Hello Reader,

The fall Google Admin Bootcamp starts TODAY (Oct. 6) at 1pm EST. There are still a few spots left. You can register here.

Over the years—and through dozens of district audits—I’ve found that domain health usually boils down to five core pillars. When these five areas are configured properly, your life will be a LOT easier!

1. Organizational Units (OUs)

• Avoid "Special" OUs: Don't create separate OUs for temporary exceptions (like "YouTube Allowed" or "No 2FA"). Use Security Groups to handle policy exceptions instead.
• Leverage Inheritance: Keep your OU tree lean. Set domain-wide student policies at the root student level and let sub-OUs inherit settings.
• Archive OU: Make sure you have a place to move suspended users and inactive devices. Don't mix inactive and active accounts!

2. Third-Party App & API Controls

A district-issued Google account is an official educational credential, not a personal login. Leaving "Sign in with Google" wide open allows staff and students to connect school accounts to unvetted web games, social apps, and consumer AI tools—introducing serious data privacy (COPPA/FERPA) and account security risks.

• Block Unconfigured Apps (U18): In Security > API Controls, block unconfigured third-party apps for users under 18.
• Enable App Access Requests: Turn on the built-in request workflow so teachers and students can request access when they hit a blocked tool, giving you a structured vetting process.

3. Email Security

Phishing attacks targeting schools are more aggressive and sophisticated than ever. Relying on default settings leaves your doors unlocked.

• Authenticate Outbound Mail: Ensure your SPF, DKIM, and DMARC records are strictly configured to prevent domain spoofing.
• Limit Student Exposure: Restrict elementary and middle school OUs to internal senders only, enable enhanced pre-delivery message scanning, and block external Google Form submissions for students.

Upcoming Events for Google Admins

Want to host a Google Admin workshop in your area? Get in touch!

• ​Google Admin Bootcamp (Online) - October 6-20, 2026
• ​MassCUE Conference (Foxborough, MA) - Oct. 14, 2026
• ​Chromebook Academy (Online) - Nov. 5 - 19, 2026 (join wait list)
• ​HECC Conference (Indianapolis, IN) - Nov. 11-13, 2026
• ​Brainstorm Poconos (Pocono Manor, PA) - Nov. 15-17, 2026

4. The Investigation Tool

When a critical file goes missing, an account gets flagged for suspicious activity, or an email bounces, you shouldn't have to guess what happened.

• Located under Security > Security Center > Investigation Tool, this utility gives you access to 30+ data sources, including Drive log events, Gmail logs, and login activity.
• Use Gemini to evaluate complex activity logs to get a picture of what happened and how to fix it.

5. Generative AI Governance

AI management has rapidly become a core responsibility for K-12 IT leaders. Admins need clear domain guardrails in place.

• Data Privacy First: Ensure staff and students access Gemini through their managed Google Workspace account so data is protected under Google's core education agreement (no public model training).
• Differentiate by OU: Keep generative tools disabled for younger students, enable age-appropriate access for older students, and give staff full access to productivity tools in Docs, Classroom, and Gmail.
• Conversation Retention: Review your conversation history settings to ensure chats are retained and searchable through Google Vault for compliance.

Master These 5 Pillars With Me (Bootcamp Starts Today at 1pm EST!)

We will discuss all five of these essential areas during the Google Admin Bootcamp. The fall cohort kicks off today, Oct. 6, at 1:00 PM EST (10:00 AM PST)! There are a few spots left. You can register here.