Prevent a school account to be under a personal account

[NielsBrockmeier]

Hello,

So we are having an interesting discussion here at school, we can't limit Chromebooks to only a student's school account, but we do want them to at least be logged in to use our SSO apps.

We have had a rough start of this year as here in the Netherlands there is now a school-wide ban on phones for students. This coincided with a change IT was preparing to limit Chromebooks to sign in only with a school account during school hours. 
Unfortunately, some mishaps were made over at our legal research department and we got some backlash from limiting the devices as apparently the devices are owned by the parents and not the school, we just manage them.

To get back to the actual question: Since we can't limit who logs in on the Chromebooks, parents own the Chromebook and not us, I was looking at a way to at least "force" the students to log in to their school account as the primary user. 
I have found settings to block students from adding their personal account under their school account (Disable secondary account sign-in) but this only pushes them away,  to use their personal account as a primary account and adding their school account as a secondary account. 

Does anyone have some insight into how we can prevent a user from adding their school account as a secondary account on Chromebooks/Chrome Browser?

[James_Seymour]

Hi Neils,

I don't think there is any way you can enforce this unless you provision the Chromebooks with a license. Then you could set them to auto-provision with a school account and still allow secondary accounts. But unfortunatley this will cost $ but does bring some benefits of being able to manage the devices.

Out of interest, how does this affect SSO apps? Surely, once a user is logged into their school account (primary or secondary) SSO will work as it is Google account related, not device?

[NielsBrockmeier]

Hi James,

Thank you for the response. We do have all our Chromebooks managed, we have a 3rd party managing Chromebook repairs for students who also provision the Chromebooks for us. When they open the Chromebook it has our school domain on the sign-in screen pre-filled.
The problem is we aren't allowed to limit sign-in to just their school account, that became clear at the start of this year. We also use, instead of forcing sign-in, a proctoring tool on our Chromebooks. So a lot of students now sign in with their personal account on the Chromebook and then add their school account as a secondary Google account within their personal account on the Chromebook. This way they can use our SSO to sign in to the school applications, which can't be proctored, and they can also still use all the Android apps on the Chromebook. Our goal is to have them not able to sign in with SSO if they are not primarily signed in with their school account, but only on ChromeOS and ChromeBrowser. Since they can use their phone at home to use SSO to sign in to our SIS as well we can't limit that feature.

I know it's a tricky and complicated scenario, and maybe there is just no solution.

[Kim_Nilsson]

Someone made a wrong decision. Anyway, there should be ways to control this behaviour the way you want.

You should have a user agreement that even if the devices are BYOD and not owned by the school, you should require the device be managed, and restricted to school accounts DURING SCHOOL HOURS.

This should be acceptable to everyone, because it is possible to have the device be wide open after school hours.

It's called Device Off Hours.
https://admin.google.com/ac/chrome/settings/device?hl=en&f=POLICY_NAME.DeviceOffHours

Also, forcing school accounts to be primary accounts should make it so they can't log in with their private accounts and then use their school accounts as secondary accounts.

https://admin.google.com/ac/chrome/settings/user?hl=en&f=POLICY_NAME.AllowedDomainsForApps+PLATFORM....

[NielsBrockmeier]

Thanks for the response and I completely agree with you Kim, unfortunately here in The Netherlands parents have a lot to say about what we (School/ICT) can and can't do with personal devices even if used, and specifically bought, for school purposes.

The reason I'm looking for an account option is that school hours differ per class, and we have schedules that change based on availability and we even have some optional classes. So the off hours didn't match the student's timetable. That is also what agitated the parents and caused the issues earlier this year.

There are 2 main issues that we have ran into when rolling our Off-hours earlier this year:

1. We had the devices off-hours set up, but since we have 8 different locations with 8 different timetables and days off, and off hours can't be scheduled with GAM, that would require a lot of manual work from IT. We have 5 mandatory school breaks per school year, which means you'd have to set and remove the schedule 5*8 so 40 times a year and the Off-hours schedule setting isn't the most user-friendly when crossing date borders...
   - And this is just 1 week+ breaks, not the 1 day off students have a few times throughout the year...
2. Added to that is that our classes have different hours based on schedules, so year 9 class 1 might start at 8 am and end at 14:00 (2 pm) while year 9 class 2 might start at 8:45 am but they end at 13.15 (1.15 pm) on Monday. Tuesday this might be the opposite and Wednesday they might have the same schedule. Add to this all the different years (6) * locations (8) we're talking 200+ classes with mostly different schedules.

Of course, it isn't necessarily needed to follow the times from point 2 exactly but point 1 is already an issue for parents, especially since (younger) brothers and sisters might be using the same device at home outside of school hours and they can't do that if it's locked to a school account.

To me, that would just be a minor inconvenience, as most days it wouldn't be an issue, but some parents here even went to the newspaper about all this 😅

[Kim_Nilsson]

Yes, the first mistake was allowing private devices in school.😂

Second is to care about differences in schedules.

Adhering to school rules should override ownership of the device. Else you need to stop allowing BYOD.

It's as simple as that.

[NielsBrockmeier]

Hahaha yes that is true, an unfortunate choice I agree. Originally the idea was that these were school devices which were assigned to a student, and because of insurance need a caretaker to sign for it. This eventually became too much of an administrative hassle, so it was decided that parents could order a device with the 3rd party and also choose the device their child would get from a list. They are all ChromeOS but there are 3 choices ruggedized, medium and sleek. That is also where device ownership transitioned from us to them apparently, but this was never properly communicated to ICT...

Differences in schedules are something that is part of the Dutch secondary education system unfortunately, that won't change anytime soon. It would make it so much easier for a lot of roles within the school though if we didn't have so many different schedules.

Also, an unfortunate problem is that we are required to do BYOD or provide all devices as the school, but when we had that for a few years students would break the devices and the school would have to pay for all repairs. Since, unless you had a video of it, parents would just say their kid didn't do it and there was no way to enforce payment as education is mandatory here instead of a right. So you can't expel the student either for it as they need to be there at school unless it's unsafe for others.

[Kim_Nilsson]

Yeah, it's the same here with compulsory school, so we have insurance.

And it was always an accident.

Anyway, those are the options you have. It sometimes comes down to the map vs the reality, and every now and then you have to stick to the map, and everyone will just have to accept that it's not optimal, but trying to have it both ways just isn't feasible.

[James_Seymour]

Hi Neils,

I was thinking that using these 2 options it looks like you should be able to force users to first enroll their devices with a school account, rather than trying to prevent them using school account as secondary account.

[NielsBrockmeier]

Good thinking @James_Seymour this might work, though I believe the second option is just for profiles on the Chromebook. Not for adding it as a secondary account within your profile. 

But I'll give it a whirl and report back, it would be great if this solves the challenge, even if it's only partially!

[NielsBrockmeier]

Unfortunately, this is indeed, as @Kim_Nilsson also said, just for ChromeOS profiles and not for Google accounts. This is already set correctly for our domain.

[Kim_Nilsson]

@James_Seymour , I don't think the Multiple Sign-in option should do what we want. Afaik, it's only supposed to be about allowing the user to skip between the two separate Chromebook profiles without entering the password.