pete

Bromcom have discovered in-browser caching and apparently would love it if you gave them a cookie for their efforts: Our engineering teams have implemented changes designed to reduce the load on our platform during peak usage periods. Specifically, we have ensured that static files, such as icons and interface elements, are now cached locally within the browser. This reduces the number of requests made to the server and prevents the platform from working harder than necessary during busy periods.  I have Y7 CS students who would be ashamed of having to make this announcement.

As a heads up, in the new version of the Student App > My Timetable appears to be pulling from the class teacher's "Legal Name" field rather than the "Preferred Name" field. Student App > My Timetable will show teacher legal name instead of preferred name or salutation. Student App > My Subjects will also show legal name. Student App > My Subjects > Calendar icon shows salutation. Cue a bunch of teachers being asked "Miss, did you get married?" this morning by our nosier students.

Yeah, we set company name for the kids too (with their form tutor as line manager) via Salamander so it's not a future-proof filter for us. Ended up doing: School01 Staff Group in trust tenant. (user.mail -endsWith "@school01domain.whatever") and (user.userType -eq "Member") and (user.jobTitle -ne "Governor") As a couple of school's AD don't have the exchange attributes, so I needed something universal.

Seems a lot snappier, but we need to know if this is because they've paid for increased capacity at peak times (and can afford to keep doing so) or because something's been fixed/optimized?

Disable the airplane mode hardware button on a HP laptop via Powershell. get-pnpdevice -Friendlyname "HID-compliant wireless radio controls" | disable-pnpdevice -Confirm:$false (you still need to disable startup of the radio management service if it's a laptop issued to kids, this is for staff who keep catching F11 when going for "-")

^ You could probably do something like: If UPN contains "otherschooldomain.whatever" and userType=member, add to $dynamic_group ....in entra ID, but you could only get as granular as "all staff from school X" in the main tenant. That would be useful for neatness / automation. For more granular control you're manually adding people to groups (or changing their attributes in local AD/home tenant so they're auto-included in dynamic groups).

It would be interesting to have a webinar on exactly what monitoring is in place and whether (should something go wrong) it kicks someone out of bed or if they all just roll into the office as normal and find chaos.

Assume you've already checked the MIS for staff leaver email addresses beginning with "M"?

Absent outside forces limiting their ability to do so, governments habitually engage in scope creep. <insert frog boiling analogy here>

Not if it's at the expense of chilling of speech by government overreach into private lives, collection of personally identifiable data by commercial entities who'll (let's face it) lose the data and also try to resell it in "anonymised" form. Or, to put it another way, ~61 million adults shouldn't have to handover personal data to use the Internet because a significant proportion of the parents of the ~9 million or so under-18s think it's a good idea to buy them smartphones before they're ready for them.

We're planning the move from ParentPay to Bromcom for online payments, with Live Register as the catering platform (in the schools with cashless systems). We've trialed it with one of our primaries (no cashless catering) and balance transfers was a manual affair carried out by finance. That was relatively easy - there's a much smaller number of pupils, meal payments tend to be paid in advance and there's not many ad-hoc transactions. The secondaries will be more a bit more involved. I don't forsee any problems from the Live Register end (couple of hours work per school), but getting the balance transfers right will be interesting.

Cheers, I've been looking at the Switch option instead as it looked a bit more maintainable. Quite tempted just to get Salamander to rebuild and automatically suffix the displayName and save me a job (there's some existing suffixes that I also need to account for/strip out).

It's quite grindy and throwing Runtime errors for Azure SSO accounts post-login too.

Ok, so I devoured books 1, 2 and 3 and I'm now on book 4 of the series. Recommended.

Has anyone managed to do any if/then decision making with expression-based attribute mappings? I've got a basic "When exporting from Tenant 02 to Tenant 01, suffix displayName with a two-character school code" expression to make life easier for Tenant 01 (we hire a lot of people with the same first names): Append([displayName], " [XX]") but for Tenant01 to Tenant02, I'd like to append a suffix based on the email domain, as I have 3 schools + MAT in Tenant01 and just slinging a MAT suffix isn't helpful for "who is Bob and which school are they at?" purposes. Something like "if email domain = school01.tld, append AA, if email domain = school02.tld, append BB, if email domain = school02.tld, append CC, if mat.tld, append DD" Edit: Expressions reference is here: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/functions-for-customizing-application-data?toc=%2Fazure%2Factive-directory%2Fmulti-tenant-organizations%2Ftoc.json#examples

https://letsencrypt.org/2026/02/18/dns-persist-01.html

Currently? They don't get M365 logins (or email) until secondary school. "Login to a computer" logins are generic until Y3, then named with individual passwords. If pupils really need M365 logins for T&L (ours typically use shared iPads, with occasional laptop use for CS), consider using "school owned device (Entra joined/hybrid joined)+ school IP range(s)" as second factors in a conditional access filter to avoid the "generic/terrible login accessible from the Internet" problem.

@Boredguy How much (if any) cleanup work did you have to do with guest accounts from Tenant02 that have access to resources in the main tenant? MS documentation states that a second "real" account is created and then you manually clean up the "guest" account and everything will be fine (tm). Does that match your experience?

^ I've heard that mentioned in other 802.11x/iPad threads and have a ticket open with them to enquire about the education pricing.

Not really. Whatever backend/middleware I use has to be able to talk to identify, issue certificates to and renew certificates for devices linked to (for example): Jamf School (not Pro, which can co-exist somewhat with InTune) Google Workspace Entra Hybrid joined InTune without requiring enrollment in InTune. At least until hardware refresh/licensing renewals come around. ...so Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile is a deal-breaker.

*thread necro* @ConceroEdu_Brad - did you ever demo this? I'm in the market for a solution that can handle certificate issuance, renewal and 802.11x auth for misc devices with minimal faffing once configured properly. That is priced keenly enough that it's affordable/worth paying for (vs doing it manually and documenting so my crew can then maintain it). Oh, and I can bolt other random schools/platforms onto it as I need to.

Finished The Daughter's War by Christopher Buehlman. Low-ish fantasy. "War's been going on so long, women now comprise the majority of soldiers and some of them have shetland-pony sized battle crows." It's a prequel to one of the protagonists of "The Blacktongue Thief" by the same author. Overall good. About to start The Long Way to a Small Angry Planet by Becky Chambers, which was recommended as "like The Expanse series but more hopeful".

Haven't seen it (and don't have an examscreen install handy to test). If you add more than two line breaks does it reduce them all to one? If it does, that looks like a pre-printing cleanup choice. The creator is pretty responsive via email.

But on MyConcern (for example), a member of the safeguarding team(s) can tag me into specific safeguarding cases to add notes / data (usually, "what's Fred been searching for?") without needing to give me wider permissions beyond "can report concerns about children".

^ Right, let's nip this in the bud. It is fantastically unhelpful for a school dealing with a cyber incident to also have to deal with phone calls from Internet randos who are curious about it. Had they answered, they wouldn't have told you anything beyond what's already been made available. Comms on the subject will be controlled and routed via the HT and governance. Staff will have been explicitly instructed not to discuss it with third parties, especially if they're not certain they've spotted and resolved every problem. That's normal. It's basic incident management: https://www.ncsc.gov.uk/guidance/effective-communications-in-a-cyber-incident Managing external factors Manage speculative media coverage with care, such as inaccurate reporting about the impact or suggestions that personal data has been compromised when it hasn’t. By managing communications proactively, you can control the narrative around the incident. Highlight your response efforts, the steps you are taking to prevent future incidents, and your commitment to safeguarding stakeholder interests. Avoid compromising the integrity of future investigations by regulatory bodies or law enforcement agencies. You can still provide updates that are factual and consistent with the progress of the investigation, without revealing sensitive details. You should also avoid speculation or premature conclusions about the cause or extent of the incident, or who is behind it. While some groups require more detailed information about the incident than others, you should be aware of the risk that this information could be leaked to the media.