Administration in the Clouds

Access to cloud resources is an opportunity for cost savings, but the administration of thousands of e-mail accounts, managing varied levels of accessibility, and doing that for multiple cloud products can make savings disappear. What's a system administrator to do?

• By Margo Pierce
• 12/02/11

Tracking students in a specific school building, district, or even state is easier in the electronic age than it was in the days when real paperwork was involved--but it's still not perfect. Unfortunately, there are new twists for the IT administrators charged with managing the essential infrastructure, things like accuracy and cost. Factor in accessibility to cloud resources, which includes the need for maintaining accessibility privileges for thousands of people--students, teachers, administrators, maybe even parents--and the potential for problems can reach nightmarish proportions.

Justin Schaef, director of data management and technology at Washingtonville Central School District in New York, however, sleeps just fine. He found an automated method for creating, changing, and deleting student accounts for accessing school-administered Google Docs and Microsoft Live@edu programs that meets his needs.

"One thing people like me worry about is administration of users and user accounts. It's a very time-consuming process," Schaef said. "When there's a new account, you have to manually go in and add that student."

Typically, those that need to be deleted must also be done by hand. So, the ability to automate such a labor-intensive process frees up IT staff for more important work and eliminates a task for clerical staff, according to Schaef.

He uses CloudConnect, a technology that automates the connection between a school's student information system (SIS) and the various hosted cloud resources. While there are other cloud-related options for this administrative task, products such as EasyConnect and OneLogin, CloudConnect offers real-time synchronization. It is also compatible with Microsoft 365, which will be available as an upgrade to schools starting next year.

Once a school establishes the level of access, or permission, any particular user will have for each feature of a set of cloud applications, those permissions are assigned to that group in the SIS. Teachers, for instance, might have full access to all features and functions, while student access would be more limited. When a new user is added to the system and assigned to a particular group, the individual user account will automatically be provisioned correctly.

"If a brand new kid registers tomorrow in our school district, the moment they are registered…it creates them in the same pattern and way that matches the Active Directory," Schaef said.

There are a few requirements to add the CloudConnect plug-in, created by developer Pearson, to an existing computer system:

• SIF zone installed along with the student information system (SIF, systems interoperability framework, is an industry initiative that enables diverse applications to interact and share data.)
• Active Directory (a directory service created for Windows domain networks)
• SIFWorks Directory Manager Agent (another Pearson product)

For schools that don't have the IT infrastructure to support internal management, Pearson offers a hosted solution that only requires a SIF-enabled student information system. According to Pearson officials, more than 25 school districts with about 100,000 users utilize CloudConnect via the plug-in--and some of those system configurations are a bit tricky.

When an IT administrator sets up an account with Google and registers a domain, he or she can also set up at least two separate sub-domains that allows him or her to control which features would be available to students and which to teachers. This is what Washingtonville did. "For example, we didn't want to give students full Gmail accounts," Schaef said. "At the same time, we wanted the student to be able to e-mail the teacher from within Google."

Among the controls in the Google Apps set is one that allows students to use Gmail to communicate with students, but not non-teachers or other students. "They can't send e-mail to the outside," Schaef said.

A student only needs to remember one password, and data entry is only necessary once. If it becomes necessary to change a password or delete students' information, these and other changes are automatically applied to all accounts (for instance, both Google Docs and Microsoft Live@edu) when they are changed in the SIS.

Schaef said his district chose to standardize student accounts on Google Docs because it was the easiest transition: Students were already familiar with the platform. But some teachers prefer to use the full-feature versions of Microsoft Excel and Word in their classes. Compatibility isn't a problem for accessibility, according to Teri Richardson, library media specialist with the Washingtonville Central School District, who also teaches classes on how to use the cloud.