itskdog

We provision both staff and student accounts using RM Unify. Unify disables and unlicences the account in M365 when they leave (an admin can extend this for 60 days to give the office time to correct the MIS if they haven't actually left, e.g. a fixed term contract was renewed but hadn't been updated yet). If an account has been marked as off-roll for 9 months, then the account is then deleted from M365. We use Redstor to back up our M365 tenant, so data can be restored if needed beyond Microsoft's 30 day retention of unlicenced accounts.

As far as I can tell (we have it enabled on all our Intune-managed PCs), it means that machine doesn't count towards the user's limit of 5 installs. It's automatically logging in for us with Entra SSO. Frees up the 5 installs to be used on personal machines installed from https://portal.microsoft.com/account as a staff/student benefit.

Got an email from Mobile Guardian this morning announcing their "refreshed Dashboard". "our new interface is representative of foundational changes to our infrastructure that we’ve implemented over the past few years." From that, it made me think there was some kind of major overhaul to the UI, especially as they said to head to the KB "If anything is confusing". Nope, it's just a different colour scheme and a new logo (that looks a lot like the Promethean logo)

If you're using the OneDrive sync app and teaching staff how to add shortcuts via the web UI, then as long as you configure Storage Sense to clear cached files when disk space gets low, you should be fine with 256 or 512GB. If you're not using the sync app, and are either using Cloud Drive Mapper or the web UI, then storage likely won't be an issue at all provided you have the usual profile clearing settings enabled.

Same here, no contact about this until the day the notification came in the app, and I was the person who set it up. We've moved to Zoho Desk for now, though that's missing certain features such as merging tickets in the free plan, and who knows if they'll one day do the same thing. Might spend some time in the summer testing a locally-hosted FOSS solution such as OSTicket or GLPI as long as it's easy to configure to our M365 mailbox, as the notification style on the Parago/EdOps helpdesk module would definitely confuse some of our staff, and their Helpdesk V2 isn't coming until next year now.

Apple's MDM protocol is a push-based one, powered entirely by silent push notifications that tell the device what to do - the MDM has to initiate contact to the device to do anything. By contrast, the OMA-DM protocol that Windows uses is device-initiated like Group Policy, but Intune is able to try to remotely trigger a sync via a silent push notification. There is an issue where the Intune Management Extension (IME - manages Win32 & Store apps, plus remediation scripts and a few other bits that OMA-DM can't do) won't check for apps immediately after ESP, and instead it requires either a logoff/logon, reboot, or waiting 60 minutes for the routine fallback sync. You accurately noted that the Sync button in Intune and the Sync button in Company Portal behave differently, as IIRC the one in Intune only sends a notification to OMA-DM (the same as clicking Sync from the "Access work or school" page in the Settings app), not IME, while the Company Portal button does trigger an IME sync (though I'm not sure if it triggers an OMA-DM sync)

We assign everything to devices as much as we can, with student devices getting a different set of apps & polices than staff (dynamic groups based on device name). Even if it's a user policy, it seems to still apply on device targeting, presumably it just saves it to HKCU rather than HKLM in the registry. We don't have SharedPC enabled, our shared devices are just normal devices with no Primary User. I have noticed a couple of instances where OneDrive doesn't sign in automatically, or KFM doesn't activate, or Edge doesn't auto-sync, but I don't think I've seen any of that, even on first sign-in, for a while.

Redstor have educational pricing for pretty much as much storage as you need, 7 year retention, priced based on the size of the school. I know LGfL customers get it for free if they have a 5-year commitment on their internet connection. We have that on our previous server that's still running, which was a vanilla Windows 2016 server (but with RM's configuration as they installed it for us).

Same here, I have received the past emails but not for this one. I was relying on the live replay on this but if it's not being recorded then it would be good to see it.

Are you able to keep Offline Files enabled for that share, but not the home folder?

Following as we've had a report from our office team as well.

We try to keep it simple, staff have read & write access to the main staff shared drive (on request, not by default unless they're a teacher), and for anyone such as the SEN department or SLT that need restrictions, they get their own drive.

Under the WEEE regulations, cartridges have to be collected for recycling by the manufacturer and/or seller for free. Cartridge People recommend Empties Please, who used to give a small kickback to the school for each cartridge - it seems they've stopped now but their homepage now has links to all the OEM pages for where to get them collected, even more than @psydii listed, as well as linking out to The Recycling Factory and Recycle4Charity, who appear to still be operating their schemes. I'll include the links below for long-term preservation, too, as I doubt the above link will be active for too much longer.

Microsoft Edge for Business has a rudimentary web filter, and your AV might have a web filter, too (I know Sophos and Defender both do, when scurrying during Covid to get one going on the DfE laptops with, I used ). LGfL schools have HomeProtect (NetSweeper like on-site, just as an installed application, and a much more basic UI) which is included free with your broadband (it's not made clear in the marketing that it's free, but it seems to be, and certainly was for us). Non-LGfL schools can also get it for a fee, presumably paid per-student you're tracking, or per-device (not sure), clients are tracked by username (in your case as you're using Intune, it will use Entra SSO to identify the account, but it can also do Google and AD) for compliance with KCSiE. Also as @Steve101 suggested, your monitoring solution (Senso, Classroom.Cloud, etc.) might also have a web filter, either already included or as an addon that you could purchase.

We're with LGfL, so get Redstor's Total Education Bundle free in exchange for a 5 year commitment (which we were planning on doing anyway). Effectively unlimited storage (normal price is based on number of pupils rather than data), so we back up all users, sites, and servers, including the desktop machine running Net2, and our InVentry machine.

PS5 Pro sales not doing as expected, perhaps? Ultimately, if you release your console exclusives on PC, people will just get a gaming PC or a Steam Deck/ROG Ally/etc. and get a wider selection of games.

Is storing a TOTP secret alongside the password in the password manager sensible? I've always avoided that as then at least if the password vault is compromised (e.g. LastPass the other year) then at least they still won't be able to get through the 2FA screen as it's stored separately.

I use Microsoft Authenticator personally. I like the additional fingerprint confirmation before accessing any TOTP codes, and also we're an M365 school so it integrates well there. I do also set up a passkey where I can with Google Password Manager on my phone, and Windows Hello for Business on my work PC, for the added convenience of not having to get a separate device or app out just to sign in (in addition to the security benefits of using phishing-resistant authentication)

Haven't used SMART Notebook, but ActivInspire is still supported (even if they haven't released an update in almost 18 months now), and licences still come included with their latest IWBs (even if they do still try to push you to their new ActivSuite instead, though I believe that's only a single user licence per IWB, rather than unlimited PCs connected to that IWB)

Depends on where you get your Cyber Insurance from. If your school is part of the DfE's Risk Protection Arrangement, then it's one of the 4 requirements to be eligible for cover. Otherwise, no need to fret unless your insurance requires it.

https://admin.cloud.microsoft/?ref=MessageCenter/:/messages/MC1310684 If I'm reading this correctly, does this mean A3/A5 will lose the >100GB quotas, or am I misunderstanding this?

Check the frequencies you're using. The legal frequencies without a licence from Ofcom (£75 for 1 year, £135 for 2 years) are 863-865Mhz, and >865MHz are used by mobile phones, so you get a lot of interference if the system isn't tuned correctly. Official page from Ofcom: Wireless microphones and monitors You can fit 4 mics in that frequency range, and 10 in the licenced range (but you need separate equipment for that on both the transmitter and receiver that are tuned to that different range) You can also get more expensive digital mics that operate in 2.4GHz alongside Wi-Fi, Bluetooth, etc., and are individually paired to the receiver like Bluetooth, rather than tuned like a radio like a typical analogue transmitter. We had issues at one point with our installers tuning the mics to use all the channels on the Trantec systems they got us, which took us into the mobile phone range, frequently causing interference. I consulted the manual for the mics and found which frequencies each channel used and found that the first 4 channels were legal in the UK, so we now switch receivers on and off when we need more than one mic in a hall to ensure there's no bleed into other halls.

ClassFlow got killed off at the end of 2023. Not sure what website you found that said it was still running, but Promethean's own website doesn't have anything about it any more. They then bought Explain Everything to use as their cloud solution to replace ClassFlow, but unlike ActivInspire & ClassFlow that came included with the IWBs, EE's a paid subscription, as is their new ActivSuite.

That's why I thought I'd mention it, as we had the same thing. If it doesn't exist, I would hope that the more tickets that PCA get about it, the more likely they'll contact the DfE about it to update the RPA's evidence requirements.

PCA have just replaced their entire system. The collector has not been released yet, and installing it is optional, you just need to be signed up. We received an email from the RPA today asking to make sure we had upgraded to the new system by the end of August, and they specifically included the words "Whilst registration alone satisfies the RPA requirement" when talking about the IP and website scans that are currently available. Just make sure you have the registration certificate and digital badge - we didn't get those when we signed up and that's what you need to prove membership when making a claim. Contact the CyberAlarm support if you don't receive those, as that's the important bit.