Restrict chromebook logon to specific cohorts

[dgsmith]

We have purchased a batch of chromebooks for exclusive year 7 use, however students in other years are finding out they can also log in to these devices, when they have their own devices already, and unfortunately are frequently "forgetting" to bring them! We already use wildcard on the domain (*.schooldomain.com) within gsuite restrict signin to list of users, and I thought I could change this to 23*@domain.com to just allow students who have 23 at the start of their email (yr7). Unfortunately this not only blocked everyone else (good) but also restricted login to students who matched the wildcard (so also said 23* accounts were restricted).

 

Do I need to use some clever regex here or is there a cleaner way of achieving this?

[jthompson]

It doesn't look like the * wildcard functionality will support that. It can only match all users for a domain, and it doesn't look like there's anything more complex supported by that policy.

[dgsmith]

It doesn't look like the * wildcard functionality will support that. It can only match all users for a domain, and it doesn't look like there's anything more complex supported by that policy.

 

That's quite frustrating really! I guess therefore it doesn't seem like a true wildcard parameter, but perhaps just detecting the presence of a wildcard symbol to then translate as "anything before the @" symbol, i.e. a placeholder character. It seemed like a fairly straightforward config change to be made but seemingly there is no support for this

[jthompson]

I think your assessment is correct. There are some other Chrome policies in which the * character is similarly basic and not really doing regexy stuff (URL patterns for allow/blocklists?). I guess it prevents policy processing from getting bogged down by anything too elaborate.