mjhardisty

Does your firewall support URL rewriting? If so, if you rewrite Google URLs and append &udm=14 to the end it should remove the AI elements from the searches. Sophos or another firewall might be able to do this. You can try it by going to http://google.com/?&udm=14 and then any resultant search adding &utm=14 to the end and refreshing. Otherwise, I did some work on Chrome policies so I've included those below. You should be able to target these in Edge too and muck about in GPO too. Google AI Disabled. Under Devices > Chrome > Settings > Users & Browsers. URLs Blocked: google.com/search?udm=50 lens.google.com Omnisearch Provider settings: Name: Google Keyword: Google Search URL: https://www.google.com/search?q={searchTerms}&udm=14&safe=active&ssui=on Icon URL: https://www.google.com/favicon.ico The following settings have been changed to be disabled: https://chromeenterprise.google/policies/#LensCameraAssistedSearchEnabled https://chromeenterprise.google/policies/#LensRegionSearchEnabled https://chromeenterprise.google/policies/#LensOnGalleryEnabled https://chromeenterprise.google/policies/#LensOverlaySettings https://chromeenterprise.google/policies/#LensDesktopNTPSearchEnabled https://chromeenterprise.google/policies/#AIModeSettings https://chromeenterprise.google/policies/#GenAiDefaultSettings https://chromeenterprise.google/policies/#ShowAiIntroScreenEnabled https://chromeenterprise.google/policies/#GenAIPhotoEditingSettings This will stop the majority of AI requests, but users can still get around by navigating directly to search engine pages. If this isn’t sufficient, there is also an extension to rewrite any Google URL with &udm=14 https://chromewebstore.google.com/detail/google-udm14/ackpmepblmioeoofggbipphdaooogjga?pli=1

I've implemented Clever at several primay schools. SSO into Google Accounts works exceptionally well.

The "where possible" is referred in the DfE FIltering and Monitoring Standards. https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/filtering-and-monitoring-core-standard Your responsibility would be to discuss both options with the DSL, discuss the pragmatics of each option for teaching and learning delivery (i.e. waiting/capability for pupils to sign in and out, etc) and then for the DSL to assess the risk and solution.

I agree with Tom, shared iPads would be the best route, plus it then would ensure the previous user signs out - rather than leaving an iPad on a single session with an authenticated firewall token from previous users. Device serial might also work if you have 1:1 devices. KCSIE still says "where possible" for identifying the individual on the device, and its exceptionally difficult on tablets. At least it does allow you to individually identify the device and time using that method.

Try this config in the .plist for the Smoothwall Browser application in Mosyle before you try the Shared Mode. <dict> <key>SmoothwallSerialNumber</key> <string>SmoothwallSerial</string> <key>UserID</key> <string>%SerialNumber%@youremaildomain</string> <key>HomePageURL</key> <string>https://www.google.com</string> </dict> See if that works? In the Smoothwall Cloud Filter you should then see alerts for a user of the devices serial number in the log? You can then create the according user in AD/Entra and then map it to the appropriate policies/reporting in Smoothwall. As least when responding to alerts then you'll know the specific iPad in question. For individual users it'll have to be Shared Mode.

OK, so you want the iPads to use one or the other and not both then. If your iPads stay on prem, then they won't need the Smoothwall Browser, they can use any browser and configure those to redirect to the Smoothwall On-Prem SSL Login page. The issue with that is that they'll retain the login from the previous user unless configured to used Shared Device. Otherwise install the Smoothwall Browser, configure it with your MDM to use the UserID string. In our Cloud-First setup we have the UserID string as device_serial@schooemailaddress. Smoothwall will use the UserID string for policy access/reporting. You can then make sure the on-prem policies allow for those iPad users (a user for each serial number) to access the internet. If that makes sense?

Are you using on-prem or Cloud Filter?

It's always useful to ensure that Intune, Entra, Microsoft, etc endpoints are excluded from any filtering/inspection to ensure service delivery. https://learn.microsoft.com/en-us/intune/fundamentals/endpoints?tabs=north-america

Afternoon all, I'm currently working with a developer on a new product designed for education called Filter Sentinel. It stress-tests your school's filtering against the risk mandated by KCSIE 2026 safely simulating real-world vectors and goes above the tool mentioned above by running against recommended education baselines rather than just illegal content. I did a short presentation at the ANME a little while ago, but it's about ready for a closed beta launch, so if you fancy being included please complete the form: Filter Sentinel - Closed Beta Application – Fill in form It asks a few questions about your security stack, etc, as it's important that IT teams also understand how this can affect filtering results and is important to ensure various levels of protection are working as expected.

There's a remediation script for Intune here: https://www.systemcenterdudes.com/remove-intune-onedrive-photo-app/ I'm sure it could be customised for all environments to remove the app - even a GPO file remove or script run.

We have mail rules to disallow student to student and student to external communications. Students are allowed to receive emails from external senders that on an allowed domain list (UCAS for example).

@Tefters does Lightspeed audit the user, does it show a load of that URL?

What product is this? After doing some stack work with filtering each tool seems to do something differently.

Got around 520 devices - haven't had any reports of these issues. If you have an X account, the Intune Support Team usually respond pretty quickly - run it past them:

We have an overarching AI Guidance Policy, supported with an AI checklist for implementation in schools. For each AI platform the guidance stiuplates that a DPIA is undertaken to evaluate risk.