oh exam season, how I love you. Or how I stopped internet access but still allow 365

[KK20]

This was a head scratcher. We use 365, we also save to onedrive (mydocuments have gone now). Shared drives are actually sharepoint drives. Roll onto the ICT practical exams, these use 365, need to access common files, need to save to a personal area. Aren't allowed internet access.

 

So in order to activate 365 I do need internet access, but only enough to get the user going. So I looked at whitelisting necessary microsoft websites, except there are a few gotchas. First, have you seen the whitelist of URLs for 365 activation? Second, that doesnt stop someone opening an inprivate browser, navigating to portal.office.com and logging in using their normal credentials.

 

In short, I created a PAC, whitelisted the necessary locations for logging in, created an old skool network share for the common files, reactivated server share documents for these exam logons. What I havent been able to do is stop someone logging into a browser as their "own" onedrive, I cannot seem to lock down the ability to only log into 365 as the user they have logged onto the machine as (if that makes sense). Is there a way to GPO or intune policy machine logged on credentials for 365 only? At the moment I am just blocking DOMAIN-my.sharepoint.com as I dont think this is necessary for the exam. But im not sure this works in word as you can access onedrive via the backdoor in word "open documents).

[Mako]

I allow the Microsoft domains/URLs/IPs, then block browsers via GPO and/or Impero.

 

This allows them to use 365 desktop apps, and they save to the local home drive.

 

If an exam/controlled assessment requires files, then they're dropped into the account ahead of time.

[KK20]

I cant block the browser as they need it for their exam. They create web pages in ICT practical unfortunately. The PAC blackholes the non whitelisted websites so external access isnt a problem. What I found is that you can add other accounts into word directly and access the files from there. You can also authorise other accounts from within word and access sharepoint too (the dropbox etc is blocked). What I cant find is a GPO or intune profile to block this adding of services and other accounts.

 

Ironically enough, the previous ICT exams we ran, you could access the internet and even send/receive email (in fact you had to as part of the questions). For some reason they had to stop this because people were apparently communicating with people in the outside world....

Edited May 10, 2023 by KK20

[jthompson]

Back when we used to lock down earlier versions of Office to prohibit the use of SPAG tools, there was a bunch of menu item IDs that we listed in a GPO to disable them in the GUI for end users. Might it be worth looking into whether the GUI buttons required to manually add an additional account can be disabled via Group Policy in this way?

 

I know that this is for the wrong version of Office, but is there an equivalent for the version you're using? Disabling commands by using control IDs

[psydii]

OT but I do wonder how people do this in Google Chromebook land.

[PotNoodleTech]

In Chrome > Settings > Users and Browsers > URL Blocking

 

You can ban * which bans all websites.

 

You can then unban the websites you need them to access e.g. drive.gooogle.com etc.

 

You can also explicitly unban parts of an already banned website, or ban parts of al already unbanned website - e.g. we needed all google education facilities to work including hyperlinks etc so we:

Banned *

Unbanned google.com

Banned google.com/search

 

So now then can do google.com things including click hyperlinks in classroom etc - but not search. You can build up layers of banning and unbanning to get the sites you need working.

 

E.g.

Edited May 10, 2023 by PotNoodleTech

[robintech]

had this for a while from within the desktop apps you can restrict it to "Organization only"

https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_SignInOptions

[KK20]

yeah, but they are both part of the same organization - the pupil own accounts and the exam accounts are in the same tenant. I have this set already to stop "home" accounts being used.

[robintech]

Could you block their own accounts during the exam, think we had to do this with Criminology where they needed to research stuff and had a PowerShell script on AzureAd to enable or disable them, could do it better with a variable and timers

 

 

Get-Content ".txt file" | ForEach {Get-AzureADUser -ObjectID $_ | Select DisplayName,AccountEnabled}

Get-Content ".txt file" |ForEach {Set-AzureADUser -ObjectID $_ -AccountEnabled $false}

[psydii]

Hope you've got Powershell for Graph SDK version of that script ready to go. https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/azure-ad-change-management-simplified/ba-p/2967456

[KK20]

manual block of their school account (whilst exam is on) is the method I employed in the mocks. It was on my "todo list" to look at a nicer method :-)

 

Oh well. for the single exam that it is, I think manual block, stick with the website PAC whitelist and mark it up to damn you 365 for not letting us small people use device licensing.

[robintech]

Hope you've got Powershell for Graph SDK version of that script ready to go. https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/azure-ad-change-management-simplified/ba-p/2967456

 

Looks like it will be Get-MgUser/Get-AzureADUser Update-MgUser/Set-AzureADUser

[dapaulio]

Not sure what proxy you have but We have smoothwall and implements office 365 rule above blocking anyone in banned users list

 

Add the user to a security group which is linked to the internal banned user group and hey presto.