Strange Google Classroom action

[ddelboccio]

This morning a teacher reported to me that a standard Google doc that she added to a Google Classroom of hers was being flagged as being "Shared Externally".

She created the Google doc in her own Google Drive, and shared it with nobody.

She attached that Google doc to her own Google classroom and suddenly additional users were added to the document by the system, and now states that it is being shared externally.

I just tried it myself.

I created a dummy google doc.  Then added it to a dummy Google classroom I have and two additional "users" appear to have been added to that document now, and the document is also now flagged as "Shared Externally"

The two users that were added are variations on the name of the classroom, which are:

Technology_101--Dave_Del_Boccio-kplVng@district31.net <--this user has viewer rights

Technology_101_teachers_kplVng@district31.net <----this user has editing rights 

The Classroom name is Technology 101

What the heck is going on here?

[Michael_Roop]

Do you or have you ever had any classroom management systems like Hapara?  I know that Hapara used to have this unfortunate effect as well (maybe not exactly but extremely similar but that was also many years ago).

[ddelboccio]

We do use GoGuardian, but that really only imports the Classroom data once when setting up to use it.

[MarkLoundy]

Had you at any time configured your school domain to be open to the outside?

[ddelboccio]

We have a few domains whitelisted for sharing, but nothing other than that.

This action also just started happening today.

[ddelboccio]

This has become easily repeatable for me. 

Whenever I add a google doc (shared to nobody) to a classroom post (with no students in the dummy classroom), it immediately has two phantom users added to it, and gets flagged as being "shared externally".

The phantom users are named the "Classroom name" and then the "Classroom name + Teachers" both with email addresses ending with my domain.  

What is triggering the external sharing flag?

I also submitted a Google ticket on this.  All indications is that this started today.

[mwhite]

I look forward to what Google says about this. I also see the "phantom" users on our Google Classroom materials. Very weird.

[Michael_Roop]

I can verify on my end that 2 users were added to a doc that I uploaded as part of Material.  Similar in naming structure to yours.  We have added nothing lately to add this nor do we use GoGuardian.

[ddelboccio]

This is not normal, correct?

[Michael_Roop]

nothing that I can ever remember, but I have rarely attached a Doc into a Materials post.  Usually I make the post inside the Classroom.

[ddelboccio]

Did Workspace flag your doc as being "shared externally"?

This is controlled by the "highlight external files" setting being enabled under Drive & Docs Sharing settings.

[Michael_Roop]

This district does not have that setting but I can say that Audit showed the doc being created, being named, then during the upload process within Classroom being shared out to both the user names (visibiliy Shared Externally), and then trashed.

[ddelboccio]

This is Google's response thus far (below).  I pushed back HARD because this document (https://support.google.com/drive/answer/2494822) states:

An “External” alert badge is displayed on files:

Owned by someone who isn’t from your organization or school.
Shared with others who aren’t from your organization or school.
These alerts help you identify potentially harmful files or when to be careful sharing confidential information in external files.

The Google doc in question has ZERO external people shared to it. 

Why have the admin console setting of "Highlight external files" (Apps>Google Workspace>Settings for Drive and Docs>Sharing settings) enabled for "a possibility that external users" might join the class?

That is absurd.  Google response follows:

Hello Dave,

Thank you for your response. My name is Pragyan, I’m working with this case as the original owner is OOO.

I have checked with my internal team and have received an update indicating that this behavior is intended. Since there is a possibility that external users may join your classes, Google Classroom provides access permissions for the documents that are posted in the classroom. This is the reason why the file is showing the message as externally shared, even though there are no external users in the particular class.

When you share a file as an assignment, Google Classroom automatically creates a shared folder. This folder is accessible to both teachers and students in the class. Even if no students are enrolled yet, the file will be shared with you and the automated group for the class. This way, everything is ready for your students as soon as they join.

If you believe this update should be modified or have any insights regarding this concern, please submit a feature request idea so that our product engineering team can review it. They read all feedback received through that channel and consider it when planning future updates.
https://support.google.com/edu/classroom/answer/10011324

I hope the above information is helpful to you. I will keep the case open for the next 3 business days. In case if you have any further queries, please revert back on the case. I will be more than happy to assist you further. If the case closes before you have a chance to reply, you do have 30 days time to reopen the case by replying to this email.

Have a nice day!

Sincerely,

Pragyan | 21:00 - 06:00 IST (UTC+5.5)
Google Workspace Support

[Josh]

This is an interesting scenario. I will say up front that I agree, a badge should not be shown if it isn't physically shared with someone externally. Doing so sends the wrong message to the user and only serves to cause confusion.

This reminded me of the Drive report in the admin console, as it follows the same behaviour for groups and is documented HERE

With that in mind I do understand the Google perspective, I imagine that it was a design decision to efficiently determine which files are/are not shared externally. If the group can have external members, then count it as external instead of checking each member individually.

That makes sense, and I would argue that it was probably ok when it only affected the drive report but if notifications are being surfaced to end users. The accuracy must be increased as it will only cause alarm and confusion.

I think having the badge is a good prompt for users to be mindful so I am following this thread with interest.

[Kim_Nilsson]

Sorry for my slow response, but this is indeed working as intended, regardless of how silly we think it is.

I had a user report it in the support forums where I created a community guide explaining the problem, and how to find files that are truly shared externally, using GAM (of course 😎).

https://support.google.com/a/community-guide/349885635