Protecting Accounts for young learners

[Olger]

This is related to this post: https://www.googleforeducommunity.com/t5/Discussion/Context-Aware-Access-to-User-Account/td-p/140696

We're a K12 school, and I'm keen to learn how others protect accounts for the early learners (Prep to Year 3 mostly). I had been hoping to restrict access to certain accounts using Context Aware Access (see above article) but that isn't possible using CCA.

We're a 1:1 school (each student has their own chromebook provided and managed by the school), and each student has their own account. For later years (Year 4 and up) students have a complex password (we reset all passwords each year), but the younger years have lots of trouble with complex passwords. 

We had hoped to restrict access to those accounts to our Campus (based on our IP range), but considering that's not possible, I'm keen to hear what others are doing to balance security and convenience for those younger years?

[panderson]

We use Clever badges for PK-2nd, toward the end of 2nd grade they start learning how to log in with a password. 

[Scott_Kovis]

+1 for Clever - we use same setup as panderson.

[Dean_Mantz]

I will agree with the Clever approach or even Classlink. We use badges with our K-2 students as well. Our 3rd graders follow the same password process as @Scott_Kovis @panderson 

[Olger]

Clever Badges, interesting. Can I use those just for logging in? I had a look at the clever website, but wasn't clear on that. We do everything in Google Workspace, all apps are deployed and controlled through there, and I'd want students to log in through Clever, but then come back to their normal chrome desktop.

Aside from setting up the younger grades in Clever, is all that is required an extension to make the chromebook log in to Clever? I do like that approach.

We don't need any of the SIS integration or other features. Can Clever sync from an API? Or alternatively, can it sync data from a Google Sheet? I import hourly all students from our SIS into a Google Sheet for other purposes, and could use that for Clever too.

[panderson]

Yes, Clever can be updated through a CSC file.  A couple of other things, if you have the paid version of Workspace and use Google Classroom, with the SIS integration you can have it create classrooms for all your teachers. The do still have everything pretty much the same, except you an use a Clever Portal and you can set up a lot of the programs to use Clever authentication and save the hassle of having to roster the program through CSV files.

[Scott]

Depending on your SIS you can either sync through API or just use data uploads via SFTP.

Once users have been synced and you have turned on badges for the schools/grades you want, you will set your chromebooks for that building's ou to use Clever SAML SSO.  There is a setup wizard that will walk you through the steps, it is very straightforward.

Although you say you do not need any other features, if you are setting up Clever I'd strongly recommend looking into rostering your various other third party apps through it.  I cannot stress enough how much of a time saver it is, and how nice it is to have all of our rostering done through a single pane of glass.  You pick the app you're using, tell it what grades, buildings, or teachers to share it with, and you're done.  All of the school accounts you need for that website are now automatically syncing and updating whenever changes are made from your Clever data uploads/syncs.  Even for our students who do not use badge login, we set their homepage to the Clever portal so they get a full menu of our apps when they log in.