Email account roll out for students - Pitfalls ??

[mikkydoos]

Hi all,

 

Just about to roll out school hosted email accounts for students 11-18 --> Gmail.

 

Staff are on O365 and I'm keen to keep these separate.... different domain name etc.

 

 

These students have never had school issued mail accounts before.

 

What opinions do you have on the the pitfalls... specifically student to student abuse, inappropriate teacher / student communication etc.

 

..... and how do you go about locking this down and monitoring inappropriate behaviour.

 

 

Would love to hear some facts/opinion on what mayhem this might cause and/or benefits.

 

 

 

Cheers in advance

[jthompson]

I'm not sure that you can proactively monitor it really. Set up suitable retention rules in Google Vault (the default retention rules may be fine, but worth chacking) and familiarise yourself with how Google Vault works for searching email content.

 

If you have Google groups set up that you don't want student being able to send to, set up suitable content compliance rules to reject messages sent to those groups from students. See https://www.edugeek.net/forums/cloud-services/224024-google-gmail-allowing-teachers-send-year-group-distribution-lists.html

 

You'll probably want to have Google Chat disabled for your students. That's now a separate app from Gmail, so you can disable that for them easily enough in the Admin console.

 

EDIT:

Given that your staff accounts on on a different platform with a different domain name, if you have student Google groups that you wan tyour staff to be able to send to, you'll need to configure the group settings hand-in-hand with content compliance rules. The group(s) will need to allow anyone on the Internet to send to them, but the content compliance rule(s) will need to reject any senders to those groups that aren't from your staff domain name.

Edited January 15, 2024 by jthompson

[Jawloms]

I assume you can do it in GMail like others, but consider a limit to the number of recipients and whether they can email distribution groups or not.

[Oaktech]

When I was in secondary, we were using office 365, and I'm not sure if it's possible with Google...

 

Student emails had the following:

 

We restricted Y7 and Y8 to only being able to email staff not each other,

Y9-Y11 were able to email teachers or own yeargroup only,

Y7-Y9 were not able to send or recieve externally.

Y10 and Y11 were able to send and recieve externally (mainly to encourage them to sort out their own work experience)

Sixthform had essentially no restrictions.

All year groups had a transport rule with a maximum recipient count of 35 (maximum class size) to prevent reply-all carnage.

All student distribution groups (eg GCSE geography ) had a moderation hold on them to be authorised by subject head, even for staff.

All yeargroups had a 'bad word' filter that rejected an extensive list of profanity.

Scanning of attachments for size (10mb) & types (no double extensions, nothing executable, etc).

 

Before it goes live you need staff to make expectations of behaviour absolutely clear to every student. Access is a privelige not a right, THINK, etc, etc.

 

You also need MLT and SLT to be fully on board with sanctions and have a robust policy regarding misuse that dovetails into your real-world behaviour policy - I forget exactly what ours was now, because it was written and enforced by other people, but it was there. We just got helpdesk requests to suspend/reinstate students' access. There was definitely a 3 strikes policy on fairly minor contraventions and a permanent ban for single major contraventions.

[jthompson]

I assume you can do it in GMail like others, but consider a limit to the number of recipients

 

You can, after a fashion. We do it using a content compliance rule for sending messages where "Recipients header" has a regex to match any email address, with a minimum match count of 31 so as to limit the max number of recipients per email to 30.

[Sephiroth]

I agree entirely with the above.

 

What I would add is that you may want to do what we do, which is to block receipt of external email for years 7 to 9, as noted above. If you do this it would be a good idea to get a list of sites and services that your students are signed up to and add the email domains to an allow list. I would also advise that you carefully manage the API scoping to stop people signing up to an service that accepts a Google login credential. This has stopped several "I can't cause a massive data breach because my class can't sign in to !"(slightly paraphrased ) and has meant that it has to come through IT Services, as per the policies.

 

As far as sanctions and accountability, Google Vault is your friend. It's relatively intuitive, but I advise getting to grips with it before the waste product collides with the rotary air movement device, so to speak.

 

* Edit to add:

We also disallow Year 7 to 9 students sending email to other students or to distribution groups.

Edited January 15, 2024 by Sephiroth

[Davit2005]

When I rolled out O365 in a college (FE) I did not let students email distribution groups either. Also restricted ability to change their photos it was over 7 years back though that I did that and I've moved on since and not admin for O365 anymore :-)

[jthompson]

Something else to get acquainted with before you have a need for it is to note down how you'd delete an email from students' mailboxes using GAM. If you assume that there's an inevitability about a student or member of staff sending an email to students that really didn't want to get sent, you'll want to have the tools to hand to purge it from students' mailboxes asap.

 

Installing GAM in Google Cloud Shell - https://basuta.com/posts/installing-google-apps-manager-gam-on-google-cloud-shell/

Bulk deleting emails using GAM: https://github.com/GAM-team/GAM/wiki/ExamplesEmailSettings#deleting-trashing-or-untrashing-user-emails

gam all users delete messages query rfc822msgid:[email protected] doit

[jthompson]

..... and how do you go about locking this down and monitoring inappropriate behaviour.

 

I'd urge against sanctioning that involves disabling access to mailboxes. An account with Gmail disabled will reject delivery of messages, so it can get messy. Abuse of a mailbox account should be covered by the school's existing behaviour policy and dealt with in those terms, rather than as an IT thing as such. Technical measures ought to be reserved for only the most pressing cases IMHO, and not as a standard response. We've had a few cases where our DSL has asked that certain combinations of students can't email one another, and one student whose mailbox did need to be disabled indefinitely, but other than that, mailbox availability is assumed to be constant.

[Julian]

We are a Google School, and have been for some years. We restrict y7 -y11 to send recive email only with our domian with some limited exceptions (Adobe password reset, Autodesk Password reset, ...).

This is done via "Apps > Google Workspace > Settings for Gmail > Compliance"

Year 12-13 are unresicted.

 

We are also using other Google services, Drive, Docs, Calandar, Meet, Groups, Classroom, Forms with MIS integration so that the Groups and Classrooms, are automatically created using the school timetable, and then populated with staff and students names.

 

Do not let students create their own classrooms, as they can then abuse the feature for private file sharing, and the Google admin cannot see that thers classrooms exist.

 

We have not had to many problems with abuse, due to the sudents knowing that they are not anoymous when using thier school emial account.

[TRSJon]

Somebody may have added this, so sorry if duplicated... At a previous role, students were using Office365 - so don't know if google have a similar process - we allowed all students to mail distribution lists - BUT... we had moderator approval setup so any emails sent by students to distribution lists had to be approved by the relevant students head of year. No approval, no email.

[dmj]

Somebody may have added this, so sorry if duplicated... At a previous role, students were using Office365 - so don't know if google have a similar process - we allowed all students to mail distribution lists - BUT... we had moderator approval setup so any emails sent by students to distribution lists had to be approved by the relevant students head of year. No approval, no email.

You do this by with a group moderator in Google Land.

https://support.google.com/groups/answer/2466386?hl=en

[ITGuyNW]

Can I set a rule in O365 where if the email address has a number at the start, it cannot be sent to?

[Oaktech]

Can I set a rule in O365 where if the email address has a number at the start, it cannot be sent to?

 

I don't think you can set 'just reject a number, any number' but you could set a text pattern and just put numbers 0-9 in it. You'd need to be super careful about who it applied to though!

[ITGuyNW]

I have it setup at the minute as if you are a member of any of these groups (years 7 to 11 group emails) and send to a member of this group (years 7 to 11 group emails), then reject and send to me.

 

Not sure its entirely working at the moment though..