Email redirect

[loxford01]

A governor has requested that they want all emails to be redirected from their school email address to their personal email address or for someone to check and redirect each time they get an email sent to their school domain email. As per GDPR I know this cannot be allowed if sensitive content is emailed to the governors school email. I want to check if it is possible in M365 to setup redirects to from work to personal emails and how this can be done? Also is it even feasible for someone else to check and know when an email is sent to the governors work account and monitor it and then inform this governor.

 

Even if it is possible is it good practice? We have recommended that they should install the outlook app on their laptop/device but they refuse to do this.

[paulkerton]

It is possible. It's absolutely terrible practice, because as you say - sensitive content. There is no easy way to filter that without their being a manual process involved.

 

Insist that they use their "work" provided email address. They're not so important that someone should check their email account for them.

[chazzy2501]

I've disabled forwarding site wide. it is used as an attack vector, email accounts get compromised, then the attackers have email forwarded in secret, so after the attack is cleared the emails still get forwarded.

[Synkrox]

We use Teams for governors then add them as a guest user with their home Microsoft account. That way data stays in your Team rather than being pinged around and you don't have to license them. IMHO they shouldn't have a school email address anyway as they are (mostly) not staff and should not be able to appear as such.

[loxford01]

We were informed by our DPO that all governors should have an @school domain email account for any communication related to the school. They haven't been given any staff permissions and have been removed from global address book. I agree Teams is the way forward and I am sure they were using this but recently was asked to create an @school email for them. Its just one governor refusing to check emails on their personal device in any form and informing us that as an M365 admin we can set redirects and should inform them when they receive and email in their @school email. Originally they asked me to give permission to download apps as they can with their E5 license but we only have the A1 license, so I guess they were referring to the Apps for faculty license which allows for the download of office 365.

[howartp]

We have two mailing lists - one of their school accounts and one of their personal accounts.

 

Agendas/paperwork etc are sent to their school email, then an email sent to their private email saying "You got mail" when necessary.

 

Peter

[loxford01]

Thanks Peter. Can I ask who would send this email to them when they get an email to their school email, surely not the M365 admin and school PA should be doing this?

[howartp]

Thanks Peter. Can I ask who would send this email to them when they get an email to their school email, surely not the M365 admin and school PA should be doing this?

Whoever sends the original email, usually chair of trustees or Heads' PA. Occasionally finance team.

 

It's just part of their workflow, not an extra "Oh I need to remember to check and see if they have anything they need telling about" - they just send both emails at the same time, job done.

 

Peter

Edited September 30, 2024 by howartp

[mavhc]

Problem isn't they want it on their home email, the problem is they don't know when they have an email, so fix that problem.

 

a) set up email on their phone

b) set a rule to send an email saying they have new email, just not the contents of it

c) Why is there no "you have new mail" system any more?

[chaplic]

Offer to setup a power automate to send a notification email to their personal 'You have a mail in your school account'

[enjay]

as an M365 admin we can set redirects

 

Can and should are different things!

 

One of our Governors also asked for this, and we refused because:

- access would continue after they leave the school

- access by family members who shared the devices/accounts couldn't be prevented

- not backed up

- not subject to our virus and phishing filters

- not accessible by other school staff if needed

- if the account is compromised, we can't lock it down

 

We set the Outlook app on their phone with the notification for new email, and they were happy (or at least they were accepting).

 

Also, it isn't just one Governor - once you've allowed it for one, you'll be doing it for all of them, then a teacher, then all the teachers.

[jthompson]

I should hope an M365 account can be added to most mobile mail clients these days: Outlook, Gmail, Apple Mail, even whatever cheesy app Samsung does. If they have a mobile, there should be no need for them to have to install anything extra.

[enjay]

I should hope an M365 account can be added to most mobile mail clients these days: Outlook, Gmail, Apple Mail, even whatever cheesy app Samsung does. If they have a mobile, there should be no need for them to have to install anything extra.

 

True, but you then lose control of it and can't guarantee their access to data stops when you disable their M365 account. We tell people M365 mail can be funny in some phone-native mail apps (which in fairness it can, especially where access to the address book is concerned) and they should download the Outlook app.

[leegcvcc]

Don't forget their private accounts are not beyond SAR requests and will be searched. I love that one! I pushed so hard on this and we now have them using cCollege accounts. Using Governor hub has been a blessing lately too. Have these Governors had any GDPR training by a DPO? They are meant to be aware of our practises and why we do things, and agree to us doing them! DPO training can be quite hard hitting in terms on private email accounts and lack of GDPR standards where their mail is potentially stored.

Also Governors using work accounts etc, our data is being monitored by their IT depts etc etc etc.

[enjay]

Don't forget their private accounts are not beyond SAR requests and will be searched.

 

Are you sure? We had an SAR which specifically asked for WhatsApp messages and were advised we didn't need to provide them because they're not a school-sanctioned system and weren't sent from school-owned devices.

[jmak]

Are you sure? We had an SAR which specifically asked for WhatsApp messages and were advised we didn't need to provide them because they're not a school-sanctioned system and weren't sent from school-owned devices.

Both can be true. If Whatsapp isn't a school system, then they can argue that it's not in scope of a SAR.

 

If you have an agreed process where they're permitted to use personal email for school business (banned where I work, but that's a separate issue) then their personal email is in scope. Realistically, you have no way to enforce that - they could delete it all - and your school would have failed to meet its legal obligations for processing data.

 

It annoys me - if they volunteer to be a Governor, then they should be prepared to put in enough effort to check emails. However I would put together a system to automatically notify them via their personal email when they've been sent a message.

 

If you use M365, giving them a school email address doesn't need to give them access after they leave. Set up Conditional Access rules so that you can delete the school's data and optionally prevent download of attachments. Set up rules to prevent forwarding.

[tl82]

We had something similar to this years ago. The solution was one of our 365 specialists made a Flow that sent a ‘you’ve got mail’ email when something arrived in their domain account

[enjay]

Both can be true. If Whatsapp isn't a school system, then they can argue that it's not in scope of a SAR.

 

If you have an agreed process where they're permitted to use personal email for school business (banned where I work, but that's a separate issue) then their personal email is in scope.

 

Good point.

[GrumbleDook]

Are you sure? We had an SAR which specifically asked for WhatsApp messages and were advised we didn't need to provide them because they're not a school-sanctioned system and weren't sent from school-owned devices.

 

Just to circle back to this one, if you do not specifically say that they can only use checked and agreed systems, then they may end up using all sorts of things, but whatever they use falls within scope.

If they are using a system that has not been checked and agreed upon, and you say that can only use the official/agreed systems, then they are in breach of your policies and whilst they can argue it is not in scope, you then have the issue of a possible breach and a Governor who is also breaching policies.

 

I like the idea of a workflow that sends a notification to a given address if new emails arrive in the school-owned mailbox.