Maximizing & Securing Google Workspace, sponsored by GetSetTech

Hello and welcome everyone.

Happy Thursday. We've almost made it through the week.

I'm Kelsey Watson. I'm the Senior Director of Membership

and Marketing at Atlas,

and I am absolutely thrilled

to introduce some great folks from Get Set Tech.

Uh, Steve has been a pleasure to get

to know they're a newer, uh, vendor partner of Atlas's,

and we're really excited about this topic.

They've worked hard to put this presentation together,

so sit back and enjoy.

And, um, I believe that the team would like you to kind

of hold questions to the end

so they can get through everything.

Um, so Steve, without further ado,

I am gonna pass it off to you.

Wonderful. Um, everybody see my screen okay?

Yeah, it looks great. Awesome. All right.

Well, we are excited to be here.

Um, thankful for the opportunity.

I've been a long time partner and friend of Atlas.

I was actually at the first one 10 years ago, so I'm excited

to be back in this capacity.

Um, there is a Bitly link to this slide, uh,

show in the Zoom chat.

Kelsey will be putting it in there

so you could follow along in there

or refer to it in the future.

Um, tell you a little bit about who Get Set Tech is.

We love helping schools get their settings set.

Uh, there are so many settings in the Google admin console,

and we are the only Google partner

that specializes in small schools and nonprofits.

And our goal is how do we help them leverage, uh,

Google Workspace to really make an impact at their school?

A little bit more about the company, um, some

of you might have known me from, uh,

my work in independent schools in the past.

Um, one of the things I got to do was, uh,

be the Google admin for a large school district, uh,

55,000 students.

And then I also, uh, was on the identity engineering team

for Airbnb.

And both of those organizations are full on Google.

Um, so over 110,000 Chromebooks they were managing.

Um, and I got to see enterprise level, uh,

workspace best practices and tools.

And so the whole reason for Get Set Tech is

how do we take those enterprise level practices

and bring them, uh, to our community, which I was a part of

before those other opportunities.

So that's what makes me excited about Get Set Tech.

A little bit about our team.

We're slowly growing as we onboard more schools

and introduce, uh, new tools.

Um, mostly focused on admin console,

but we also have some professional development we're

starting to offer in terms of different Google products.

These are just some of the testimonials.

If you go to our website, you could find more there.

Uh, we partner with other, um, EdTech companies

that are doing good things that, um, we could then,

you know, send our schools to.

We don't want to just make it about,

you know, us and what we have.

We also, we've partnered with Figma

and our biggest partner is obviously Google.

Um, so we're looking very closely at, you know,

how do we help schools for the, for the full package and,

and direct them elsewhere when,

when Google can't come up with the right answer.

Um, so these are our presenters today. It's the three of us.

I'm gonna go ahead and hand it off now to Adam, uh,

who will introduce himself and then Lisa after that,

Well, hey, good.

Uh, morning or afternoon or maybe even evening,

but depending on when you're here with us,

uh, watching later or live.

Um, I'm Adam. I'm the Technical Account

manager here with GetSet Tech.

And I, uh, bring with me a number of years of experience,

uh, about 10 or more years in IT support and Apple products.

I love Apple products, and I love learning about, um,

schools and what they need to set up their, uh,

workspace environment right for them.

So that's what I love doing, helping out here

and, uh, bringing to the table.

Nice to meet You'all.

Hello everyone and welcome.

Thank you for joining us today. My name is Lisa Spencer.

I am formally the director for Instructional Technology

with Prince George's County Public Schools,

which is a large school district in Maryland.

I am here with Git Tech Set, uh, Git Set Tech.

Sorry, I, I'm the marketing ma project manager.

Um, and I am happy to be here.

So I'm looking forward to working with each of you.

Thank you.

All right, thank you both. And then, Adam,

you're gonna lead us through some disclaimers,

very important disclaimers.

So if you want to go ahead, Adam and

share your screen and take over.

Great. Thanks Steve.

I am happy to get us kicked off here today, just

with a few disclaimers.

Um, these are just a few things we wanna orient you

around thinking about as we get going in this webinar,

and you're about to see and learn a lot.

So we're excited about that.

Um, let see here, let me click through.

Alright, disclaimer one, you'll see some dancing folks

with their hands lifted high from Seinfeld.

Um, what we mean by this in the disclaimer, we want you

to see, you're gonna see a number of things in this webinar,

uh, related to the settings in workspace.

And you're gonna see some of these settings in Rejoice

because maybe you've got it set just the way you like it.

You've been there, you've done that,

and hey, that's less you have to think about.

We're happy for that. We're gonna,

we're gonna let you rejoice in that.

So there's some other folks in here perhaps that see some

of the settings that we talk about,

and they may want to just slightly scoot back into the bush

back behind them because they're like,

I have not seen that, touched that.

Not sure what to do with that. Um, that's totally okay.

We want you to know that both kinds of reactions

to the things you're gonna see are welcome here.

We want to get, uh, everyone oriented in this webinar so

that, um, maybe everybody comes to a more comfortable place.

And, um, that's what we, that's what we're looking to do.

We don't want anybody to go on their admin,

Google admin console

and change anything during this webinar.

Please don't. You might make a mistake,

or some of the recommendations we might make may not apply

to you and your school environment.

So we don't want any, anybody to get in trouble out there.

We could spend hours

and in depth on a lot of these settings

and, uh, what it could do for you and your environment.

But we want, uh, you just to take this in for now

and then maybe bring, you could bring questions

or talk to us more about it, uh, later.

Um, this kind of disclaimer idea here behind this kind

of image is that there are many ways you can approach

how you set up your environment.

Um, there are ways

to think about things in very calculated ways

and how, how to apply that in a very, um, uh, measured way.

And there's also creative ways you're gonna bring into, uh,

some of these settings that maybe just apply in your context

that are maybe a little, uh, a little less just cut and dry,

but maybe you're trying to figure stuff out, um,

in a more creative way.

That's great. We,

we're gonna show you some recommended ways,

but we can also partner with you to learn more about

what you need and as well, how it might apply.

Um, that being said, again, some

of this stuff can get really technical

and it can, uh, for some people who are not used to that

be maybe a little overwhelming.

That's okay. We just want to get you introduced.

We want to spend some time showing you some recommended

settings, sometimes showing you

what a few things you can do.

And maybe that'll help get the gears spinning.

Maybe that'll make some things click, maybe that'll, uh,

really help get off the ground.

Um, as, as we, uh, go through this webinar, you're gonna see

that there, uh,

obviously are various additions in Google education, uh,

workspace that, um, apply.

We're gonna talk about some settings that may apply to some

of the more, uh, plus or standard plans.

But most of the things we're gonna cover in this webinar

do apply to the no cost, uh, fundamentals plan.

So we think that there's gonna be

something for everyone here.

And anything that we do identify later on

that's gonna be in one of those higher plans, um,

you're gonna have, we're gonna have a, uh,

little icon there, and we're gonna mention it

that it's gonna be probably mo only available in

the standard or plus plan.

Again, just a reminder, don't, you can log in

and look maybe, but don't make any changes, uh,

while we go through this webinar.

We don't, we don't want, uh, any, any problems with your,

with your environments or schools.

With that, that being said,

that should do it for the disclaimers.

I'll hand it back.

Awesome. Thank you so much, Adam.

And I'm gonna go ahead and, uh, jump right in.

Um, what you'll find over the next six sections is we'll

begin with some light housekeeping,

and then we'll kind

of get more progressively into some deeper

of the deeper weeds.

And, um, we've really looked at

what the fundamentals version in making sure that

what we share with you today, uh,

is gonna be applicable to all schools.

So let's go ahead and jump right in.

The first one is this, um, within the Google admin console,

you can have multiple domains.

Often people don't know about these secondary domains,

especially if you've taken over a school, um,

or you're new to a school.

We may not take the time to go

and look at what are some

of the secondary domains you might find.

You know, they say most tech breaches happen

by a previous employee or a current employee.

And so one of the back doors is if someone has, uh,

added another domain that you don't know about, that

that could be something that, uh, could throw you off.

So we recommend go

and take a look, be aware of

what your secondary domains are.

Um, we don't want your users to be shocked

by new settings within the Google admin console.

So we recommend for people, uh,

to do the scheduled release rather than

do the rapid release.

Um, I remember in 2019 when Google released the grade book

within classroom and a bunch of schools were reaching out

and struggling because their teachers were just

so surprised by it.

Um, so there is a setting within Google admin console

where you can set your preference to say, we only want, um,

we want at least a two week notice or a two week window.

Along those same lines,

there's another setting in that same area.

And by the way, for this slideshow on the very bottom,

we actually put the location of, uh, the setting in your,

uh, Google admin console.

So you can go and find the setting that we've, you know,

screenshotted and we also have a help center on the bottom

right where you could go and learn more from Google

or from get set tech resources.

Um, in terms of these specific settings.

So this is another one of those settings where Google loves

to introduce new products.

And it could be not the ideal time for us as educators.

It might happen in the middle of the school year.

Uh, so we recommend in your admin console turn,

turn these settings off so that you can be prepared.

You've already been warned, you can do some PD

before any new apps, uh, or features come online.

This is, um, plus

or standard premium feature setting within Google admin

console your data at rest.

So this is data that is not accessed very much.

Um, the, uh, Google sets the, uh, where,

where that data is stored at, no preference.

Um, but for those of you that are plus

or standard schools, you can actually go in

and say, I want it, I want my data

to be in the United States.

Um, I don't know really why Google does this.

It's because, uh, I I I feel like they should know, Hey,

if we're a school, uh, we're in the United,

if we're a school in the United States, that's

where we want our, our our at rest data.

But it's just a setting that most

of us don't know about, don't think about.

But if you are on the plus

or standard P plan, we recommend going in

and, uh, just setting your preference to the United States.

If there is ever, uh, any kind of a breach,

at least you could say, yeah,

our data was was in the United States,

and you knew that it was there.

Okay, so that was really light, just some things that most

of us probably already have down.

Um, now we're gonna go into the second section,

which is all about admin accounts.

Um, and the first thing is this.

If you've had someone leave your school,

make sure you remove their admin privileges.

Um, and all you gotta do there is go into your directory,

sort it by suspended users who have any kind of a role,

and go ahead and remove those roles.

If, if there's a employee that was on the IT team,

they left the dis, they left the school,

and then five years later they came back

as a substitute teacher

and you someone reactivates their account,

now they have this privileged access.

People often forget about, you know, uh, that,

that person's previous work

and they don't know what roles they may or may not have.

So we recommend at Get Tech, go in there, find out

who your previous users are

and remove their admin privileges.

You don't want this kind of a screen where, uh,

you've got a lot of people with admin roles,

even though they're not with that school anymore.

Chrome, uh, custom admin roles, oftentimes within a school,

uh, you might wanna give someone granular role.

So someone has created a custom role.

Go ahead and just audit that once a year. Take a look.

Are there any custom admin roles

that have been created in your domain?

Are they still needed? If they're not needed,

go ahead and get rid of them.

Find out who has them.

These are sort of some of the settings that might slip

through the cracks when it comes to admin accounts.

Here's another, uh, best practice.

I know that early on I would name, um, admin accounts super,

or I would include the word admin in them.

Uh, we recommend not making any of your privilege

or admin accounts do not make it, uh, visible in the name,

especially in the email.

So we recommend doing something like alt or secondary

or infra or helper.

Um, so these are just some best practices

because if you're a hacker and you're trying to breach

or get into somebody's, uh, Google Workspace environment,

you're gonna be able to identify these privileged accounts

if that name is obvious.

So we recommend, um, we recommend eliminating that.

The other piece here is, um, uh,

multifactor for your admins.

I know this one goes without saying, most

of you already have pushed multifactor

to your entire schools,

but make sure for your admin accounts,

including service accounts that you have, uh,

enabled multifactor, even if they're non-human accounts

that you never log into.

Okay, I don't know about you all,

but this is, uh, filling my heart to talk about some

of these settings that, uh, we tech people get to get

to have fun with and, uh, get into.

So this one is, uh, another setting that's,

uh, really interesting.

Um, we recommend having a secondary account

as your super admin account.

We don't recommend schools using their daily driver

as their super admin account.

And the reason is, is

because you wanna lock down the settings for your admin.

Um, ou things like anyone with a link, one of the schools

that we support, uh, previous tech director had set one

of the folders that had a lot of privileged information so

that anybody with a link could access that folder thinking,

oh, well this is trustworthy

because it's just, I'm gonna email it

and no one else is gonna have access to it.

But, uh, what you really wanna do is actually eliminate the

ability for a admin who, who gets

to look at confidential items, who gets API keys

and is doing, um, a lot of really important work.

You don't even want them to have that option.

So ideally, and this is where the plus

and standard comes in in terms of, uh, target audiences,

and we're gonna talk more about target audiences,

uh, as we keep going.

You wanna set target audiences general access groups

for your super admin group

or your admin group where they only have the option to share

with the IT team, otherwise it's restricted.

Notice the anyone with a link option is not even there.

Uh, this is one of those best practices that, um,

enterprise organizations do.

It makes sure that nothing is gonna get shared, uh,

you know, broadly without someone really going

out of their way to do that.

And, um, the feature of anyone with a link

that's actually not a plus

and standard, there's just a setting.

And so again, we've got the

setting location here on the bottom.

And the setting is when sharing outside of, you know,

your school is allowed,

users in the admin can make files published web content, uh,

visible to anyone with a link.

We just recommend uncheck that for your admin ou.

Um, and, um, that's one less thing you have

to worry about in terms of data being leaked.

Primary, uh, admin accounts and secondary emails.

Um, make sure whatever your primary admin account is in your

admin console, that, um, you have that being forwarded

to other, uh, admins.

Oftentimes, uh, the primary admin gets some

of the most important emails from Google

about changes that are coming.

Um, and, and you wanna just make sure

that other people can see those emails.

So we just recommend set up a forwarder for anything

that comes to that inbox to go to your rest of your IT team.

We also recommend for secondary email,

I've seen too many times

that tech directors will use their personal email account.

Um, we recommend having a generic email account

that is shared amongst your tech team, um,

in case of an emergency.

Uh, so you would set up a Gmail

or another, I mean, Gmail actually is the,

the one that we recommend.

Um, and you set up multifactor with that, a UB key

that you might, uh, by two or three UB keys

and give them out to your team

and say, Hey, can you make sure you could log into this

account and you have multifactor set up on it.

Um, you just don't want a situation

where it's all bottlenecked on one person.

Okay. So that was section two all about admin

console settings.

Um, now we're gonna switch into sort of some settings

for your day-to-day for your, your users.

Um, the first piece is not as much of a setting,

but just more of a reminder.

Um, please go ahead

and, uh, be intentional about your OU structure.

What you're seeing on the screen is an OU structure

that we recommend, but you know, every context is different.

Um, we did, we just make sure there, there's been, uh, times

where we've seen that people didn't take the time

to really think about and create an OU structure, um, that

that would keep everyone safe

and set the right settings for the different grade levels.

So we just wanna make sure, um, that you, um,

have thought deeply about your OU structure.

And of course, we could have a long conversation about OU

structures, um, if that's something you're interested

and we can jump into.

But for now we're just saying make sure you've, uh,

really take the OU structure seriously.

Um, and from a security perspective,

make sure there's no users or devices in your root ou.

Um, often we might create a user,

we might create them quickly

and they end up living in our root ou.

So a quick easy test to see, you know, how safe

and secure is my admin console.

Just go and see if you have any users in your root ou.

The reason why we mention this is

because all these other OU are the ones

that you're more intentional about.

You're gonna go, uh, in your staff ou

and set them, uh, with specified, uh, granular controls.

Same for students, same for offboarding,

but often our root ou we don't want to go in and touch

because then it affects everyone.

So we just recommend that, uh,

your root OU shouldn't have any users or any devices

because those settings may not be, uh, really fine tuned

for safety and security like the rest of your settings.

Inactive users, uh, this is an easy one.

Uh, you want to go in your directory, download all

of your users, it'll produce a spreadsheet

with all kinds of data.

Um, and we recommend looking at this right side here

of active accounts

that haven't been signed into within the last six months.

Um, just take a quick look

and ask why are these accounts still open

if no one's using them?

Do I need to reset their password?

Should I check with that department

and see if, uh, they're still using these accounts?

You know, these open accounts just sitting around

or accounts that could be used to Phish.

There are accounts that could be used to gain access

to your Google admin console.

Um, so just keep an eye on that.

Alright, comprehensive mail storage.

I debated about having this setting here

or, or another area.

Um, have you ever shared a Google Doc with someone

and wrote a message when you've shared that doc with them

and then later wondered, man, what was that thing

that I said to them?

Um, and most of us, uh, it just disappears.

The other person did receive it in their inbox,

they received the message.

But wouldn't it be nice if you could go into your own

sent folder and see what you wrote to that person in that,

uh, sharing, uh, in that sharing description box?

Well, with comprehensive mail storage like this one here,

just quickly demonstrate like, it's great, I was able

to go into my scent folder

and find, um, find what I had written.

And the setting is here. It's called

comprehensive Mail Storage.

We recommend go ahead and turn that on.

It means that there'll be a,

a sent item in your inbox

for your users every time they shared.

And so they could go and look back

and see what they had shared.

Alright, um, directory profile editing.

So this is one that's especially important

for us tech directors

because you just never know which

of your students have gone in

and they've put some sort of a funky picture.

They've changed their name in Google,

in their Google profile.

Um, and, and Google is regularly adding

some new fields here.

So for example, they added, uh, pronouns, I believe

sometime in the last six months.

And so those settings, they may not be locked down.

And depending on your culture and,

and your school setting, these are things you might decide.

I want to turn this on for our faculty and staff,

but I'm a little concerned

what our students might do with some of these.

So just go take a look under the hood

and your profile settings

and make sure that that is, um, make sure

that you've got it set the way you want it so

that students can only make the changes

that you want them to make.

Um, custom contact directory, this is another one

of the kind of looking under the

hood tests that you could do.

Um, if you signed up in sign into your Google admin console

as a test student in one of your student ou

and you go to contacts.google.com/directory,

you might be surprised how many different accounts

that users in your domain could see.

You might have created an account 3, 4, 5 years ago,

forgotten all about it.

Um, and your students will know about it.

Um, and I, from, from some

of the larger school districts we've dealt with, uh,

they've had issues with students going,

downloading all the email addresses for that entire, uh, for

that entire school and then sharing those in places.

You know, we, you wouldn't want them to be shared.

So your your contact directory,

we recommend creating a custom directory.

And the cool thing with custom directories

is you could actually, uh, just create a Google group

that includes sort of all your active students, um,

all your teachers, and then that's

what your students will see.

They're not gonna see your super admin account

or any test accounts that you may have created.

So this is another one of those.

Um, in terms of locking down your admin console, you know,

some, some of these aren't a

problem until they're a problem.

And so maybe you've never looked at this

and don't think it's much of a problem until one

of your users says, Hey, what's this account

that people are using or why are they using it?

Um, and the other piece with this is

with Google Admin Console, for most

of us, it's here to stay.

And these are the kinds of settings

that you wanna make sure, like for the next five 10,

you wanna, you want to give the tech director in a future

or yourself in the future, you want to set them up so

that these are things that are already done.

They don't have to kind of deal with the pain

of not having them done.

Alright, this setting here default permission

to view conversations.

Um, for those schools that leverage Google Groups,

they allow their teachers to create Google groups.

Maybe they allow their students to go create Google groups.

The default permission in most

of our Google admin consoles is set

that all organizational users can view permissions.

And so if you allow your teachers to create Google groups,

they may not know, or they may not, um,

or other administrators, they may not spend the time to look

through all the different settings.

And it's better for you to lock those settings down,

make 'em more, uh, restricted than to have them open.

And so we have seen with some, uh, schools that if you go

to groups that google.com as a student,

you can then see all kinds of groups that have been created

because the default permission is set

to all organizational users can view conversations.

So this is another one of those important settings

throughout the years we've seen

and we, we, uh, in our audit, we go through with schools

and look at, you know, what's a, what's a better way

to set this for your particular school resource permissions.

By the way, if I'm going super fast, don't worry,

you're getting too for the price of one.

So that's, uh, that's my whole thing here.

Um, but I just really wanted to provide value

to this community knowing that you're taking time out

of your day and we just want to go through as many

of these settings so that kind

of really get you thinking about them.

Um, and we, of course, we'll be available after the chat

and, uh, you can always reach out to us.

But resource permissions, most

of us use resource calendars.

Either we have room reservations or we've got a van

or whatever it might be.

Um, we recommend making sure that those are set

to hide the details.

If your principal is meeting with one

of the students' parents, um, in the conference room

and, uh, they have a calendar invite, you know,

Johnny's been acting up, you don't want Johnny to be able

to go looking at the resource calendars

and seeing what's booked in those rooms.

And the way that we recommend to do it is go ahead

and set those to be free busy,

but use, uh, the resource calendars.

Permissions should be set by group.

Um, this is one of those, um, that,

that we may not really take the time to,

to remember when we're setting up resource calendars,

but if we get it right, um, it'll,

it'll really go a long way for us in terms

of keeping our admin console secure

and making sure students

can't see things they shouldn't see.

Alright, groups for business.

Um, many of the schools that we work with use Google Groups

for business, and they keep them on

for their students thinking that they have to be on,

in order for the students to be able

to be in a Google group.

And we just recommend if your students are not,

they don't have any classes, like maybe

for the high school level,

you might wanna leverage Google Groups,

but PK through eight,

you're not usually having your students

create any Google groups.

So go ahead and just set, turn off that service

for those grade books.

There's no need, uh, sorry, turn off

that service for those grades.

There's no need for those, uh, that to be on.

And so the best way to test this, log in

as a student tester in one of your ou, go

to groups.google.com and just see what you see

and ask yourself, you know, is this what I want our students

to be able to start searching and looking at?

Okay, so I've done a lot of talking

and now I'm gonna hand it off

to Lisa who's gonna give us some trivia time.

All right, here's for our Google gurus.

So, um, please grab your device so that you can prepare to,

to scan this QR code.

I am going to share my screen.

Can you see my screens?

We cannot. Not Yet. Not yet.

We do hear the music. All right.

Getting you ready for it then?

No, still not sharing.

You want me to share? It's,

it's actually now it's telling me I'll host only Hold it.

Oh, let's make sure you're a co-host.

Looks like you're a co-host.

Maybe I'll, I'll undo that and redo it.

Hang on, let's try that.

How about if I go on to the next section?

Um, because, uh, just to

make sure we have time, so I'm happy to go

through this next section and then we

can come back for the game.

Okay. Alright.

Um, we just did section three, which was about

what our users see.

Let's jump into section four, which is about API and OAuth.

Um, so, uh, API controls,

these are applications that your users,

third party applications that your users want

to give information to.

So often there's the login with Google button,

and that login with Google Button will give users access

to sometimes Google Calendar, Google Drive.

Um, and this is actually a real environment, uh,

with over 4,500 configured apps.

I know most of us at our schools don't have that many.

Um, but what you wanna do is go into your API controls.

You want to view that list, uh, you want

to download that list.

And then you wanna take a look at what are the applications

that users in our domain are accessing?

Look at the names. Are they familiar? Are they verified?

Did Google actually verify them as a approved app?

Do you have a contract with that company?

Um, and then lastly, on the way to the right,

what are the scopes that they have access to?

And scope simply means

what data within your domain do they have access to?

So you might say, Hey, I'm okay with Calendly having access

to users Gmail and also their calendar,

but why do they have access to Google Drive?

We don't want them to have that information.

They don't need that information for that service that

that third party app is providing.

So we recommend, you know, going through, looking at your,

uh, third party apps.

Another area, I don't know how many

of our schools are utilizing this.

When one of your students

or your teachers goes to log into a third party app,

you wanna make sure that, um,

they know why they can't log into that.

It's, it's not an approved app.

And so within Google Admin console,

you could set up a custom user message.

So when they click the login with Google button,

if it gets rejected, uh, they'll get this message saying,

this is not an approved.

And that you could put in your own, you know, name

of your school and where you want, uh, to be emailed so

that you can then kind of approve or disapprove.

So just a, a cool setting.

Um, if, if you're not aware of it.

And then as far as third party access, we recommend,

go ahead and turn it off for your faculty, your staff,

as well as your students.

Um, and really only allow the third party apps that you need

to allow, um, and, and, uh, and,

and have really refined, granular permission around that.

You just, you don't wanna keep it open

because obviously, you know, there could be breaches and,

and your data gets shared.

We also have a one pager on setting up alerts

for app access control.

So if you ever want to just get an email, uh,

if anybody tries to log in with Google

and it doesn't work, um,

you can set it up within your trust rule rules to get,

um, to get an email.

And if you click on this screenshot, it'll take you to

that one pager, uh, walk you through the steps

for setting that up.

Okay, Lisa, are we ready for some games? Now?

It looks like you're on mute.

Can you see my screen? Yeah. There we go. Yay.

All right,

now my present button won't work.

Uh oh,

Come on.

Well, today might not be our day for trivia time.

Okay, No problem.

I'm sure people are just so, uh, afraid of some

of our hard questions that we put in here.

Um, so we'll, uh, we'll pass that for this time.

All right, maybe at the end, let's try it again, okay.

Okay. Sounds good. Started. Okay.

Oh, it works now.

All right, I'm gonna go ahead and jump

into the, oh, there you go.

Okay. If, if we can, um,

Oh, we got people in there.

Look at that. Yes.

Two more people to join.

All right. This is also gonna test your speed.

So the first one, who answers are

the ones who answers first.

You'll get the points,

okay.

All right.

You'll be given 25 seconds to answer the question.

Again, speed matters.

Okay, looks like we've got a plateau. It's 24.

So I'm gonna go ahead

and start, start as, uh, so we can save some time.

So, ready for question one. Here we go.

The creator of Gmail.

Paul Basal Hattie famous tagline to describe Gmail.

Your answers, your responses are below decluttered, outlook,

buttered, better chimes in outlook, simple

like Google, search or search.

Don't start. What's your answer? Five seconds.

4, 3, 2. Everyone has answered.

Ooh, look at that. All right.

Our correct answer, search, don't sort. All right.

Way to go, Dane. All right, next question.

What year was Google Classroom invented?

Remember, speed matters.

No, using Gemini.

That's right.

Okay, here we go. Dang. All right. He's crushing it.

All right, Ryan. Andy, you're not too far behind.

You can still catch up.

Question number three,

later this year, we'll be adding Gemini feature in the admin

console that will advise you on settings in your console.

True or false?

Uh, all right. That is true.

Okay. Dang. Woo. Got the, uh, oh, Andy. Woo.

Only a couple points behind.

Okay, this is gonna be our last question. Here we go.

This is gonna tail the tail.

How many total settings are there in Google admin console?

Everyone has answered, and the answer is over

1000, believe it or not.

Woohoo. Okay. Let's see who's got it.

Oh, dang. Look at that. Andy's taking over.

All right, great job. Woohoo. Thank you.

Appreciate your time. All right.

I am gonna stop sharing and back to you, Steve.

That was awesome.

And Andy, we need, I feel like we need to have a, uh,

overtime, you know, sudden death,

Sudden death. Hey,

definitely.

Yeah, that was awesome. Alright, Fun.

Um, well we've got two more sections

and I got about 20 minutes,

and I want to just speed through this

and, uh, keep it open

so we can chat afterwards if anybody has any questions.

So Google Vault service obviously hosts your most

private and secure data.

Go ahead and turn it off for your students.

It should not be, that service does not need to be on for it

to collect their data and track their data.

So a lot of times people think, oh, I need

to keep Google Vault as a service on, but you do not.

Um, just keep it on for the ou

where people are gonna actually access the data

within Google Vault.

Um, also when it comes to Google Vault,

Google's regularly introducing new tools,

and these new tools, um, have their own retention policy.

So we just recommend going in, taking a look

and sit, making sure that your retention policies all match

and they, they've been set, uh, intentionally.

This is one of those settings that, um, in the middle

of the school year, we have a lot going on

and Google introduces a new tool.

We may forget to go in and,

and make sure that that data is being

tracked for a long time.

Um, okay, shared drives external management.

This is one of those settings

that protects your users from

doing something they don't know.

Um, if, if a, if one school shares their shared drive

with another school and users from your school put data into

their shared drive thinking, you know, well,

where I'm a member of that shared drive,

they actually change ownership when they do that.

Documents change ownership when they get moved from one

organization's shared drive to another shared drive.

So sometimes your users might be uploading a bunch

of math curriculum or English curriculum

because, um, they've been doing some cross training

with another school or collaboration,

and now you lost all that data.

So we just recommend this is a setting, um, by default,

it's set to, anyone can share outside the domain.

Um, you know, as a Google admin console, you know, uh,

you know, within Google that if you go to share a doc

and change ownership of that doc to externally

outside your domain, you can't do it.

However, this is a workaround for that.

So we just recommend going in

and, uh, turning this setting off, uh, groups in chat.

This one might alarm some folks, and so that's good.

It's, it's good to be alarmed about some of this

because at least you're learning about it

and you can make some changes.

So, uh, make sure that this setting is set

to only group owners and managers can add groups to spaces.

The default within Google Admin console is

that anyone in the organization can add groups to spaces.

So when spaces became popular in the last year, we had a lot

of schools that had reached out

because students were adding a full group.

And I know maybe this doesn't happen at your school,

but it's just one of those things

that you don't want someone

to accidentally add a entire group to a Google chat.

Um, and you can actually restrict them from,

from being able to do that.

It makes a ton of sense.

If this was a, uh, it is groups for business,

not groups for schools.

It makes a ton of sense to keep it open, uh,

for your faculty and staff,

but it doesn't make a ton of sense for your students.

Alright, source domain, I don't know how many

of you have ever done this,

but I recommend going into your

student test account into one of your student OU

and just doing source colon domain.

And, um, what you might find is that all

of a sudden people have shared things in your domain

that your parents can go in

and search this and look at this.

This is kind of how we learned about this.

We had some parents reach out saying,

did you know your admissions inquiry results are available

for anyone in your domain to look at?

How does this happen? Um, when you go to share a document,

there's this option that says, can find and search results.

People unknowingly

and mistakenly may have shared documents, um,

with the entire domain.

Sometimes this happens

because they use the template,

maybe somebody else created the doc.

But a quick easy test just to make sure there's nothing, uh,

being shared that you don't want shared.

It's just do the source domain check. Um, target audiences.

This is a paid feature.

We highly recommend target audiences for all

of our schools using, uh, the plus and standard version.

So what target audiences allow you

to do is set up buckets for access.

Most of us at our schools, if somebody goes

to share Google Doc, uh, it's set to general access.

That means students can have access,

teachers can have access, um, if they, if they're,

um, in that, in that group.

And so the, the default target

or general access audience is any account in your domain

that's ever been created.

So with target audiences, you can actually create, um,

adults, students, teachers, and staff.

So what this means is, uh, people have

to be intentional when they go to share

that they know exactly who they're sharing with.

They're not just share Sometimes, um, uh,

I I've seen administrators

or teachers think that they're only sharing

with all the other adults when they pick

that general access group,

but actually they're making that document available

for anyone who's ever had an account in your domain.

And so target audiences, I believe, are going to become more

of a cornerstone with how Google Workspace is managed, um,

where you're gonna need these target audiences

and you're gonna depend on them for all the different apps

to make sure that your access is locked down.

Um, so yeah, we highly recommend creating target audiences,

setting them for Google Drive and different ou.

The other thing I love is you could actually give the target

audiences a little description so people know exactly

who is in that group.

And for spaces, um,

you wanna definitely set up target audiences to make sure

that if somebody has created a new space

and they set that generic access, that means your students,

uh, could click if you have chat turned on

for your students, which some high schools do.

Um, and also for your faculty

and staff, this is something to consider, um,

that they're gonna click on browse spaces

and then they're gonna see all kinds of spaces

that are wide open.

And, and this is a good test for you to go look at your, uh,

console and see what spaces have people created.

What really bugs me about this,

and you can tell Spaces was something

and chat was something

that Google wasn't really thinking about schools, um,

they were thinking more on the business side for,

for businesses, but you can actually click on preview

and join and then you can see

what people have chatted about in those wide open spaces.

And then you could join and see who the users are.

So this is another one of those

that if once you have the awareness about it

or you do some kind of an audit on it, you then know

to change those settings.

Automatic forwarding, you might be surprised how many

of your teachers are set their emails to just forward

to their personal email.

So their school email just gets forwarded

to their personal email.

They have any number of reasons of why they do this.

Go ahead and turn that off.

You don't know what two factor they have set

up on their personal email.

You don't want any, um, emails going to their personal email

that are school related with sensitive data.

So this is a setting that most of us maybe don't touch

or don't think about, and it's often left on,

but go ahead and turn it off.

Um, security Sandbox is another paid feature,

uh, within workspace.

It helps me to sleep better at night for our schools.

Basically, the security sandbox, um, allows, uh,

if an email is sent to your domain

that might contain a malicious attachment, Google will open

that email in their virtual servers to make sure that

that attachment is not malicious.

And if it's not malicious, it'll forward the email through,

and if it is, it'll send it to a quarantine.

So we highly recommend enabling, uh,

the security sandbox in your Google admin console.

Spoofing and authentication, I'm sure many

of you have been phished, uh,

somebody sends an email pretending to be one

of your employees, your head of school, one

of the board members, you know, Hey,

I need to talk to you right away.

A lot of people go to third party companies

for their security within workspace,

but there's actually really amazing, uh,

security within workspace itself.

So these settings here, spoofing

and authentication, for example, protect against spoofing

of an employee names.

Anytime anybody emails someone in your Google tenant

that has the same name as someone, one of your employees

or one of your students, they'll get a red banner saying,

Hey, this doesn't, this person has the same name.

Doesn't look like you normally email

with them from this email address.

You know, make sure. So I, I really love that, uh,

for our schools because it means it's one less way for,

for people to get around our system and,

and do phishing attacks.

All right, um, classroom memberships.

This is just a fun one right now for most, um, most

of our admin console students can unenroll themselves.

We recommend turning this off so

that only teachers can enroll them.

Unenroll a student from a Google Classroom.

Reason why this is valuable,

and I put it under the security section,

is you just don't want to deal with, uh, what happened,

who removed who, and what do the logs say.

If you just block teacher

or students from being able to remove themselves,

it's just one less thing for you

and the future you to have to deal with in terms of

what happened to the grades or this class

or why wasn't this assignment turned in.

Last sections, uh, is about the security center,

the tools and visibility.

Um, so we're just gonna kind of fly through this section.

Um, this is a, one of the paid features,

and what it allows you to do is create a, um, dashboard

and you can actually customize this dashboard with some

of the, uh, possible attacks that your, uh,

school might be having with, you know, users sharing

outside the domain.

If that number skyrockets, you want to know about that.

Um, and you can actually arrange these to be sort of

what it, what's a quick snapshot

that you need on a day-to-day basis about

how the security is doing, um, in your domain.

There's also the security health dashboard.

Um, this is the one

that's gonna put our company out of business.

Um, no, I'm teasing.

We're we're gonna adapt and adjust,

but Google is going to eventually just have

that Gemini helper in there for you

to help you think through these settings.

But, um, and that, and that's great and we,

because our goal is how do we help schools

more be more secure?

And if that helps, then that's great.

Um, but you can also go to your security health dashboard,

which identifies some of these settings

and says you might want to take a look.

The problem is they're not really specified for schools,

but they're not bad to go and look at

and just see what Google is advising on these different

settings in your security health

dashboard investigation tool.

If you're not familiar with it,

we highly recommend getting into it, learning it.

Um, and we also recommend setting up quick access, uh,

searches because when a, uh, phishing attempt happens

and you gotta quickly find out what's going on at your

school, you don't want to have

to think about what's the right, um,

what's the right criteria.

You just, you gotta have your go-tos

and you can actually set up within Google admin console

templated searches where you could just open those templated

searches up, type in what you need to type

and it'll produce for you.

Um, and again, this is one of those paid features

of Google Admin console, the investigation tool,

I think you can't live without the investigation tool.

It allows you to delete emails, it allows you

to change ownership of files, allows you

to do all kinds of stuff.

Um, it, it's really got a lot of different settings.

Sometimes people will use the investigation tool

and say, well, why didn't this one event show up?

Um, well, there's lag times

and we've linked those lag times here in the help center,

so you can actually know like, how long does it take

for someone's IP address to show up in my domain

after they log in?

Does it happen within minutes?

Does it take weeks or a few days?

Um, so if you're ever searching for data

and you feel like something's missing,

you can go check the lag times data loss prevention rules.

We could have done a one hour session just on data

loss prevention rules.

Um, basically if a certain phrase

or a certain word in your domain is used when sharing

a document, um,

Google's data loss preventions will prevent that from going

outside your domain.

Um, there's actually examples that they provide for you,

like social security numbers, internal names, um, and,

and uh, you can, you can have a lot of fun with this and,

and really lock down your admin console.

We do a whole session with folks when they're looking at

data loss prevention to talk through what are the right,

because you don't want false positives.

Um, you really want to, uh, make it granular for your school

context aware access.

This is also a new, um,

feature within the last few years within Google Workspace.

Uh, you could say I only want people in this country

to be able to log into my Google admin console.

Um, we recommend for schools really thinking deeply about,

um, what, what countries are they okay with, excuse me,

logging into their Google admin console.

Um, you can even set up an exception list

and then you could create a Google group

where once you put a student in that Google group,

it'll allow them to go.

So for example,

before a break, um, you might ask your community

to make sure they fill out a form if they're leaving the

country, and you can then make sure

they don't get interrupted.

If they're trying to do schoolwork

while they're on, they're away.

But this is also an amazing tool that is a paid feature

where it allows you to block access

to your Google tenant just based on location.

You could even do it by device

where you only allow users using your device

to get into your Google admin console.

You could even do it at for time.

So if any of you would like to say to your staff, like,

you don't need to work from midnight to 6:00 AM

and you can actually set a context to where policy

that says, you know what, uh, if somebody tries

to log in at this time, they're not gonna be able to,

but don't tell your head of school that.

I'm the one that mentioned that recommendation. Alright, Mr.

Scheider, I'd like to hand it now back over

to you to close us out.

Excellent. Well thanks Steve.

Um, we are glad that you joined us for this webinar.

We're gonna open it up, uh, uh, to make sure everybody, uh,

knows how to get in contact with us.

We are GetSet Tech. We covered a, uh, a lot of things today.

We hope that you're as excited as we are to be able to, um,

explore this stuff with you.

You can email us at google@getsettech.com and

otherwise we want to congratulate you for

walking through this with us.

And thanks for tuning in and listening in.

Um, you should be, we should be all set, man.

There's the fireworks.

We have a bunch of questions.

Uh, so I'm gonna go ahead

and just maybe try to talk through some of those questions.

Steve, if you want, I can pause the recording.

Um, and then you can kind of handle one-on-one questions.

And just as a reminder, everyone is going

to get these slides

and Steve did a wonderful job of linking all

of these references so you'll be able to go directly

to your own, um, dashboard from there.

So, um, for those of you who wanna stick around

for questions, please do.

Otherwise, thank you so much for joining us.

Thank you Steve, Adam, Lisa, for, uh, presenting

and for all your support of the community.