Google Groups visibility for students

[nvijayagopal]

Hi,

we are a school and the students and faculty/staff are in the same domain.

We have set up the faculty Google Groups such that non-members can email the group. They should be able to look it up in the directory or the autofill.

This would mean students would be able to email the group as well and we want to prevent that.

I have looked at the Directory Visibility settings in the admin console but that just restricts students from seeing members of an OU, the Groups are still searchable. 

The other option is to use Content Compliance to reject the message sent by students to a list of groups. This might work but does not sound right.

Any one has a better suggestion? Appreciate your help.

[Stormlord]

We are also a school and are running into this problem.  We have staff groups that other staff outside the group would like to email, but in order to do that, we have to check "Entire Organization can Post".  That allows students to post to the staff groups.  For example, we have a custodial group.  Faculty would like to post to the custodial group, but they are not a part of that group and cannot post, unless the setting is Entire Org can Post.  We thought we had a solution, and created a group that all students are in called Banned.  Then we tried to put the Banned group in the banned section of the staff groups, so that we could turn on Entire Org can Post, but sadly, it does not work. Apparently, you can not ban by group, only individual.  Did you ever find a workaround?

[icrew]

A couple of thoughts here:

1) You might try just leaving those groups open for the entire domain to send to and see if it actually becomes a problem. Especially if you set the group so that it's only visible in the directory to members, odds are good no one else will find it. (See https://support.google.com/a/users/answer/167427?hl=en)

2) I wrote up the document at https://docs.google.com/document/d/1DfTbCOml3mv2CM4NoaKUyBr3tx8P8tHxPv6nhssYxYU/edit# for our campus here at UC Berkeley several years ago. It's a bit outdated, but it might give some ideas. Note that "CalGroups" in that document refers to our internal instance of the InCommon Grouper enterprise group management tool, which likely doesn't apply for you, but the rest of the document may be of some use, maybe.

Hope that helps, at least a little,

Ian

[Stormlord]

We have been struggling with nested Google Groups for some time now.  I like the idea of an Allowed Senders Group... that may help.

Last year, students began sending inappropriate emails to the staff groups, so we locked them out by unchecking the Entire Organization can Post, but then staff outside of those groups couldn't post either.  We added those staff to the groups so they could post, but then they complained about getting emails that didn't pertain to them.  We've tried a few other tricks, but none of them seemed to work very well.  Thanks for the suggestions.

[icrew]

You can add staff to those other groups (or sub-groups of those groups), and then set them to "no email" so they don't get the emails they were complaining about...

[Stormlord]

I am unsure how to make that work ... How do you set them to no email?  I could change them to be Managers, I suppose... then check that Managers can't view?

[icrew]

When you're looking at the members list of any group, you can set whether each person (or each sub-group) receives email from that group via the "Subscription" column:

[Stormlord]

OH!  I see ... it's in groups.google.com .... I was looking in the Admin panel under groups.  Yes ... that will be helpful.  It will make a little more work in adding members to groups on the front end, but should be worth it.

Looking at the document you supplied, I am confused a little.  First, it says that sub1 and sub2 are members of the parent.  But then it says if sub1 posts to parent, only parent and sub1 get the message, and not sub2.  But if sub2 is treated as a member of the parent, and sub1 posts to the parent, shouldn't all children of the parent get the message?  If sub2 does not get the message that was sent to the parent, then it appears that sub2 is not being treated as a member of the parent, which is opposite of treating all subs as members of the parent, that was stated in the first part.... 

I think I may be running into this issue as well.  We have a nested group, called All-School-Staff.  All-School-Staff has just 3 individual members, and then 2 sub groups of HS-Staff, and Elem-Staff.  HS-Staff has several individual members, and sub groups of HS-Custodial, HS-Licensed-Teachers, and HS-Food-Service.  Elem-Staff, has the same groups for it's school (Elem-Custodial, Elem-Licensed-Teachers, Elem-Food-Service).

So ... is this saying that if an individual belonging to Elem-Licensed-Teachers posts to the All-School-Staff group, that only the 3 individual direct members of All-School-Staff, and ONLY Elem-Licensed-Teachers will get that email?  Not all the other sub groups of All-School-Staff?  I don't see the point of having a nested group at all, if that is the way it works.  If, for example, a member of the Elem-Food-Service group posts to All-School-Staff, I would be expecting "all school staff", in their entirety, to get the email.  That would be the point of posting to that group, yes?  Sorry so long.  Trying to wrap my head around this.

[icrew]

Yes, you're getting it correct. It is confusing and not necessarily what you'd/we'd all want. 

Maybe it'd help to restate it this way:

For groups set to "only members can send to this group", they only look at their own membership (look down the hierarchy) when making a determination about whether or not to allow a message from a given user to go through to that group.

They don't look up the hierarchy to see what other groups they're a part of (and who's a member of those groups) when making that determination.

This limitation is the reason for the "Option 3: Create an “Allowed Senders” group and add it to all groups" section of my document.

Does that help?

Cheers,

Ian

[Stormlord]

Yes, indeed.  The Allowed Senders group is the option we are going to implement.  The part that is inconvenient is that we will have to adjust all groups.  The hierarchy we set up was meant to make things easy.  Groups within Groups within Groups, so that one group email to the parent could essentially send to all employees of the school.  But that does not work, depending on the group the individual sending belongs to.  When a new teacher is hired, the object was to add them to the building faculty group and be done, letting the nesting take care of all the other groups they should be in.  But with how it actually works, I'll have to add the teacher to 8 different groups, setting up preferences in each group, about whether they get email from that particular group or not. 

I'm hoping in the future they implement my idea of allowing you to ban a group from posting, rather than just an individual.  I could set up all the groups, allow posting from the entire organization to every group, but place a banned group, that contains all students, in each of the staff groups.  Then everyone, except students, can post to all staff groups.

[icrew]

You might want to post that idea to the Feature Ideas section here. Doing so will allow it to be upvoted by others and possibly considered as a future feature enhancement.

If you do not already have access, you need to request it first. See https://www.googlecloudcommunity.com/gc/custom/page/page-id/Workspace-Feature-Ideas-FAQ for how to do that.

Once you have access, go to https://www.googlecloudcommunity.com/gc/Feature-Ideas/gh-p/workspace-ideas-group . There, you can upvote and comment on any similar idea, or post a new idea.

If you are submitting a feature idea, be sure to explain the problem that you're trying to solve with the feature idea, not just the idea itself. For example, saying "when my users are trying to do 'A', they often get confused by the fact that the buttons to do 'X' and to do 'Y' look quite similar to each other, which leads to this unintended consequence" is far more likely to get fixed than a feature idea that just says "change the color of the button 'Y'".

Cheers,

Ian

[Stormlord]

Yep ... I did submit the idea.  Did I explain it well enough?

It is here:

https://www.googlecloudcommunity.com/gc/Feature-Ideas/Allow-groups-to-ban-groups/idi-p/444715