jthompson]

Gmail and Drive are going to be the biggies there, yes. That'll cover the lion's share of your users' data and the majority of third-party apps that they're likely to come across and want to try. The rest of them I guess I've tightened up just because. Admin is probably worth restricting, given its power.

 

Classroom isn't listed there, but there's a separate API option for that in Apps -> Google Workspace -> Classroom -> Data access. Whether that needs to be enabled to allow any API access (whitelisted by admin or otherwise) for users I can't recall. Online documentation isn't clear.

 

Google's defaults in this area tend to be more permissive than is perhaps good for us in education.