Administering Google Apps & Chromebooks for Education

Transcription

1 Administering Google Apps & Chromebooks for Education February 4, 2016 Edward / google.com/+edwarddoan

2 customer quotes and snippets It s almost this easy. also highlight customer map? Google confidential Do not distribute

3 Administering Google Apps User creation, deletion, administration Google Apps services and organizational access Mail delivery, routing, & filtering Groups Security Chrome Policies Support

4 Access the Admin Console admin.google.com

5 User & Services Management User Provisioning Organization Units Managing Google services

6 User Provisioning Options Method Phase Staff Notes Manual Provisioning Pilot Google Apps Admin Easiest method, but not scalable CSV Upload (Admin Console) Core IT Google Apps Admin More flexibility than manual, but not scalable Google Apps Directory Sync Early Adopter Global Go-Live LDAP Admin Integrates with LDAP, scalable, requires no programming LDAP Admin, Development Staff Scalable, flexible, requires in-depth programming Admin SDK Directory API

7 Recommended OU Structure

8 Google services are controlled by administrators per OU Details Two tiers of services: Core & Additional Different Terms of Services (one time acceptance for users) No SLA for additional services Configured by OU level settings Core Services Gmail, Calendar, Contacts, Drive, Sites, Google Groups, Hangouts, Vault, and Classroom Additional Services Commonly used additional services include: Google+, Google Maps, YouTube, Analytics, and Chrome Web Store

9 Why Structure? Create organizational structure in order to control which Google Apps services are available to users and what settings are applied.

10 Key Lessons OU Structure not supporting for service settings i.e. OUs broken down per school rather than Staff/Students. Provisioning methods not providing granular structure or groups GADS not used to translate to supportive structure Testing OUs for kiosk mode Effective account lifecycle not in place

11 Mail Routing & Delivery User Provisioning Organization Units Managing Google services

12 Mail Routing: Early Adopter Co-existence Gmail MX Record Existing AV / SPAM / DLP External Sender (if part of legacy architecture) Routing Rules Legacy / Unknown Users Inbound: Intra-domain: Outbound: Shadow Domain Gmail gmail.yourdomain.com Legacy Mail Server

13 Mail Routing: Go-Live Gmail MX Record External Sender Routing Rules Unknown Users Legacy Mail Server Inbound: Outbound: Gmail

14 Mail Routing: Common OU Settings Setting When to use Comments Routing: Receiving When implementing split-delivery and/or a special receiving routing rule for a given OU Requires all users to be provisioned. For users non-provisioned, use default-route instead Routing: Sending When implementing a custom delivery route for outbound or internal mails Allows you to put in place a sending policy based on Organizational Unit Compliance: Content When implementing split-delivery and/or a special receiving routing rule for a given OU Requires all users to be provisioned. For unprovisioned users, use default-route instead Compliance: Objectionable Content If you need to setup a rule based on custom objectionable words Add words into a custom objectionable list Compliance: Footer If users need a uniform footer in all mails Supports rich text format

15 Mail Routing: Routing Actions Reject/Modify A message can be rejected or modified When multiple rules affect a message, the reject rule always take precedence Change recipients Change the address of the recipient Add a recipient to the message Change content Prepend subject Remove attachments Reroute message Change the route to another system (eg: Legacy server) Can be done by IP, host, or MX Optional: Reroute Spam (if you want to route all mails including Spam) Add headers X-Gm-Original-To header - useful to track if the delivery address has been changed X-Gm-Spam header - useful to tell other hosts if Gmail thinks the message is spam) A custom X- header to the message Spam Bypass spam filters so as message is not marked as Spam

16 Groups, Calendar, Contacts Uses for Groups Shared Contacts Calendar Resources

17 Google Groups Security & Administrative Features: Distribution Lists Allow posts from external senders, or only from users within the domain Permissions Groups Shared Mailboxes Control who can join the group Google Groups Ability to moderate messages before they are posted Sharepoint Replacement Discussion Boards Public Folder Replacement Control who can view content Prevent users from adding external addresses to the groups they own Option to allow users to keep groups out of the GAL Does not require a user license Configured in the Admin Console

18 Google Groups - Best Practices Naming Group names do not support symbols or special characters Display name should be descriptive of the actual group use User Managed Groups Allow all employees to create and manage groups available to domain users For large organizations, Google recommends disabling user managed groups All groups are provisioned with a specific set of access rights and features True of all groups created manually, via API or GADS Use the Groups Settings API to change required settings in bulk Core IT and Early Adopter phases should be thought of as coexistence Ensure all groups are setup correctly in legacy system during migration Starting with Early Adopter phase, all mail should be routed via Google When MX records are pointed at Google and groups provisioned, mail cannot easily be routed to the legacy system. Google does not recommend this configuration. Use the Groups Settings API to change required settings in bulk Provisioning Coexistence Mail Routing

19 Contacts in Google Apps Google provides two types of contacts: 1. Personal Contacts: unique to individual users 2. Domain Shared Contacts: centrally managed, domain accessible contacts (vendors, customers) Both types of contacts appear in: Auto-complete for Gmail, Calendar, and Drive Contacts search results Gmail Contact Picker Note: The global address list (GAL) is made up of user accounts, nicknames, groups, calendar resources and domain shared contacts.

20 Calendar Resources in Google Apps Provisioning For Exchange and most LDAP systems, use GADS to provision calendar resources For Domino, use GAMIN calendar resource provisioning Other options include Admin SDK or manual provisioning in the Admin Console Naming Agree on a naming convention before provisioning Use a resource naming convention to create a hierarchy Considerations Ensure single source of truth for resources throughout deployment Ensure correct visibility at provisioning time Resources will inherit the default settings For booking, set visibility to "Share all information" Train users on changes to naming convention and booking process

21 Google HEX 3369e8 eeb d50f25 RGB HEX 75787B 4285F4 RGB Google F23A35 for WorkE4A F9D Security Why Drive? Greys User Authentication Auditing Vault HEX e6e6e b1b1b1 d4d4d4 e9e9e9 RGB Google confidential Do not distribute

22 Google Apps User Authentication Google supports three user authentication architectures 1 Google Authentication - Google stored credentials 2 Google Authentication with 2-step Verification - Smart-phone based second factor 3 Single Sign-on (SSO) - SAML 2.0 standard authentication

23 Google Authentication Summary: Authentication with ID and password stored at Google Users are presented a Google login prompt Pros: Consistent login experience for users Leverages Google login security features Leverages Google s global load balancing No third party software required Cons: Inability to control access via IP address Additional login required to corporate web-based application (no SSO) Inability to define advanced password policies

24 Google Authentication with 2-Step Verification Summary: Recommended Google Authentication Architecture User credentials are defined in Google and users are prompted for 2-Step Verification (2SV) code 2SV codes are received via text message or phone call, or from an Android or iphone mobile application App Passwords are generated for clients that do not support 2SV Pros: 2SV adds critical protection against phishing Cons: Not compatible with SAML 2.0 (SSO) User initiated enrollment process

25 Single Sign-On Summary: SSO support for SAML 2.0 compliant SSO servers Pros: Single credential for corporate web applications SSO servers can provide custom security controls Time, location, password policies, etc.. Leverage existing IDM and authentication systems Cons: Not leveraging Google advanced security features Third party SSO software required Potential single point of failure

26 Google Apps Audit Logs Auditing through the Admin Panel, API, and User Account Summary Audit user settings such as 2SV status, monitor password strength, or revoke / authorize access to approved OAuth applications Run admin reports and logs, calendar audit logs, OAuth token logs, or all web-based logins for users in your domain Admin Alerts Receive notifications for suspicious logins, admin console changes, or user password changes Reports API Programmatically access log information for you user login audits, doc sharing audits, audits, user setting audits, and user reports User Account Activity Users have the ability to monitor their own account usage for suspicious activities or how to sign out of all active sessions Admin Security Tab Audit Reports

27 Google Vault Google Vault is now a core service for Google Apps for Education. Vault lets you retain, archive, search, and export your organization s , hangout and drive data for your ediscovery and compliance needs. Vault is entirely web-based, so there s no need to install or maintain any software, which will save your school IT costs and resources. Search your domain's Gmail, Hangout & Drive data for legal discovery purposes Place user accounts (and related data) on litigation hold to preserve data Notify users of litigation holds and track acknowledgments Manage related searches and litigation holds under a single container, called a matter Share matters among authorized users Export search results in standard file formats Save your search queries Set retention policies for your domain

28 Google HEX 3369e8 eeb d50f25 RGB HEX 75787B 4285F4 RGB Google F23A35 for WorkE4A F9D Chrome Management Why Drive? Greys User Policies Device Policies Networks HEX e6e6e b1b1b1 d4d4d4 e9e9e9 RGB

29 Chrome User Settings Best Practice Set granular policies by OU Pre-install apps Set default pages to load on startup Assign Bookmarks URL blacklist

30 Chrome Extensions & Apps Best Practice Pre-install apps per OU Block apps & extensions Recommend apps

31 Chrome Device Settings Best Practice Restrict sign-in to Forced Re-enrollment Assign Printers Recent Activity Reporting Set up Kiosk Mode

32 Chrome Device Management Best Practice Assigned owner & location Track usage Activation & update status bit.ly/cbinventory

33 Networks by popular demand

34 Support Google confidential Do not distribute

35 Google Support Best Practices Designate a Team to Keep Support Site Up-toDate Send out Monthly Newsletters to Share What s New in Google Apps Use Google Help Article links for auto updates from Google to minimize number of changes. Training videos and recorded webinars continue to be a tool leveraged for new employees Continue to Update Knowledge Base Continue to document learnings from support tickets opened by users. Track Success Google confidential Do not distribute Send post Go-Live communication and training Tip of the week: goo.gl/xb0ma Share helpful use cases Track reduction in "how to" and "expected behavior" cases over time Continue to drive traffic to the End User Support site and monitor with Analytics

36 Questions?