This article is written for Google Workspace for Education administrators.

The article is a deployment guide of Safe Doc, a chrome extension that helps school administrators manage inappropriate features in Google Workspace for Education that Google Admin Console doesn't provide. Safe Doc can be installed in managed Chrome devices (primarily Chromebooks) and desktop Chrome browsers.

0. Prerequisites

  • To change a series of settings in admin console, you need to be a Super Admin role.
  • Safe Doc has System Requirements. Please make sure your school's technology environment meet the requirements.
  • You need a license key to enable Safe Doc. If you don't have a license key, please apply for a 30-days trial key.

1. Create a Test Organization Unit (OU)

For the first time hands-on, we recommend you to experiment and configure Safe Doc in a test OU. This is to avoid screwing up your production students' Chrome browser settings. Once you're more familiar with Safe Doc setup, you can copy the settings to your production students' OU.

If you're an experienced admin and confident with what you are doing, you can skip this and directly work on your production student OU.

If you didn't know create an OU, please follow Google's documentation Add an organizational unit extension. In this article, we only focus on the setup of Safe Doc extension. We use a test OU xfanatical.com > students in the rest of article for demonstration.

Create an Organization Unit (OU) for students in Admin Console
Create a test Organization Unit (OU) in Admin Console (Directory > Organizational units)

2. Add test student accounts to the OU

Now you add one or more test accounts to the test OU. The following screenshot is in Directory > Users. See more instructions from Google's doc Move users to an organizational unit.

Target students are put into the students OU
Test students are put into the students OU

3. Customize User & Browser Policy to the OU

Some security policies are required so that the Safe Doc chrome extension cannot be easily shutdown or tampered by students, e.g. Chrome Developer tools.

  1. Open Devices > Chrome > User & browser settings.
    Select User & browser settings in Chrome management
  2. Disable Developer Tools for force-installed extensions. Select either Never allow use of built-in developer tools (Recommended) or Allow use of built-in developers except for force-installed extensions
    Disable developer tools in Chrome settings
  3. Disable Incognito mode. Explain: Incognito mode disables all extensions, including force-installed applications, including Safe Doc.
    Disable incognito mode in Chrome settings
  4. Whitelist our license server in your Chrome policy settings if you have adopted Google Admin Console's built-in content filter. In the URL blocking section > Blocked URL exceptions, add a new line denali.xfanatical.com. These 2 Google articles documented the usage of URL blocking, Allow or block access to websites and URL Blacklist filter format.
    Whitelist our license server in your chrome policy
  5. Whitelist our license server (https://denali.xfanatical.com) in your school firewall. This is beyond the scope of this article. Please contact your network administrator if you are not in charge of the network. You can verify if our license server is reachable by clicking https://denali.xfanatical.com in the test user's Chrome browser. If it tells you Not Found, that indicates no blocking.

4. Install Safe Doc on Students' Chrome browsers

Installation of a chrome extension can be done remotely in your Google Admin Console, without physical access to your students' devices. You can grab an overview of extension deployment in Google Help Article Automatically install apps and extensions. Follow this instruction for Safe Doc deployment specifically.

  1. Go to Devices > Chrome > Apps & extensions.
  2. Under the left panel, select the students OU, so the extension will be installed only under this OU.
  3. Hover on the Yellow plus button button and click the Chrome Web Store button to find an extension from Chrome Web Store.
    Add an extension in Chrome Apps & extensions
  4. Now type Safe Doc in the search bar and click Select to install.
    Find and install Safe Doc from the Chrome Web Store
  5. After Safe Doc is added into the list, change its installation policy to Force install.
  6. Download the attachment text file in your trial license confirmation email.
    Safe Doc Trial License Policy Configuration Email Attachment
  7. In the Policy for extensions, upload the attachment file. It's a JSON formatted content, including the license key for your school as well as policies to configure Safe Doc blocking behaviors. Learn more in Safe Doc Configuration.
  8. Click Save.
    force install Safe Doc in Admin Console

Here is an example of extension policy,

{
   "SafeDocLicenseKey": {
     "Value": "04fdc2ca-f9b3-11e9-969d-878ce7c660bf"
   },
   "EnableExplore": {
     "Value": false
   },
   "EnableDictionary": {
     "Value": false
   },
   "EnableVideoSearch": {
     "Value": false
   },
   "EnableImageSearch": {
     "Value": false
   },
   "BlockAddVideo": {
     "Value": false
   },
   "BlockEmojis": {
     "Value": ["🖕", "🗡", "🔫", "🔪"]
   }
}

That's all for setup in Google Admin Console.

5. Validate your Setup of Safe Doc

Validate if Safe Doc is force-installed on students' Chrome browsers. We assume you have the mock user added in the OU and the account has logged in a Chromebook now.

  1. Open Chrome browser in the Chromebook.
  2. In a few seconds, the Safe Doc icon will be displayed in the toolbar, in GREEN. It means the extension functions properly.
  3. If the icon is colored in GREY, it's not functioning properly for the following reasons.
    • The Safe Doc chrome extension is installed directly from Chrome Web Store.
    • The Configuration File in Step 4 isn't given.
    • The license key in configuration file is invalid (expired, misused etc)
    • The student's email domain does not match with the student domain of license key.
    • More information can be found in Safe Doc Common Issues.
    • Software bugs. If none of above applies to you, it's likely a software issue from our end. You can send an email to [email protected].
Safe Doc Status in colors
Safe Doc Status in colors

Now you have Safe Doc working properly (displayed in GREEN). It's time to test and explore Safe Doc features. You can find the list of Safe Doc features in the Support page. Some features require Safe Doc Configuration setup. The following blocking features shall be sufficient for you to validate if Safe Doc works out-of-the-box.

  1. Open any Google Doc, Sheet, Slides, Forms or Drawing document. The image search and youtube video search features are no longer accessible to students. Take Google Doc and Slide as the examples.
  2. The Insert > Image > Search the web is not visible any more. Safe Doc also blocks similar menu entries in different places. As you know, the Search the web menu item can trigger the image searching side panel which allows your students to search not-safe-for-school images. But now it's impossible.
    Block Search the web that activates image search with Safe Doc
  3. The Explore widget on the bottom right of Google Docs and Slides will be removed. It also remove other places like in the context menu that trigger the Explore feature. The Explore feature allows students to search wobbly filtered web and images. This extension will stop that.
    Block Explore Widget in Google Docs
  4. Now Open a Google Slide. Find the Youtube video search functionality in Google Slides, which allows your students to search and watch Youtube videos within Google Slides.
  5. Click the Slides menu Insert > Video...
  6. A dialog will popup. It used to show Youtube search in a Search tab. However, Safe Doc can remove it for you. Students cannot search Youtube videos but type in managed Youtube URLs, which is safer.

Now verify if ALL of your students in the OU have Safe Doc enabled in GREEN.

Upgrade License

The trial license key and the annual license key are two different keys.

After you purchase the annual license, you will receive a new annual license key by email. Please follow these steps to activate the new license key.

  1. Login into your Google Admin Console.
  2. Go to the Devices > Chrome > Apps & extensions page.
  3. Under your production students' OU, select Safe Doc.
  4. In the Policy for extensions section of right panel, replace the existing trial license key with the new annual license key.
    Upgrade safe doc license in policy for extensions
  5. Click Save.
  6. The new license key will usually propagate to students' Chrome devices or browsers in a few minutes after when they are online. But the process can also take up to 24 hours according to Google's documentation How changes propagate to Google services.

Uninstall Safe Doc

Uninstalling Safe Doc from your students' Chrome device or browsers follows a similar pattern.

  1. Login into your Google Admin Console.
  2. Go to the Devices > Chrome > Apps & extensions page
  3. Under the production students OU, select Safe Doc.
  4. On the right panel, click the trash icon button.
  5. Click Save.
  6. The extension will be automatically unloaded remotely from your students' Chrome browsers.
Uninstall Safe Doc from students' OU
Uninstall Safe Doc from students' OU

Wrap up

Please take patience to configure enterprise-level applications. It's often more complex and error-prone than individual account setup. So if there are confusions in this article, please email us at [email protected].