dmj

There is a tickbox in GCDS that forces users to change password at first login. You probably have that as on. here is some more info http://www.edugeek.net/forums/cloud-services/208196-g-suite-forces-students-change-their-password-first-sign.html

The passwords only sync when they are changed (in AD)

The lawful basis would happily fit within the remit of education. Displaying children's work improves their self esteem and encourages them. I really can't imagine a hefty fine for this one. Sounds like an unnecessary bureaucratic burden that probably isn't even followed up. *edit: caveat - high profile student who's wanted by the mafia. Mafia puts spies in schools, student get abducted, school gets the blame.

So I suspect memberOf, role1,role2,ou1,ou2 is what Oliver expects to see. At the very least, you will have to pass a memberOf attribute to Oliver - Try mapping 'primaryemail' -> memberOf I must say it does look like neither system is very configurable

The attribute mappings for ADFS will be similar (or identical). What does the documentation for ADFS say?

https://edu.academia.co.uk/academia-announces-significant-strategic-investment-from-strive-capital/ For those that don't know, Annodata are about one of the most incompetent companies I have ever had the displeasure of working with. Lets hope it doesn't affect schools with academia support contracts too badly.

The is also a service degradation with teams:

As other have alluded to, the problem with companies like Novatia is that they sell services to schools, so you won't get independent advise because they will be trying to sell you additional services which will only revolve around how they intend on providing the service, which isn't necessarily what the school needs. You really do need to have an idea of what you intend to get out of this; Any competent tech could script you a list of hardware and software in an hour or so - I'm guessing you're really looking for a strategic plan, or to outsource the entire system? Have you considered talking to the local authority or academy trust for advice?

A former colleague made one using google forms. Notifications were done by email. The finance team would have to copy and paste into FMS, so it wasn't ideal, but the finance team found copying and pasting easier than copying from hand written notes. There is something about approval workflows for manager authorisation here: https://support.form-publisher.com/hc/en-us/articles/115005834245--Part-1-Set-up-an-Approval-Workflow-on-Google-Form

I'm doing a project that involves doing just this. AzureAD, Google Suite, ADFS, simpleSamlphp, Shibboleth, Okta, etc essentially fulfil the same function as SAML identity providers (obviously some have advantages over others). Specifically with AzureAD and bilateral federations: If you go to your Azure portal > AzureAD > Enterprise Applications you will able to add a new application. These will mirror the application that you added in ADFS, so upload the applications metadata and set them up to release the same attributes that your ADFS releases. Download the certificate and upload it to the application and that's pretty much it.

I meant the BYOD education market really. I think the UK is a bit more windows heavy overall because of the SIMS effect and the desire to keep to a single platform.

I think the education marketshare at the moment is about 60% chromebooks, 20% apple and 20% windows.

Not best practice. Only host a VM when there are no other options: IAAS is the last resort with cloud strategy . If we can't buy the service in then we should containerise the app and run it in kubnernetes. It's far more cost effective and has additional advantages such as scalability, self healing and working with your CI/CD pipelines. docker pull scjalliance/papercut-mf

Sounds like you are already in a good position. It would be a good plan to write out the services that are currently onsite and work a plan as to the most appropriate way to migrate them, ie decide whether they can be (replaced) or moved to Paas, Saas, containers or IaaS.

I would certainly think about doubling up the WAN connection, through a different telephone exchange if possible. As for best practices: The goal is really to migrate services SaaS>PaaS>IaaS. Most services should become SaaS: For example move SIMS to offsite Arbour, BromCom or one of the web based solutions that are managed offsite. Services that cannot be bought as a SaaS can usually be run as PaaS (things like sql servers, Active directories etc where (eg) AWS,Google,Azure provide the platform to which you are the admin). Services that you can't get as PaaS then need to be containerised so that they can run as 'serverless' kubernetes - this will be for all the odd things that you can't buy a service for. So the best practice is really to have as few virtual servers (IaaS) as possible in the cloud because these are the most expensive resource with the fewest options for scalability, self healing etc.

I'm pretty sure it's the storage chip. It is possible to change surface mount chips with a hotair station but I doubt it would be worth it for a one off.

Presumably the school bought the ipads VAT free? The school gets the VAT off because they are educational devices not so students can install what they want when they are home. I would suggest to your lawyer deputy head that you can take the MDM off when the VAT is paid.

To be honest I would go back and set it up properly, using an automated directory sync ( do you have a centralised directory such as LDAP, Active Directory or Azure? I think this will be a better long term fix.

I'm probably being a bit paranoid about keeping data longer than necessary !

I think this method probably is the simplest method for non-technical teaching staff: All they would have to do is drop a list of usernames into a pre-defined folder on a network share. Your script would then process the file to remove users. could it really be simpler ? It's free, well supported and takes 5min to setup. You can use this.

No, the script only deletes users whos accounts are suspended and have not been accessed for 12 months. It would be straightforward to increase that timeout to a value that suites. Ideally, with Google we could just do accounts for life. But we've not got around to that yet.

I did this last week because we were getting low on licenses. Our domain is synced via GCDS. Users who are not present in AD are suspended from gsuite and not deleted. The script I have relies on gam, and deletes users who's accounts are suspended and have not accessed them in 365 days. The first part of the script creates the csv. Presumably you won't need to do that part if you already have the csv. This is probably the easiest way, because it required zero intervention from your staff - they just need to upload the scv somewhere and the script runs as a cron. . #!/bin/bash export GAM_CSV_ROW_FILTER='{"lastLoginTime": "date<-365d"}' gam print users query "isSuspended=True" lastlogintime |awk -F ',' '{print $1 }' >/tmp/userlist.csv gam/gam csv /tmp/userlist.csv gam delete user ~primaryEmail

yes it looks like the restrictions are for specific services. I can't see any restrictions on using W10 as a kubernetes server cluster unless you want to offer the windows services above https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm "(iii) Device connections. You may allow up to 20 other devices to access the software installed on the licensed device for the purpose of using the following software features: file services, print services, Internet information services, and Internet connection sharing and telephony services on the licensed device. You may allow any number of devices to access the software on the licensed device to synchronize data between devices. This section does not mean, however, that you have the right to install the software, or use the primary function of the software (other than the features listed in this section), on any of these other devices."

ok so a cluster of 100 windows 10 clients would only be good as a server with 2000 connections, sounds like too few to be worth considering unless it was only serving a local area network for some basic services. Might be an option for those who want a 'serverless' school without the overhead of a cloud infrastructure.

oh that's interesting. Does windows desktop edition still have the license limit that prevents more than 20* external connections, forcing people to buy server edition? Or is that all a think of the past now? *Edit: 20 connections as explained in the post below.