Google Workspace - Drive - Conditional Access

[Koldov]

TL;DR

 

iPad > iMovie > saved to Google Drive > viewed at home > possibly shared...

 

Free Educational Google Workspace version.

 

How do I stop it?

 

A teacher has just come to me and said one of the pupils took a video on an iPad in iMovie, saved it to their Google Drive and was then able to watch it at home and share it.

 

Got to say I'm far from comfortable with Google Workspace, it was thrown at me to get sorted over Covid with no warning and no training, it's not something we use very much and it's not something that's a core part of our curriculum use so it's not part of our culture.

 

Is the problem the iPad or Google? Or ($deity forbid).... classroom management...?

 

Do I need to pay for Google and get conditional access and limit it to school I.P. ? If so how do you manage the pupils doing homework?

 

Do I try and find some way to stop them signing into Google on the iPads? If so how do you manage access to Classroom when they want to use it in lessons.

 

I've always disliked iPads in the classroom as no teacher can watch 30 screens all the time, I've also brought up limiting Google Drive contents (even on here) and was told that you can't do it... and also why would I want to...? smh

[jthompson]

...one of the pupils took a video on an iPad in iMovie, saved it to their Google Drive and was then able to watch it at home and share it

 

The only thing that seems problematic there is the "share it" part. What does that mean in that particular instance? If it's sharing it publicly or with other external contacts, then that's a configuration on Drive that you can/should make to restrict your users to only being able to share within the organisation.

 

You could prevent access to school accounts from non-managed devices, but I'm not sure you'd want to if you don't have 1:1 managed devices.

[flyinghaggis]

If you go into the Google Admin console (https://admin.google.com/) into "Apps>Google Workspace> Drive > Sharing Settings" you should be able to find a setting that lets you restrict Google Drive sharing settings for users. That would potentially stop pupils being able to share it with others. Edited June 14, 2024 by flyinghaggis

[jthompson]

You won't be able to stop them from sharing with other users in the school, though. In case you're being asked to prevent that.

[Koldov]

I got a bit more, but it's 3rd hand from the pupil and then from the teacher, so who knows what the reality is, some of this may not be correct.

 

Apparently they accessed the video at home saved it to their phone and then emailed it to someone (possibly another child in the class).

 

I think I have sharing externally disabled for pupils, so in Apps > Google Workspace > Settings for Drive and Docs > Sharing settings?

 

I'm sure they don't have GMail enabled so personal email from phone?

[jthompson]

I think I have sharing externally disabled for pupils, so in Apps > Google Workspace > Settings for Drive and Docs > Sharing settings?

 

Yes.

 

Sounds like there's not really a tech issue, just a behaviour/responsibility issue.

[Koldov]

OK, so a bit more info...

 

The child created a video on a school iPad, saved it to their school Google drive, accessed it at home on their phone, saved it to their phone and then sent it to their friend via Whatsapp...

 

The teacher is having a meltdown about safeguarding and going to the head, so it will roll back downhill and land on my desk at some point soon...

 

Just to be clear, I can't stop it happening?

[TheHyperTechie]

OK, so a bit more info...

 

The child created a video on a school iPad, saved it to their school Google drive, accessed it at home on their phone, saved it to their phone and then sent it to their friend via Whatsapp...

 

The teacher is having a meltdown about safeguarding and going to the head, so it will roll back downhill and land on my desk at some point soon...

 

Just to be clear, I can't stop it happening?

 

As far as I am aware, you can't stop this without utilising a higher tier of Google Workspace (Standard, Plus) and using context aware to set up conditional access rules. (Please correct me if I am wrong!)

 

You sound like you have done the most you can do, by blocking external access etc.

Edited June 14, 2024 by HyperTech

[jthompson]

You could use context-aware access (Admin > Security > Access and data control > Context-Aware Access) to prevent users from accessing certain things from devices that aren't school managed. That would likely prevent anyone from doing their homework though, unless you're handing out 1:1 devices.

 

I don't think that context-aware access requires extra licensing. -- EDIT -- It's not available on Education Fundamentals, only on Education Standard and Plus.

 

The MDM tooling built into Google Admin does have support for some iOS-specific controls to prevent work data from Google Drive being able to be shared out via the iOS sharing functions, but I believe that that requires the user to have a GWfE Plus license assigned.

Edited June 14, 2024 by jthompson

[TheHyperTechie]

You could use context-aware access (Admin > Security > Access and data control > Context-Aware Access) to prevent users from accessing certain things from devices that aren't school managed. That would likely prevent anyone from doing their homework though, unless you're handing out 1:1 devices.

 

I don't think that context-aware access requires extra licensing. -- EDIT -- It's not available on Education Fundamentals, only on Education Standard and Plus.

 

The MDM tooling built into Google Admin does have support for some iOS-specific controls to prevent work data from Google Drive being able to be shared out via the iOS sharing functions, but I believe that that requires the user to have a GWfE Plus license assigned.

 

According to Google, context aware is only available for Education standard, and Plus. Which is a shame!

[Koldov]

Anyone know how much that costs?

[jthompson]

You might want to suggest restricting use of the cameras on the school-managed iPads, if there isn't a specific requirement for them, so that the teaching staff can be confident that there are no cameras in classrooms. I'm assuming that you'll have some MDM tooling to manage the iPads accordingly.

[TheHyperTechie]

Anyone know how much that costs?

 

I have standard licensing issued across all users on my domain(s) (The only option is to license the whole tenant unfortunately)

 

We pay £2 per user license a year.

[Koldov]

You might want to suggest restricting use of the cameras on the school-managed iPads, if there isn't a specific requirement for them, so that the teaching staff can be confident that there are no cameras in classrooms. I'm assuming that you'll have some MDM tooling to manage the iPads accordingly.

 

Unfortunately the lesson they were doing was from some planning from our ICT consultant on creating videos , part of the computing curriculum apparently.

 

I have standard licensing issued across all users on my domain(s) (The only option is to license the whole tenant unfortunately)

 

We pay £2 per user license a year.

 

That's good to know thanks.

[jthompson]

This is the official matrix - https://edu.google.com/intl/ALL_uk/workspace-for-education/editions/compare-editions/

Resellers will likely have some room to price more competitvely. But yes, you do have to purchase enough licensing for your entire organisation - you can't purchase just a handful.

 

Even with it, I'm not sure you'd want to block non-managed devices. How will students do their work outside of the classroom?

 

If the root concern is a safeguarding one around in-classroom videos ending up on WhatsApp, then removing the camera functionality from devices in the classroom (assuming mobile phones are banned in class) is the neatest way to achieve that.

[TheHyperTechie]

Unfortunately the lesson they were doing was from some planning from our ICT consultant on creating videos , part of the computing curriculum apparently.

 

 

 

 

 

That's good to know thanks.

 

No problem, if you are investing more into Google as a school it is definitely something to look at. I use a lot of the added features, (mainly security focused). I don't think i could go back to fundamentals now.