How do students take their files with them when they graduate?

OneDrive.com Graduation

What Is Included?

• Sync your school-provided OneDrive to your computer - This gives you a connection to your school-provided OneDrive on your local computer.
• Create a new personal OneDrive account if you don't already have one - This will become the new location for all of your files once you've finished moving them from your school-provided OneDrive.
• Sync your personal OneDrive to your computer - This gives you a connection to what will become the new home for your files on your local computer.
• Move your OneDrive files - Move your files from your school-provided OneDrive account to your new, personal OneDrive account. You can do this using File Explorer or Mac Finder. All files you place in your synced OneDrive folder automatically upload to the cloud whenever you're online.

• Move a OneNote notebook to OneDrive - You’ll need to use different steps to move your OneNote notebooks.

What Is Missing?

My Point of View:

"how should I set up my Microsoft Teams? Should it be one big Team for ALL staff? Separate Teams for each Faculty? What about Channels?"

Best practices for school leaders creating teams and channels in Microsoft Teams for Education

This is pretty extensive resource that covers off a range of different scenarios where Teams could be used, and is part of the wider Education Support pages for Microsoft Teams. One question I routinely get asked that is most popular in larger High Schools, is how to set up a Faculty/Department. This is the recommendation from the guide:

Channels & Files Tabs

Within your district or school, it’s possible to create teams that follow an organizational structure. Use this approach if you have strict reporting requirements, are managing a large district with high staff numbers, or have goals to increase transparency across a diverse set of schools and employees. Here’s how that might look, with teams “reporting” up the chain to other teams. This ensures school leaders, staff, and teachers are members in the teams that are relevant to them.

• Science Faculty (Team)
  • General (Channel)
    • Conversations Tab (inter-department conversation, reduce email etc)
    • OneNote Tab (Store Departmental Meeting notes etc)
  • Physics (Channel)
    • Yr12 Content (Files Tab Folder)
      • Individual Unit To Teach (Files Tab sub-Folder)
      • Individual Unit To Teach (Files Tab sub-Folder)
      • etc etc
    • Yr11 Content (Files Tab Folder)
      • Individual Unit To Teach (Files Tab sub-Folder
      • Individual Unit To Teach (Files Tab sub-Folder)
      • etc etc
  • Chemistry (Channel)
  • Biology (Channel)
  • Junior Science (Channel)

Announcement of AzureVM For Minecraft:Education Edition

IT administrators and educators have been asking for a better multiplayer experience, including workarounds for device limitations and classroom management. Our team has taken this feedback and worked with Azure to develop a Minecraft VM solution. The Azure VM will host the multiplayer world, instead of the student or teacher. So, if a teacher wants to setup a multiplayer world, they no longer need to host the world on their device or rely on a student to host. When a multiplayer world is hosted on Azure, students simply connect via an IP address, accessing their world when they need to.

My Point of View:

• Many schools segment network traffic using VLANs and blocking peer-to-peer connectivity across the wireless network. This increases the difficulty of getting multiplayer Minecraft:EE working easily.
  • Hosting the worlds in an AzureVM removes this security issue as all players (teachers and students) exit the LAN and access the hosted world on the internet.
• Until now, students needed to be on the same LAN to be able to play multi-player meaning continuing to collaborate in a hosted world for homework was virtually impossible.
  • With this announcement, students can continue working together on a project in Minecraft:EE because they can access the hosted world via the AzureVM from home.

A federated identity in information technology is the means of linking a person’s electronic identity and attributes, stored across multiple distinct identity management systems. Federated identity is related to single sign-on (SSO), in which a user’s single authentication ticket, or token, is trusted across multiple IT systems or even organizations. SSO is a subset of federated identity management, as it relates only to authentication and is understood on the level of technical interoperability and it would not be possible without some sort of federation

What does this actually mean?

Image credit.

You use federated authentication to link Apple School Manager to your instance of Microsoft Azure Active Directory (AD). As a result, your users can leverage their Microsoft Azure AD user names and passwords as Managed Apple IDs. They can then use their Microsoft Azure AD credentials to sign in to their assigned iPad or Mac and even iCloud on the web. Students can also use it to sign in on Shared iPad.

What Is Required To Federate?

1. Start the federated authentication process.
2. Connect to your identity provider by linking Apple School Manager to Microsoft Azure AD.
3. Verify your Azure AD domain ownership.
4. Turn on and test federated authentication.

My Thoughts:

Overview:

As this blog post will be a little longer (and more technical) I’m going to give you a break down of what is to come so you can skip to the important sections relevant to you:

• Part One (read this blog post here):
  • Identity – why use a cloud identity?
  • Why use AutoPilot?
  • Configuring Autopilot
  • Enrolling your device
• Part Two:
  • Intune vs Intune for Education
  • What are CSP?
  • Building a custom CSP Policy
  • Using LOB App Deployment in Intune

Now it’s worth stating at this stage that I am not an IT administrator by profession. Whilst I’m probably more technical than many, I’ve got the following working through a combination of relying on the detailed guides in the Microsoft Docs and awesome technical colleagues who have shared some of their expertise with me. Additionally, like you, I read a bunch of blogs to see how people have done this in the past. This blog is a small contribution to the community who like to learn from other’s experiences. If you’re reading this and are more technical than me and see some improvements or corrections in what I’ve done – I’d love to hear from you in the comments section below. With that said, let’s get started!

Intune vs Intune for Education

Intune as a standalone Mobile Device Management (MDM) tool has been around for a long time, however Intune for Education was only launched in 2017. A key point to clarify is that both versions use the same backend system to manage the configurations – Intune for Education is really just a simplified interface for educators to leverage. If you make a change in Intune for Education, it’s reflected in the equivalent settings inside of Intune (and vice versa). I’ve written a more detailed blog about when to decide which version to use that you can read here however I commonly ask the following questions in helping schools decide which version to use:

1. Are you only going to be managing Windows10 Devices?
   1. Yes? Use Intune for Education
   2. No? Use full Intune for multi-OS management
2. Will teachers and other less technical people be wanting to manage settings and push applications?
   1. Yes? Use Intune for Education if possible (see above re: Win10) as the interface is simplified and very easy for non-technical people to use.
   2. No? Use either, if you’re more comfortable with a large amount of settings and configuration options then the full version of Intune will be more valuable.
3. Do you have advanced configuration settings and policies you want to configure on the devices you’re managing (i.e. replicating Group Policy).
   1. Yes? Use the full version of Intune standalone as this has significantly more settings and options
   2. No? Use Intune for Education if dealing only with Windows 10.

Remember, the important thing to get this working is to use AzureAD as your underlying identity management. You can get a lot of assistance from the Microsoft Education Documentation and Resources link. It is worth pointing out that since Intune for Education was first released, new features have been added to it, including the ability to manage iPads in late 2018– really helpful for schools that are wanting to develop a “single pane of glass” for configuring and deploying all their educational devices.

What Are CSP?

CSP stands for Configuration Service Providers and the best place to get started if you have no knowledge of this is here – CSP For Beginners.

A CSP is an interface in the client operating system between configuration settings specified in a provisioning document and configuration settings on the device. Their function is similar to that of Group Policy client-side extensions in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files or permissions. Some of these settings are configurable and some are read-only.

The reference to Group Policy client-side extensions above is important and useful because most IT Admins are familiar with these, and when you explain that CSP achieve the same outcome but are managed out of the cloud from an MDM like Intune, they generally get the concept quite quickly. In essence, a CSP allows you to restrict/allow various functionality on an end device – in this case we will primarily be talking about Windows 10 – such as allowing the Edge web browser to make search recommendations. Some of these settings are enabled via the GUI inside of Intune, others need to be manually created with a Custom CSP Policy (read on below for an example). To return to the Edge search setting example, in Intune the policy to allow search suggestions in the Microsoft Edge address bar uses Browser/AllowSearchSuggestionsinAddressBar in the Policy CSP

The GUI inside of Intune on the left simply configures the CSP on the right to either 0 (not allowed) or 1 (allowed)

Once you understand the concept of what you can do with CSP and are ready to get your training wheels off, reading the full list of Policy CSP available here is a great starting point. In fact, because not all CSP are currently available in Intune’s GUI, you may find some advanced features that can only be deployed using the Custom CSP Policy (again, read on for a good example of this).

It’s worth noting that the full version of Intune has many capabilities to manage iOS devices, often requiring a custom Profile to be created and pushed to the iPad. I’ve written a five part blog series showing how you can do this on iPads that is worth reading here.

Building A Custom CSP Policy

I got tipped off by a friend who is far more technical than me to two CSP that exist in the Authentication section and are designed to speed up the initial login of Windows 10 devices in a shared environment like a school: These are:

• Enable Fast First Sign In
  • This policy is intended for use on Shared PCs to enable a quick first sign-in experience for a user. It works by automatically connecting new non-admin Azure Active Directory (Azure AD) accounts to the pre-configured candidate local accounts.
  • OMA-URI = Authentication/EnableFastFirstSignIn
• Preferred AzureAD Tenant Domain Name
  • Specifies the preferred domain among available domains in the Azure AD tenant.

    Example: If your organization is using the “@contoso.com” tenant domain name, the policy value should be “contoso.com”. For the user “abby@constoso.com”, she would then be able to sign in using “abby” in the username field instead of “abby@contoso.com”.

  • OMA-URI = Authentication/PreferredAadTenantDomainName

Available in the Settings Blade, an IT admin can rapidly add this setting to Win10 devices now.

• Sign into the Intune Portal
• Go to the Device Configuration Blade

• Click on Profiles

• Click “Create Profile“

Note in the main display you can see existing Profiles I’ve created already, including my example “Fast Signin and UPN Default”

• The “Name” and “Description” Fields are entirely up to you, however make sure you choose “Windows 10 and later” for the Platform and, critically, you choose “Custom” for the “Profile Type”. On the left below is my configured policy, on the right is the options when creating a new one

• Once you have a Profile created, you need to add settings to it so click “Add” – this is where you need the documentation to guide you for the correct CSP e.g. for Authentication CSP

• Again, the “Name” and “Description” fields are largely up to you, but the critical fields are the “OMA-URI” and “Data Type” and “Value” fields are all going to be informed from the CSP documentation

In this example the Data Type is a string, as I’m putting in my O365 tenant’s domain name. The full OMA-URI in this example is: ./Vendor/MSFT/Policy/Config/Authentication/PreferredAadTenantDomainName

In this example the Data Type is an Integer with “1” = on and “0” = off. The full OMA-URI in this example is: ./Vendor/MSFT/Policy/Config/Authentication/EnableFastFirstSignIn

• With your custom CSP Policy created, you now need to assign this to devices under the “Assignments” Setting – in my example I’m applying it to All Devices:

1. Fast First Sign In – does exactly what it’s name suggests, reducing the time considerably for a student to sign into a Windows 10 device for the first time
2. Preferred AzureAD Tenant Domain Name – given many younger students are not great at typing, or remembering relatively complicated text like a school domain name, allowing them to simply type their username e.g. “sam.mcneill” or even “samm” (based on school username policy) reduces the complexity of the sign in process.
   1. If you’re after a creative way to help younger students remember ‘complex passwords’ then have a look at my blog post on this.

Using LOB App Deployment in Intune

Using Intune to push Minecraft:EE as an LOB app, rather than a Store app, makes it instantly available to a student when they log into a shared device for the very first time. This means no waiting for apps to appear and no lost teaching time.

• Overview Line of Business App documentation here.
• Go to the Education Store and find Minecraft:EE under the “Products and Services” that are managed, then select to “Download for offline usage” – this will effectively allow you to download a .appx file:

• Scroll down a little further and download the “Required Frameworks” file as well, as you’re going to need this in Intune shortly:

• With the two files downloaded, you need to return to Intune and click on “Client Apps” and then “Apps”

• You need to click “Add” to start building a new app – see below in my screenshot you can observe the different types of apps that I have available to deploy, and I’ve circled the Minecraft:EE Universal App (.appx) as a Line of Business app, as well as Chrome Browser as a .msi Line of Business App, compared to the standard Microsoft Store apps.

• Make sure you choose a Line of Business App:

• Upload the .aopx version of Minecraft and the dependency framework file you downloaded:

• Configure the app information as it will appear to your users once installed on their device:

• With this done, you can now assign the app for deployment based on your groups of devices – it will automatically install the first time and be instantly available for any user as soon as they sign into the device the first time.

Final Thoughts

• Part One:
  • Identity – why use a cloud identity?
  • Why use AutoPilot?
  • Configuring Autopilot
  • Enrolling your device
• Part Two:
  • Intune vs Intune for Education
  • What are CSP?
  • Building a custom CSP Policy
  • Using LOB App Deployment in Intune

Identity – why use a cloud identity?

1. The user may sign into an “on-premise” identity platform (on the left), in this case Active Directory (still incredibly common in schools) which, through the use of a tool called AzureAD Connect can automatically sign into a cloud identity as well, in this case Azure Active Directory (AzureAD or even AAD).
2. Alternatively, the user may sign directly into a cloud service (on the right) using their AzureAD credentials. In fact, if their device is managed by the school, it may even be joined to AzureAD only.

The key point is: identity matters. If your school does not have a cloud identity of some sort, you’re going to be inherently limited in what you can do.

• Creating Single Sign On (SSO) from AzureAD into Google Suite
• If your users only exist inside the Google Suite and you’re wanting to leverage Office365 / Minecraft:EE then completing a simpler “Similiar Sign On” may be worth exploring – the blog post for this is here.

Azure Active Directory Premium P1. In addition to the Free and Basic features, P1 also lets your hybrid users access both on-premises and cloud resources. It also supports advanced administration, such as dynamic groups, self-service group management, Microsoft Identity Manager (an on-premises identity and access management suite) and cloud write-back capabilities, which allow self-service password reset for your on-premises users.

Why use AutoPilot?

Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, re-purpose and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that’s easy and simple.

Windows Autopilot is designed to simplify all parts of the life cycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users.

• Devices become enrolled / locked to your organisation. If a user (authorised or not) resets the Win10 OS back to factory settings, as soon as it connects to the internet again it will register back to your organisation, making it largely useless to anyone if it was stolen.
• Speeds up and simplifies the Win10 setup process – you can optionally skip quite a few of the steps you normally need to undertake in Win10 e.g. requiring the user to agree to the EULA, choosing their privacy settings, configure whether the user will be an Administrator or a Standard user, and depending on deployment mode, can even skip keyboard preferences.
• Devices can be assigned to specific users, meaning when they turn it on for the first time, connect to the internet they’re greeted by name as part of their organisation.
• AutoPilot Reset allows an IT Admin to remotely reset the device, returning it to the original state, but keeping it joined to AzureAD and enrolled into Intune for management – think of this like a “spring clean” at the beginning of the school year or new Term.

Configuring Autopilot

md c:\\HWID Set-Location c:\\HWID Set-ExecutionPolicy Unrestricted Install-Script -Name Get-WindowsAutoPilotInfo Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv

Basic PowerShell commands will allow you to extract the unique Hardware Identifier (HWID) for your existing device – this is required for AutoPilot to run

1. Add your devices (HWID) into Intune
2. Create an AutoPilot Device Group (tells Intune which devices in your organisation should be managed by AutoPilot). Note you can do both static and dynamic rules for adding devices here.
3. Create an AutoPilot Deployment Profile – this is the configuration settings you want to choose and allows you to skip a number of the standard Win10 decisions that need to be made when a device is being set up for the first time.
4. Assign an AutoPilot Deployment Profile to a Device Group – this matches what you’ve created in Step 2 with Step 3
5. Assign a user to a specific AutoPilot Device – this optional step allows you to match a user in your organisation with a specific device. The net result of this is the first time the user turns on the computer and connects it to the internet their name and email address is pre-populated in the setup process, meaning they only need to confirm their password during the setup – very cool!

Enrolling Your Device

A user must always choose their region

Keyboard preference remains a requirement

At this point, once the device is connected to the internet it will automatically join AzureAD and enroll into Intune because the HWID is registered with your tenant. Further Win10 setup steps can be optionally skipped at this point based on the Autopilot Profile configuration.

The device immediately starts to configure based on AutoPilot Deployment Profile you’ve created and assigned to the Device Group

This screenshot shows AutoPilot busily configuring the device and giving progress updates – the time this takes varies based on how many apps you’ve chosen to push to the device.

Done! Note the following: 1) School logo is displayed 2) User is greeted by name if the device is specifically assigned to a user 3) The school/organisation name is displayed; 4) The user’s email address is displayed 5) A customisable welcome message is displayed with contact details for assistance.

1. Choose their country
2. Choose their keyboard
3. Connect to the internet (this could even be their home WiFi)
4. Enter their organisation password (Office365)

My Thoughts

What is Flipped Learning?

In a flipped learning setting, teachers make lessons available to students to be accessed whenever and wherever it is convenient for the student, at home, in class, on the bus, or even from a hospital bed. Teachers can deliver this instruction by recording and narrating screencasts of work they do on their computers, creating videos of themselves teaching, or curating video lessons from trusted Internet sites.

Why Use Microsoft Teams "Meet Now" Feature For Flipped Learning?

1. Screen Sharing Feature
2. Recording Feature

Example of a Screencast recorded in Microsoft Teams

• Relief Lessons: if I knew I was going to be away from school for a period of time (e.g. on a sports tournament or taking a camp) then recording some content for my classes is a quick and easy way to ensure they will continue to progress their learning in my absence
• Introducing Major Assessment Tasks: one of the keys to ensure students succeed in assessment is helping them understand what is required of them from the task and how they can adapt it for personalised learning (where applicable). This is often a lengthy and time consuming process and may need to be repeated for students who were absent. Recording this once in Teams is a great way to ensure a high quality explanation that all students can access at any time (and go back and re-watch if they're getting stuck).
• Scholarship Classes: This came up in a discussion with some students recently where they were discussing how they can get access to scholarship level classes when there were clashes with their timetables. I see this working in two ways:
  • The teacher leading Scholarship may in fact record a series of key ideas / learning concepts using Meet Now / Recording in Teams and start to build out a bank of "lessons" or "key concepts" that students can tap into and watch at any time. Over a number of years, this would start to create a truly valuable resource.
  • Often Scholarship Classes are run before/after the school's timetabled lessons, meaning there are clashes and students can not always be present. If the teacher recorded the lessons using Teams (and possibly a wireless mic/headset) then all content would be available for students even if they were absent.
• Extension Activities / Difficult Concepts: Teams would also be a great platform for recording more complex and difficult concepts that take time to explain clearly or in different ways. This would allow the teacher to introduce students to them in a Flipped Way, allowing for 'watch on demand' as needed.

• If the school is already using Office365 then Students are ideally already in Teams (consider using School Data Sync to automatically populate students into classes)
• Teams has the built in Recording Features and Screensharing to enable quick and easy Screencasting on any platform (Windows 10, MacOS, iOS)
• Recordings are automatically published to Microsoft Stream for secure viewing either inside of the Team itself, or on the Stream platform inside of Office 365.
  • It's worth noting that Stream automatically transcribes your speech inside of your video, allowing everything you say to be searched. This can be especially helpful if you're a teacher that has certain key words such as "In the end of year exam....." which students could search across your videos for!

Tips For A Successful Flipped Learning Recording In Microsoft Teams:

• Using a wireless headset or mic as your audio input, rather than the built in mic on your computer. This will make your voice clearer, as well as reducing ambient noise (and clicking from your keyboard, often positioned very near a built in mic!)
• Have a touch / digital ink enabled device like my Microsoft Surface - this really unlocks the power of a Flipped Lesson, by allowing you to ink / annotate as if you were writing on a whiteboard in your classroom.
  • Consider also applications that support inking effectively e.g. Microsoft Whiteboard, Microsoft OneNote, and don't forget inking is fully supported in Office365 Apps like Word and PowerPoint which can present great canvases for inking.

• When ready to record in Teams, follow this sequence:
  • Launch the Meet Now meeting inside of the correct Channel inside your Teams App
  • Blur your background if you want additional privacy
  • Share your screen - remember, you can share your entire desktop (recommended if you're going to be switching between multiple apps), or a single application such as a web browser, or Word, OneNote etc.
  • Start Recording when ready (if you have others on the call, do make sure you advise them the session is being recorded)
  • When you're finished, either simply hang up the call to end it, or stop the recording in the same way you started it.
• Post-Recording the Flipped Learning lesson will automatically be uploaded to Stream and embedded into the Channel inside of Teams that you recorded it in:
  • Expert Tip: Inside of Teams you can create a dedicated tab along the top just for Stream and the Videos you're recording - learn how here.

Final Thoughts:

DOWNLOAD:

Hidden Chinese Character Minecraft Mission - NZ Chinese Classroom

The Code Executing In Minecraft: Education Edition

My Thoughts:

1. Recreating the Chinese Tang Dynasty capital city - this is especially interesting as the lesson plan and outline is designed to support multi-class engagement.
2. Exploring systems of measurement used by the Chinese - a great numeracy activity that includes some historical angles as well.