Office 365 and ICT exams

[KK20]

Looking at ICT exams and the requirements for the practical assessments. This academic year is the first exam since the new syllabus. Previously students were allowed to use the internet plus all the normal working applications. Since covid this has changed it seems, now the students are not allowed to use the internet. We are using office 365 so that will be fun licensing our users with no internet. So, looking at a solution that will allow office365 to license but student having the internet denied I have these thoughts:

 

Students use an exam domain logon (that has a 365 account associated). Exchange rules prevent sending and receiving emails. Member of an ict group so I can lock down via GPO (we are hybrid).

 

1) first option was to create a whitelist internet group in our filter, that way office 365 can authenticate and license but pupils wont be able to use internet pages. This would naturally open up sharepoint but that is ok because the ICT pupils use an examination logon rather than their usual logon (so easily locked down). Problem though, Securly isnt as good at doing this as our previous filter, sure you can create a whitelist profile BUT! global exceptions are allowed - not just the whitelist allow, this means ALL those bypass sites that have been approved using their teacher allow web page will need to be removed from the global list and added to the individual profiles. A non starter. Why securly couldnt have a second switch under the whitelist option to give you a choice of include global allows or not is beyond me.

 

2) second option. "Extended offline access" for 365. I dont know much about this so I will need to look into it. I assume it is a non starter because a user would need to log into their exam account first, then have the internet blocked. Seems a lot of work.

 

3) Specialised PAC file. We use securly and their PAC, I block internet to the exam accounts by putting a non existent proxy via GPO. I could create my own PAC that examines the address and either lets it through to securly (microsoft logon sites) or sends the user a non existent proxy address.

 

Im leaning more to (3) as that seems simple and least work. However I will need to look for office 365 logon urls (I dont want to blanket allow *.microsoft.com as that will open up the website portion at the same time).

Edited November 24, 2022 by KK20

[mavhc]

Can you just block browsers? chrome.exe and edge.exe?

[KK20]

nope. Part of the ICT practical is to design a website so that cant be done.

[mavhc]

Do the pac thing then:

function FindProxyForURL(url, host) {
if(dnsDomainIs(host, "127.0.0.1") || isInNet(host, "10.0.0.0", "255.0.0.0") || isInNet(host, "192.168.0.0", "255.255.0.0") || dnsDomainIs(host, ".domain.local") || isPlainHostName(host)) { 
	//alert("Local, therefore DIRECT");
	return "DIRECT"; 
} else {
	if (dnsDomainIs(host, "SOME MICROSOFT DOMAIN") || dnsDomainIs(host, "SOME OTHER MICROSOFT DOMAIN")) {
		return "PROXY 1.2.3.4:8080";
	} else {
		return "PROXY FAKEPROXY:1234";
	}
}
}

[KK20]

In the end I used PAC. There is already a powershell command for generating a suitable MS Office 365 list of domains for use as a PAC.

 

https://learn.microsoft.com/en-gb/microsoft-365/enterprise/managing-office-365-endpoints?view=o365-worldwide#pacfiles

 

I used common and sharepoint, the common files are stored in a sharepoint library folder, the rest is locked down so it works out nicely. No email but the exam group rules in exchange already sort that out.