This article is written for GSuite Super Admins.

If you don’t know what Safe Doc is, check out this What is Safe Doc article. In a nutshell, Safe Doc hides the image / youtube search feature in Google Apps to protect K12 students. This chrome extension applies to Chromebooks and Chrome browsers.

Now let’s start setup.

0. Prerequisites

1. Create an Organization Unit (OU)

An Organization Unit (OU) is recommended because it allows you to assign specific policies to users in the OU without impacting other domain users. In our case, the chrome extension will be installed only for the students OU. If your school has more complex students structures, you can create sub-OUs to further segments them.

If you didn’t know create an OU, please take an exercise with the G Suite Training extension provided by Google. It’s a long story learning the Admin console, so we only focus on the setup of Safe Doc extension in this article.

Create an Organization Unit (OU) for students in Admin Console
Create an Organization Unit (OU) for students in Admin Console (Directory > Organizational units)

2. Add Students to the OU

Now you add student users, who use this extension, to the students OU. The following screenshot is in Directory > Users.

Target students are put into the students OU
Target students are put into the students OU

3. Customize User & Browser Policy to the OU

Some security policies are required so that the Safe Doc chrome extension cannot be easily shutdown or tampered by students. We know they are curious.

Of course, the following policies only matter the operation of Safe Doc extension. You definitely will apply other policies like Youtube content sensitivity, to further control the content for students.

  • Open Devices > Chrome management > User & browser settings.
  • Disable Developer Tools for force-installed extensions. Select
    • either Never allow use of built-in developer tools (Recommended)
    • or Allow use of built-in developers except for force-installed extensions
Disallow developer tools in Admin console
Disallow developer tools in Admin console
  • Disable Incognito mode. Explain: Incognito mode disables all extensions, including force-installed applications, that invalids Safe Doc.
Disallow Incognito mode in Admin Console
Disallow Incognito mode in Admin Console

4. Install Safe Doc on Students’ Chromebooks

Installation of a chrome extension can be done easily on Admin Console, without physical access to users’ devices. General steps has been described in Google Help Article Automatically install apps and extensions. Specifically for Safe Doc, follow this instruction.

  • Go to Device management > Chrome > App Management.
  • Under the left panel, Find or Update Apps, you type Safe Doc in the text box, and click Search.
  • Then Safe Doc will show up in the right screen of search results.
  • Click Safe Doc.
Find and Install Safe Doc in App Management
Find and Install Safe Doc in App Management
  • You will then see the settings for this chrome extension.
  • Click User settings.
  • Select the students OU.
  • In the Force installation, Setting inherited, click Override.
  • In the Configure, Setting inherited, click Override.
Override settings of Safe Doc for students OU only
Override settings of Safe Doc for students OU only
  • Turn on Force Installation.
  • Click UPLOAD CONFIGURATION FILE.
  • Now upload the license key file. It looks like this.
{
  "SafeDocLicenseKey": {
     "Value": "426b83b8-8c03-11e9-8abc-43052bdae888"
  }
}
Enable Force Installation and upload configuration file (the license key file)
Enable Force Installation and upload configuration file (the license key file)
  • Once you uploaded the configuration file, You may click View to review it.
  • Now click SAVE button if information is correct.
Review the uploaded configuration file and save in App Management
Review the uploaded configuration file and save in App Management

That’s all for setup in Admin Console. Let’s validate if this works.

5. Validate the Setup of Safe Doc

Validate if Safe Doc is force-installed on students’ Chromebooks. It’s easier to test on a mock user and a spare Chromebook than request access to students’ Chromebooks they are currently using. We assume you have the mock user added in the OU and logged in a Chromebook now.

  • Open Chrome browser in a Chromebook.
  • In a few seconds, the Safe Doc icon will be displayed in the toolbar, in GREEN. It means the extension functions properly.
  • If the icon is colored in GREY, it’s not functioning properly for the following causes.
    • The Safe Doc chrome extension is installed directly from Chrome Web Store.
    • The Configuration File in Step 4 isn’t given.
    • The license key in configuration file is invalid (expired, misused etc)
    • This user has exceed the user quota in the license key. It can be observed that part of students’ Chromebooks have Safe Doc functioning while others don’t.
    • Software bugs. If none of above applies to you, it’s likely a software issue from our end. You can send an email to support@xfanatical.com.
Safe Doc Status in colors
Safe Doc Status in colors

Now you have Safe Doc working properly (displayed in GREEN). It’s time to do some real field testing.

  • Open any Google Doc, Sheet, Slides, Forms or Drawing document. The image search and youtube video search features are no longer accessible to students. To keep your students from tampering Safe Doc, we don’t disclose where these entries are.
  • We take Google Doc and Slide as the examples.
  • The Insert > Image > Search the web is not visible any more. Safe Doc also blocks similar menu entries in different places. As you know, Search the web can trigger image search. But now it’s impossible
Block Search the web that activates image search with Safe Doc
Block Search the web that activates image search with Safe Doc
  • The IMAGE tab in Explore side panel is now removed. Without Safe Doc, students would use Explore feature to search any images. They cannot see any images now.
The IMAGE tab in Explore is disabled
The IMAGE tab in Explore is disabled

Now look at the video search in Google Slides

  • Click the menu Insert > Video…
  • A dialog will popup. It used to show Youtube search in a Search tab. However, Safe Doc can remove it for you. Students cannot search youtube videos but type in managed youtube URLs, which is safer.

Now verify if ALL of your students in the OU have Safe Doc enabled in GREEN.

Wrap up

Please take patience to configure enterprise-level applications. It’s often more complex and error-prone than individual account setup. So if there are confusions in this article, please don’t hesitate to comment below or email us at support@xfanatical.com.

Good luck to your setup.