Student School email accounts

[maxrebo]

Hi,

Just looking for a bit more advice, just wondering what restrictions other schools have on Student school email accounts? such as a whitelist for emailing etc...?

We currently dont have anything in place here and the account is open for them to use similar to a personal account.

 

At my old school we blacklisted students emailing in and out other than a while list. This was setup from years prior to me starting there and worked well for the security side of things.

 

Would be great to see what other schools do.

 

Regards

[AlphamaleZed]

We go through Google workspace so blocks the app connectors unless we approve.

I have only blocked adult domains from receiving or sending emails to i.e. PH

[Frodo_Baggins]

Inbound\outbound whitelist of domains and address book policies with some additional mail flow rules - as well as all of the usual mail filtering

[itskdog]

Our M365 was provisioned by RM, so they added a bunch of swear filters in the mail flow rules.

 

As we're a primary, we don't give students email access anyway, so haven't had to look too closely at that myself.

[TheRobins]

For us using vanilla 365 exhange, basically rules limit them to internal send and receive only, apart from a few white listed incoming domains for signing up to systems for school purposes. Also have a rule that sends all sent and received to a shared mailbox, myself, safeguarding and IT teachers have access to that account so any "issues" can be very quickly investigated  

[LeMarchand]

3 hours ago, TheRobins said:

For us using vanilla 365 exhange, basically rules limit them to internal send and receive only, apart from a few white listed incoming domains for signing up to systems for school purposes. Also have a rule that sends all sent and received to a shared mailbox, myself, safeguarding and IT teachers have access to that account so any "issues" can be very quickly investigated  

 

 

Pretty much the same at my sites.

[jthompson]

Gmail here. We don't have any allow/block listing in place for students sending or receiving email, other than those that will be applied generally to all users for spam-filtering reasons. One or two user-specific recipient blocks are in place for safeguarding reasons (on the request of DSL). Students are prevented from sending to most of the group addresses (staff group or student cohort addresses).

 

I do have a custom rule applied that will reject sending (by our users) of any message has more than 30 individual recipients, just to avoid any carnage from someone adding hundreds of other users into an email and then having reply-all madness going on. Because school.

 

[ThatBoringBloke]

16 hours ago, jthompson said:

 

 

Quote

I do have a custom rule applied that will reject sending (by our users) of any message has more than 30 individual recipients, just to avoid any carnage from someone adding hundreds of other users into an email and then having reply-all madness going on. Because school.

Care to share where you have set this? I was looking for something yesterday but couldn't see where to apply it.

 

[jthompson]

1 hour ago, ThatBoringBloke said:

Care to share where you have set this? I was looking for something yesterday but couldn't see where to apply it. 

 

Admin -> Apps -> Google Workspace -> Smail -> Compliance -> Content compliance.

Create a rule at the root OU:

• Name: "Limit max internal recipients per message."
• Email messages to affect: Outbound and Internal - sending
• Expressions:
    Advanced content match
    Location: Recipients header
    Match type: Matches regex
    Regexp: A regex that matches your email domain name(s). e.g.
       

  schoolname\.com|schoolname\.net

  
    Regex description:
      Look for school's domain(s) in recipients header. Use match count value to set the allowed number of such recipients.
    Minimum match count: 31 (or whatever limit you need)
• If any of the above expressions match, do the following:
  Reject the message
  Cusomise the rejection notice:
    Too many school recipients per message. Your message has not been delivered to any of its recipients.
• Account types to affect: Users

If you want that rule to not apply to certain OUs (e.g. staff), select the OU in the tree and set the rule to be disabled at that OU.