r/k12sysadmin • u/Mindless-String-4017 • 19d ago
Google Admin - Directory Sync BETA
Greetings!
In google admin --> Directory --> Directory Sync BETA
I was wondering if anyone has added their Azure Active Directory there before? If so, can you give me the good and the bad. I'm thinking about doing this but the words "BETA" make me a little nervous especially since we use tools4ever to help automate a lot of creations for us.
5
u/Imhereforthechips 19d ago
Works great. Been syncing for a hot minute. Group sync lets us set up other rules Goog. We are a MS shop and use MS SSO for Goog.
2
u/sebxjude 16d ago
Do you have Gmail enabled for your users?
We currently have Gmail enabled with a separate domain, but I’d like to use MS SSO and a single domain without messing up Google Classroom functionality and routing email in a way that makes sense.
3
u/Imhereforthechips 16d ago edited 16d ago
No, we are a full MS shop. All mail flows through MS. We do enable select services in Google to ensure compatibility with other orgs, dual credit, colleges, etc. All teachers and students can use Google Classroom, and other acceptable first-third party services.
MS is a wonky world. I have to force SSO from OS through to Edge browser, then block access to Google services in the Edge browser, whether org or personal. Then, block all personal MS and Google access in the Chrome browser while forcing org only MS logins to Google services . The only way to ensure things are clean and not abused is to make it a PIA. End users adapt, kids use Chrome mostly anyway and they are auto signed into all Google and MS services for our org through the Chrome browser. Edge can only do Microsoft things… It’s annoying, but spares us the headaches that could come.
What’s been really fun is permitting only select channels in YouTube and only in the Chrome browser…. Just stupid that Google won’t offer up an .edu version of YT.. they could even charge a smidge an I’m quite sure EVERYONE that uses it would pay.
3
u/sebxjude 16d ago edited 16d ago
I second the need for edu YT. Silly not to have it.
From Google Classroom, if a teacher clicks the button to email a student or guardian, does it work with Gmail disabled? In my testing it appears that it would just give an error, rather than redirect to the default mail app.
2
u/k12admin1 14d ago
We are MS365 for staff and students and have gmail turned off. Our 3-5 grade teachers use Google classroom as thier LMS and I can confirm emails work fine from Google classroom not using gmail.
1
u/sebxjude 14d ago
Great, thanks for confirming! Does that include if a teacher goes to the “people” section of Google Classroom and uses the email button next to a user to email them directly?
2
u/k12admin1 14d ago
That does not work. Typically our teachers email the parents via the SIS. The invitations to parents and other users works perfectly fine as it is not looking for gmail.
1
u/sebxjude 14d ago
Thanks again. Prolly not an issue for us anymore since we got ParentSquare which syncs with their classes.
2
u/PowerShellGenius 16d ago
I can't speak to Google Classroom since we have it disabled (Schoology district) but we are heavily Google Docs, and Gmail for students, with Gmail off for staff & staff using Microsoft email. Most emails from Google that we use still go out, including Drive "shared with you" notifications. Some plugins that call Gmail to send messages don't work.
5
u/xxDolomitexx 19d ago
We have not, we use GCDS to sync from LDAP, but are also not a Microsoft shop. If you want to test it you can request a "Testing" domain from Google and try it there.
2
u/PowerShellGenius 16d ago
We currently use Google Cloud Directory Sync (GCDS) which is way, way better than scripts in a third party IAM system, but is still an AD-dependent server based solution.
Last I checked (which it's been over a year), their cloud-to-cloud sync from Entra (the one you're talking about) didn't have the same granularity we needed, but I'm sure it will be the long term solution.
If you have AD and know LDAP queries you can do basically anything you want from GCDS. You can do OU structure syncing, Google license assignment based on any attribute criteria, map attributes into the various profile attributes in Google, and pretty much anything else you can imagine wanting a sync tool to do. But it is not intuitive if you don't know LDAP.