Google Workspace for schools and academies

The controls appropriate to a member of staff and to a year-eight student have almost nothing in common. Separate org unit trees let you apply external sharing restrictions, application allowlists, chat availability and drive controls independently, and they make year-group-level policy possible.

Where schools get into trouble is a flat structure with exceptions bolted on. Every exception is a thing somebody has to remember, and staff turnover means it will eventually be forgotten. Structure is more durable than memory.

Workspace can surface alerts on concerning activity, but alerts sent to an unmonitored admin mailbox are worse than no alerts, because they create a record that something was flagged and nobody looked. Routing matters as much as configuration.

Alerts should reach a named designated safeguarding lead with a documented response path and a deputy for absence. That routing needs testing at least once a term, in the same spirit as a fire drill, because the failure mode is silent.

Rollover has four parts: promoting continuing students between year-group units, handling leavers, creating incoming accounts, and reconciling staff changes. It is entirely predictable and yet routinely done in a rush in the last week of August.

The leaver decision should be made in March. Options are export coursework to a personal account, retain the account in an archive unit for a defined period, or suspend and delete after retention. Whichever the school chooses, deciding it in March means August is execution rather than judgement.

Teachers adopt tools quickly, which is good pedagogically and hazardous administratively. Every application authorised with OAuth against student accounts holds whatever scopes it requested, and in an open marketplace configuration nobody is reviewing what those scopes are.

An allowlist with a lightweight approval route is the workable compromise: teachers can request, a named person reviews the scopes, and the answer arrives within a few days. Blanket blocking produces workarounds; blanket permission produces exposure.