Gmail - How to get students to receive email but not send email if on a ban

[SW-ICT]

Dear fellow Edugeekers

 

We recent migrated over to Gmail and all other G suit services

 

Some students are not allowed to send emails but they still need to receive the emails, We use to have exchanges and we could do what we needed in the admin panel quite nicely.

 

Does anyone know of a way to do this in the google admin panel? Sorry if it seems like a LMGTFY question

SW

[Jawloms]

I know nothing about G-Suite, but our Exchange is set so that if a users mailbox is full they can receive but can't send, which I believe is a fairly standard setting. If we had to do what you want, I'd just set their mailbox allowance to be tiny so it acts as thought it's full.

[Garacesh]

Apps - Google Workspace - Settings for GMail - Routing

 

Add a new Routing rule

Outbound, Internal - sending

For the types of messages above, do the following:

Reject the message

 

Scroll down to the bottom before clicking Save, click Show Options

 

B. Account types to affect: Users

 

C: Envelope filter: Only affect specific envelope senders

Single email address - [email protected]

 

Edit: sorry, just seen "Some pupils", plural.

You'll want Pattern match instead of single email

(?i)(Pupil1|Pupil2|Pupil3|etcetera)(\@domain\.gtld)

Edited March 24, 2022 by Garacesh

[SW-ICT]

Thank you will take a look.

I'll get back to you

[SW-ICT]

Apps - Google Workspace - Settings for GMail - Routing

 

Add a new Routing rule

Outbound, Internal - sending

For the types of messages above, do the following:

Reject the message

 

Scroll down to the bottom before clicking Save, click Show Options

 

B. Account types to affect: Users

 

C: Envelope filter: Only affect specific envelope senders

Single email address - [email protected]

 

Edit: sorry, just seen "Some pupils", plural.

You'll want Pattern match instead of single email

(?i)(Pupil1|Pupil2|Pupil3|etcetera)(\@domain\.gtld)

 

 

Thank you so much

 

Works a treat. Still getting use to it all.

[Garacesh]

No problem. We have a pupil whose incoming and outgoing emails are all duplicated to a safeguarding account because there's been... issues.

Same rule, just different action

[jthompson]

C: Envelope filter: Only affect specific envelope senders

Single email address - [email protected]

 

Edit: sorry, just seen "Some pupils", plural.

You'll want Pattern match instead of single email

(?i)(Pupil1|Pupil2|Pupil3|etcetera)(\@domain\.gtld)

 

I'm wondering if the 'Group membership' option here might work. Create a Google Group specifically just to contain those pupils to which a sending ban would need to be applied, and specify that group here in the routing rule. Pupils would then just need to be added and removed from the group as needed, and the routing rule would not need to be edited each time a change is needed. If that works, it's easier for long-term management of pupils' bans. Also, if pupils have any aliases on their account that they can send from, that would probably be covered automatically as well, without having to account for any of those in a pattern match rule.

 

I had wondered whether using an address list might work as well, but I think those match on senders for incoming mail, and recipients for outgoing mail, so wouldn't be of use in this case.

[Garacesh]

Valid, but a lot of the time we don't want pupils to know when they have special/nonstandard configuration, because usually they'll try to find a way around it.

If you have Google Groups enabled for them, they'd be able to see that group. And probably leave it, too. Sure, you could make it AD-linked so GCDS would re-add them but anything between leaving the group and your sync wouldn't be covered.

 

Edit: Yup, just checked, my test pupil can leave the all-students group.

Edit2: That, and in my case, you can't monitor incoming email that way using group membership.

Edited March 28, 2022 by Garacesh

[jthompson]

Valid, but a lot of the time we don't want pupils to know when they have special/nonstandard configuration, because usually they'll try to find a way around it.

If you have Google Groups enabled for them, they'd be able to see that group. And probably leave it, too. Sure, you could make it AD-linked so GCDS would re-add them but anything between leaving the group and your sync wouldn't be covered.

 

Edit: Yup, just checked, my test pupil can leave the all-students group.

Edit2: That, and in my case, you can't monitor incoming email that way using group membership.

 

I guess it depends on how many pupils this would need to apply to, and how dynamic that list is going to be. If it's only a few and changing very rarely, then keeping it all within a single routing rule is probably the most KISS approach.

 

RE: students removing themselves from groups, there is a way to make a group unleavable. I don't think it's presented in the Admin or Groups GUI, though, but it's in the API and available to set using GAM. That won't affect the ability of GCDS or groups admins to manage group memberships as normal, it just prevents vanilla members from removing themselves.

 

gam update group [email protected] who_can_leave_group none_can_leave

Edited March 28, 2022 by jthompson

[Garacesh]

RE: students removing themselves from groups, there is a way to make a group unleavable. I don't think it's presented in the Admin or Groups GUI, though, but it's in the API and available to set using GAM. That won't affect the ability of GCDS or groups admins to manage group memberships as normal, it just prevents vanilla members from removing themselves.

 

gam update group [email protected] who_can_leave_group none_can_leave

 

Oooh very interesting, thank you!

I did have a hunt around in the admin console for an option to lock membership but I assumed it wasn't a thing because spam, I guess? A user joins a group, the group starts spamming them, the user can't leave now.

Looks like PSGSuite has a comparable command too.