Jump to content

Office 365 Email Segregation

jhithersay

By jhithersay
in Cloud Services

 Share

Recommended Posts

jhithersay

jhithersay

Posted
Posted

Hi All,

 

We are currently looking at moving to Office 365 and one of the things we want to maintain from our current setup with the council is the ability to stop students from email staff or seeing the staff address book.

 

Is this possible in Office 365 and if so how?

 

Thanks in advance

 

John

twin--turbo

twin--turbo

Posted
Posted

Unless something massive has changed then no. we were on a hosted VLE providers Live@ and could see the addresses of every other user in every other school!

 

We set up our own live@ for testing and could not segregate staff & students.

 

We left students on Live, and setup exchange for staff.

 

Even on exchange it seems virtually impossible to hide one set of users from another. I broke exchange lots and lots with adsiedit trying to disable address lists.

 

Novell Groupwise was able to do it without any problems, shame we were forced to move off it.

 

Rob

ozydave

ozydave

Posted
Posted (edited)

On 365 you can hide staff with a powershell command.

Set-Mailbox -identity joblogs -HiddenFromAddressListsEnabled $true

Edited by ozydave
CyberNerd

CyberNerd

Posted
Posted
On 365 you can hide staff with a powershell command.

Set-Mailbox -identity joblogs -HiddenFromAddressListsEnabled $true

 

can you do that with an OU or Group though?

 

Sorry I never under stood this one surely it is good for students to comunicate with staff?

 

 

Agreed. It does require a change in culture for some old staff though

ozydave

ozydave

Posted
Posted

can you do that with an OU or Group though?

 

You can add custom attributes to users. I have got each year intake as a custom attribute. Maybe a way round it.

Or

Just create a sub domain and point that at 365. Then use one for staff and one for students

CyberNerd

CyberNerd

Posted
Posted
can you do that with an OU or Group though?

 

You can add custom attributes to users. I have got each year intake as a custom attribute. Maybe a way round it.

Or

Just create a sub domain and point that at 365. Then use one for staff and one for students

 

So can you run the Set-Mailbox script on all of the users? or would you have export a list from the subdomain or custom attribute and run on all users and then specify that the script runs on (staff) user creation?

jhithersay

jhithersay

Posted
  • Author
Posted
Sorry I never under stood this one surely it is good for students to comunicate with staff?

 

Completly agree with you on that one, we currently have to set them up a student email address as well as there staff email so the students can send them home work etc. It would be much easier with a single email address

 

On 365 you can hide staff with a powershell command.

Set-Mailbox -identity joblogs -HiddenFromAddressListsEnabled $true

 

I had read this, but doesn't that stop staff from seeing each other in the address book, also if the students work out the staff email address (Which isin't hard) then they can still email them

 

Just create a sub domain and point that at 365. Then use one for staff and one for students

 

Is this possible in Office 365?

 

Think i might have a chat with Microsoft and see what they have to say

jamesbmarshall

jamesbmarshall

Posted
Posted

Each Office 365 tenant has one GAL - if you add multiple domains to a tenant they'll all share the same GAL. It is possible to hide users from the GAL, but you cannot prevent users from seeing the GAL; so if you hide staff your students will see each other, and staff will still see the students.

 

On the one hand, supporting custom address book policies in Exchange Online would be a great thing, and whenever I get feedback about this I always pass it on. On the other hand, there is the camp, as this thread has thrown up, which thinks that actually preventing users from appearing in the GAL serves little-to-no purpose but actually negatively impacts productivity (after all, if you use a consistent naming convention for your users, it doesn't much to work out a user's email address...).

jhithersay

jhithersay

Posted
  • Author
Posted
Each Office 365 tenant has one GAL - if you add multiple domains to a tenant they'll all share the same GAL. It is possible to hide users from the GAL, but you cannot prevent users from seeing the GAL; so if you hide staff your students will see each other, and staff will still see the students.

 

On the one hand, supporting custom address book policies in Exchange Online would be a great thing, and whenever I get feedback about this I always pass it on. On the other hand, there is the camp, as this thread has thrown up, which thinks that actually preventing users from appearing in the GAL serves little-to-no purpose but actually negatively impacts productivity (after all, if you use a consistent naming convention for your users, it doesn't much to work out a user's email address...).

 

Thanks for this information, this was what i was thinking.

 

If we were to setup 2 tenat's with either differnt domains or a sub-domain how would this affect single sign on? Staff would have their AD account tied to their Staff Email then if we configured a student email account for them, how would they be able to access this?

 

Thanks in advance

 

John

nicholab

nicholab

Posted
Posted (edited)
Personally I thing it might be time for this daft situation to stop and suggest that it would help with staff student to collaborate. What happens when a staff member e-mails a student they then have the staff members e-mail address. The 1st school I worked in we had a staff and student e-mail system it made life easier as you could contact a students easily. I would be making the case that the solution is not technically elegant and difficult to implement losing the benefits of the cloud they might buy that! Edited by nicholab
jamesbmarshall

jamesbmarshall

Posted
Posted
If we were to setup 2 tenat's with either differnt domains or a sub-domain how would this affect single sign on? Staff would have their AD account tied to their Staff Email then if we configured a student email account for them, how would they be able to access this?

 

There are lots of things to consider in this scenario - more than I can cover properly here unfortunately. If you're looking at this level of complexity (i.e. multiple tenants, single sign-on, different domains, etc.) then I'd really recommend you look into using a partner company to help you deploy if you don't feel you can pull it off on your own! :)

 

There is lots of documentation available online, and I've tried to bring it all together under one roof to make it easier to find: Office 365 for education Deployment Resources - UK Education Cloud Blog - Site Home - MSDN Blogs

 

Briefly, it is possible to have two tenants and staff and students split between the two but there are technical trade-offs in doing this. If it were me doing this in my school I'd try and tackle the cultural argument of whether or not there should be a shared GAL separately from the technology. You need to thoroughly evaluate how important a split GAL (and therefore, separate tenants) is vs. the ease of being able to share information, communicate and collaborate with services like Lync Online and SharePoint Online - both services that would be affected by your tenancy design.

 

Hope that helps!

  • Thanks 1
CyberNerd

CyberNerd

Posted
Posted

 

Briefly, it is possible to have two tenants and staff and students split between the two but there are technical trade-offs in doing this. If it were me doing this in my school I'd try and tackle the cultural argument of whether or not there should be a shared GAL separately from the technology. You need to thoroughly evaluate how important a split GAL (and therefore, separate tenants) is vs. the ease of being able to share information, communicate and collaborate with services like Lync Online and SharePoint Online - both services that would be affected by your tenancy design.

 

Hope that helps!

 

Like I say - its a few years behind Google apps which lets you segregate OU's with ease, based on their Active Directory memberships.

  • Thanks 1
jhithersay

jhithersay

Posted
  • Author
Posted
There are lots of things to consider in this scenario - more than I can cover properly here unfortunately. If you're looking at this level of complexity (i.e. multiple tenants, single sign-on, different domains, etc.) then I'd really recommend you look into using a partner company to help you deploy if you don't feel you can pull it off on your own! :)

 

There is lots of documentation available online, and I've tried to bring it all together under one roof to make it easier to find: Office 365 for education Deployment Resources - UK Education Cloud Blog - Site Home - MSDN Blogs

 

Briefly, it is possible to have two tenants and staff and students split between the two but there are technical trade-offs in doing this. If it were me doing this in my school I'd try and tackle the cultural argument of whether or not there should be a shared GAL separately from the technology. You need to thoroughly evaluate how important a split GAL (and therefore, separate tenants) is vs. the ease of being able to share information, communicate and collaborate with services like Lync Online and SharePoint Online - both services that would be affected by your tenancy design.

 

Hope that helps!

 

I thought you would say something like this, i would prefer a single tenant for simplicity and i am going to fight the powers that be over the need for a split GAL but i thought i would ask the question to see if my thoughts were right.

 

Thanks for your help and we do have a partner already, they have set us up on a trial so we can have a play

maark

maark

Posted
Posted
Like I say - its a few years behind Google apps which lets you segregate OU's with ease, based on their Active Directory memberships.

 

We have google apps but there is only one global address list - How do you segregate OU's within address list?

CyberNerd

CyberNerd

Posted
Posted (edited)
Can see that you can hide users - that is not the same as having 2 directories - one for staff and one for students?

 

For that you'd use the show_in_group_directory. I don't think you can do that for an OU though

 

gam update group  settings show_in_group_directory true|false

 

actually I think this may be more towards displaying the mailing list. The API is the way forward for now https://developers.google.com/google-apps/contacts/v3/

Edited by CyberNerd
  • Thanks 1
maark

maark

Posted
Posted
thanks will have a look at that -we have same problem as a lot of schools - teachers accidentally emailing students instead of staff
  • 6 months later...
themightymrp

themightymrp

Posted
Posted

Does anybody know if the Address Book Policy feature is now available on Office 365?

 

See : Address Book Policies, Jamba Jokes and Secret Agents - Exchange Team Blog - Site Home - TechNet Blogs

 

If so, can anybody explain how to use the new features to segregate the GAL for students and staff? I want staff to see the entire GAL but students to see nothing at all! If they want to share email addresses with each other then that's fine but I don't want them having the full list from the get-go

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...