Note: Google has recently simplified its offerings by consolidating the Gemini Education and Gemini Education Premium SKUs into a new subscription called Google AI Pro for Education. Existing customers of SKU 1010470004 (Gemini Education) will be upgraded to the features of the Premium version at their next renewal.
Transcript
00:00:00.480 --> 00:00:07.839
All right. So, if you're a school IT
admin, I bet you know this headache all
00:00:05.120 --> 00:00:12.559
too well. Managing parental optouts for
new AI tools. Well, today we are going
00:00:10.320 --> 00:00:15.839
to build an elegant, totally automated
solution for that exact problem. And
00:00:14.400 --> 00:00:20.800
we'll do it right inside the Google
Admin Console. Okay, so picture this.
00:00:18.640 --> 00:00:24.160
You've rolled out a fantastic new tool,
something like Gemini, for your
00:00:22.080 --> 00:00:29.519
students. The possibilities for learning
are just huge. But then the opt out
00:00:27.760 --> 00:00:33.120
requests from parents start trickling
in. And if you've been in that boat, you
00:00:31.519 --> 00:00:39.280
know the logistical nightmare of trying
to track who's in and who's out. It can
00:00:35.520 --> 00:00:44.320
get so messy so fast. And here's the
real problem, the frustrating part.
00:00:41.840 --> 00:00:49.280
Google Workspace, well, it's built to
turn services on for people, not off.
00:00:47.680 --> 00:00:53.360
You can't just upload a simple list of
students and say, "Block these kids." It
00:00:51.360 --> 00:00:57.920
doesn't work that way. And that makes
managing optouts, which is all about
00:00:55.120 --> 00:01:02.399
excluding people, super tricky. But hey,
don't worry. There is a fantastic
00:01:00.480 --> 00:01:06.240
automated way to solve this. And that's
what we're here for. We're going to walk
00:01:04.080 --> 00:01:10.640
through creating some custom tags,
building what I like to call a backwards
00:01:08.240 --> 00:01:14.400
group, setting up the app access, and
then of course testing the whole thing
00:01:12.240 --> 00:01:19.360
out. All right, let's get into it. Step
one, the very first thing we have to do
00:01:16.960 --> 00:01:23.119
is create a way to digitally tag a
student who's opted out. And we're going
00:01:21.280 --> 00:01:27.920
to do this right inside their user
profile in the admin console. Yep, that
00:01:25.759 --> 00:01:31.040
means no more messy spreadsheets. Okay,
so to kick this off, you're going to
00:01:29.280 --> 00:01:35.600
head into the directory section of your
admin console. From there, click on
00:01:33.360 --> 00:01:39.439
users and then you'll need to find the
manage custom attributes option. It's
00:01:37.920 --> 00:01:44.159
kind of tucked away under the more
options menu. This is the spot where we
00:01:41.840 --> 00:01:47.439
can add our own special data fields to
user profiles. Now, you've got a choice
00:01:46.079 --> 00:01:50.880
here. If you've already set up
categories for custom data, you know,
00:01:49.040 --> 00:01:54.399
like this student fields example, you
can just add it right in there. Or if
00:01:52.799 --> 00:01:58.159
you haven't, no big deal. You can just
create a new category to keep everything
00:01:56.079 --> 00:02:01.840
nice and organized. The main thing is
just having a logical home for this new
00:01:59.759 --> 00:02:05.840
optout field. Okay, this is the most
important part right here. We're
00:02:03.680 --> 00:02:10.879
creating a brand new custom attribute.
Let's give it a clear name, something
00:02:08.000 --> 00:02:15.120
like Gemini opt out. And for the type,
this is crucial. You want to select yes
00:02:13.120 --> 00:02:18.720
or no. This simple little toggle is
going to be the engine that drives our
00:02:16.560 --> 00:02:22.879
entire automation. And boom, just like
that, the groundwork is laid. So now,
00:02:21.040 --> 00:02:26.400
when that email from a parent comes in
asking to opt their kid out, you just
00:02:24.720 --> 00:02:31.760
find the student's account, scroll down
to their info, and flip this new switch
00:02:28.319 --> 00:02:35.440
to yes. See? So clean, so simple, and
everything is logged right where it
00:02:33.120 --> 00:02:40.000
should be. Okay, so we've got our tag.
That's great. But how do we make Google
00:02:37.680 --> 00:02:43.599
Workspace actually do something with it?
Ah, well, this is where we get clever.
00:02:41.920 --> 00:02:47.760
This is the secret sauce. This is where
the magic really happens. So, remember
00:02:45.760 --> 00:02:51.120
how I said we can't turn Gemini off for
a group? We're just going to flip that
00:02:49.519 --> 00:02:54.879
whole idea on its head. We're going to
create what I call a backwards dynamic
00:02:53.120 --> 00:02:58.720
group. And this group, it's going to
automatically contain every single
00:02:56.640 --> 00:03:02.720
student who is allowed to use Gemini.
It's a yes list, not a no list. See
00:03:00.959 --> 00:03:07.360
where I'm going with this? The entire
trick, the whole thing, it all comes
00:03:05.200 --> 00:03:10.640
down to this one tiny little detail.
When you're in the dynamic group query
00:03:08.959 --> 00:03:14.560
builder, you'll see this powerful little
minus button. When you're building a
00:03:12.480 --> 00:03:19.280
rule, you click this button and it flips
the logic from equals to not equals.
00:03:17.120 --> 00:03:24.080
This right here is the key that unlocks
this whole solution. So, check out the
00:03:21.440 --> 00:03:30.080
logic of the final query here. The first
rule that pulls in everyone from the
00:03:26.319 --> 00:03:34.480
main student OU. Simple enough. But then
look at the second rule. It excludes
00:03:32.480 --> 00:03:38.480
anyone where that Gemini opt out field
is set to true. So, what you're left
00:03:36.720 --> 00:03:42.400
with is a group that includes every
single student, unless that little
00:03:40.480 --> 00:03:46.000
switch we just made is flipped to yes.
Once you've got that query built, you'll
00:03:44.319 --> 00:03:50.560
want to give the group a really clear
name. You know, like Gemini students, so
00:03:48.000 --> 00:03:54.560
you know exactly what it does. And this
next part is critical. You have to mark
00:03:52.480 --> 00:03:57.840
it as a security group. That's what lets
you actually use it to control app
00:03:56.239 --> 00:04:02.000
settings across your whole domain. All
right, so we've got our digital tag.
00:03:59.840 --> 00:04:06.080
We've got our clever backwards group.
Now, it's time for the payoff. Let's put
00:04:04.319 --> 00:04:10.879
all these pieces together and make this
automation go live. Okay, so the first
00:04:08.959 --> 00:04:14.720
move here is a big one. You need to go
to your Gemini app settings and you're
00:04:12.560 --> 00:04:18.639
going to turn the service off for all of
your main student OUS. This sets the
00:04:16.799 --> 00:04:22.160
default for every single student to no
access. It's a clean slate. And this
00:04:20.400 --> 00:04:26.160
also conveniently takes care of any
students under 13 who shouldn't have
00:04:23.840 --> 00:04:30.240
access anyway. Then right on that same
settings screen, you're going to find
00:04:28.000 --> 00:04:34.320
and select that Gemini students group we
just made. and you're going to override
00:04:32.160 --> 00:04:38.960
that OU setting by turning the service
on specifically for them. This is the
00:04:37.120 --> 00:04:42.800
step that actually grants the access
back, but only to the right people. And
00:04:40.880 --> 00:04:48.320
the final logic here is just it's
beautiful. It's so simple. The service
00:04:45.600 --> 00:04:53.600
is off for all students at the U level.
That's the default. But because group
00:04:50.800 --> 00:04:58.320
settings always override OU settings,
any student who is in our special Gemini
00:04:55.759 --> 00:05:01.600
students group gets access. So what
happens when a student gets opted out?
00:05:00.080 --> 00:05:05.759
They get automatically kicked out of
that group and their access just
00:05:03.360 --> 00:05:09.919
vanishes. It's completely hands-off. And
that's it. The whole system is
00:05:07.600 --> 00:05:14.000
configured. But of course, we're not
done until we test it, right? We have to
00:05:12.240 --> 00:05:17.360
make sure it works perfectly. So, let's
do a quick recap of the process and talk
00:05:15.759 --> 00:05:21.520
about how to verify it. It really all
boils down to this elegant little
00:05:19.120 --> 00:05:26.240
three-step process. First, you create
the custom attribute so you can tag the
00:05:23.360 --> 00:05:30.560
users. Second, you build that backwards
dynamic group for all the students who
00:05:28.080 --> 00:05:35.520
have not opted out. And third, you set
Gemini to off for the student OUs and
00:05:33.039 --> 00:05:40.240
then on for your new group. That's it.
Tag, group, configure. Simple. Testing.
00:05:38.240 --> 00:05:43.759
This is super straightforward. Just grab
one of your test student accounts and
00:05:41.680 --> 00:05:47.840
first confirm they can get into Gemini.
Everything's working. Then go into that
00:05:45.840 --> 00:05:52.240
student's profile and flip that Gemini
opt-out switch to yes. Now, you might
00:05:50.560 --> 00:05:56.000
have to be a little patient. Go grab a
coffee or something because dynamic
00:05:53.759 --> 00:06:00.960
groups can take up to 24 hours to fully
update. But when you check back, you'll
00:05:58.080 --> 00:06:05.039
see their access is gone all on its own.
You know, this technique is just so
00:06:03.280 --> 00:06:08.880
powerful and it goes way beyond just
managing Gemini access. So that leaves
00:06:07.199 --> 00:06:12.560
us with one final question to think
about. What other administrative
00:06:10.800 --> 00:06:16.400
headaches do you have? What other
services or settings or permissions in
00:06:14.479 --> 00:06:21.039
your domain could you simplify with this
same idea? Anytime you need to manage
00:06:18.639 --> 00:06:26.120
exclusions, this backwards groups method
might just be that elegant solution
00:06:22.560 --> 00:06:26.120
you've been looking for.
Comments
Please sign in to leave a comment.