xFanatical Safe Doc Configuration

This article is written for Google Workspace for Education (GWFE) Admins. Note xFanatical Safe Doc configuration is not supported for personal Gmail accounts.

xFanatical Safe Doc helps school IT admins manage age-inappropriate features in Google Workspace for Education, that Google Admins do not offer. Similar to Chrome Enterprise policy list, xFanatical Safe Doc has its own enterprise policy list. Each policy manages a specific feature in GWFE. These policies are managed in Google Admin Console's Apps & extensions. To get a better understanding of how Chrome extension policy works, take a look at Google's support article App and extension policies.

Policy Configuration Format

This article focuses on the Chrome profile based policy configuration via Google Admin Console. This policy management approach supports all managed ChromeOS devices, Chrome Browser for Windows and Chrome Browser for MacOS.

xFanatical Safe Doc policy configuration in Google Admin Console is a JSON file. Please explore the JSON syntax if you have never heard of it. The JSON includes a group of policies. Here is a sample policy.

{
  "SafeDocLicenseKey": {
    "Value": "12345678-9012-3456-7890-1234567890"
  },
  "EnableExplore": {
    "Value": true
  },
  "EnableDictionary": {
    "Value": false
  },
  "EnableVideoSearch": {
    "Value": true
  },
  "EnableImageSearch": {
    "Value": false
  },
  "BlockAddVideo": {
    "Value": false
  },
  "BlockEmojis": {
    "Value": ["🖕"]
  },
  "BlockDocLinkPreview": {
    "Value": true
  },
  "BlockWebPublish": {
    "Value": true
  },
  "BlockGoogleSearchGames": {
    "Value": true
  }
}

Each policy comes with a format of "PolicyName": { "Value": <the value> }. The "Value" property is a must. Missing it would invalidate the entire configuration and the changes won't be delivered to your students' Chrome browsers.

The policy value depends on its data type.

If it's a Boolean, the value is either true or false.
If it's a String, the value is a text like "this is a text".
If it's a Number, enter a number.
If it's an Array (or List), then the value is like ["a", "b", "c"].
If it's an Object (or Group), then enclose policy elements with a pair of braces { property1: true, property2: false }. An Object is like a folder in your computer containing more files.

The definition of each policy can be found in the xFanatical Safe Doc Policy List below. Most xFanatical Safe Doc policies are of the Boolean type.

Be careful of typos. A redundant comma or missing curly bracket will break the policy configuration. The following example shows a missing comma in the JSON configuration results in an error message from Google Admin Console extension policy configuration pane.

*JSON syntax error in configurating xFanatical Safe Doc policy in Google Admin Console Apps and Extensions page*

Edit Policy Configuration

First of all, We recommend you test your policy configuration in an isolated Organizational Unit (OU) to find your blocking strategy. When you're ready, you can copy and paste the policy configuration to the production student OU(s).

To edit the policy configuration for an OU, follow these steps.

Log into Google Admin Console.
Go to Devices > Chrome > App & Extensions > Users & browsers.
Select the OU with xFanatical Safe Doc installed.
Click the xFanatical Safe Doc app.
In the Policy for extensions of right panel, edit your policy configuration JSON.
If everything is correct, click Save to take effect. Then the Safe Doc extension in your test student accounts under this selected OU will be automatically receive the changes and block features as you configured.

*Configuring xFanatical Safe Doc in Google Admin Console Apps & Extensions (Click to enlarge)*

Best Practices on Configuring Safe Doc Policies

Only enable the policies you need. If you don't need to block the features in Google Workspace for Education, it's recommended to explicitly turn off the policy. Enabling too many policies may impact your students' Google apps performance and experiences.
Watch out for the default values when the policies are unset. For example, the EnableImageSearch with default value of false, that means the image searching feature is blocked if this policy does not appear in your policy configuration.
Side note: we're designing the naming convention towards Block<GWFE-feature> with the default value of false to make configuration more consistent.

xFanatical Safe Doc Policy List

SafeDocLicenseKey

Description	The license key used to activate Safe Doc. With a valid license key, the Safe Doc extension will display the icon in . Otherwise, it's displayed as . If not set or incorrect, the extension does not function.
Data type	String
Support since	Version 1.1.0

EnableExplore

EnableDictionary

EnableVideoSearch

EnableImageSearch

BlockAddVideo

BlockEmojis

BlockDocLinkPreview

BlockDriveSharedLinks

Blacklist

This is a subsidiary property of BlockDriveSharedLinks policy.

Description	The blacklist of Drive file sources. Safe Doc can block Drive shared files in 3 forms. 1) A specific Drive file ID. Safe Doc blocks specific Drive files if their file IDs are in this blacklist. 2) All shared Drive files from specific owners. Input an email or emails of file owners. Safe Doc detects the owner of file link and block it if the owner's email address falls into the blacklist. Support the * wildcard. 3) All shared Drive files from owners from specific organizational units (OU) or sub OUs. Specify the Organizational Unit Path. The OU path is a different representation of OU separated by a forward-slash '/'. For example, /Students/Elementary School/Grade 1 equals to District Domain > Students > Elementary School > Grade 1. Safe Doc looks up the OU of file owner and blocks the file link if the owner OU is in the blacklist.
Data type	List of Strings
Default	`[]`
Examples	`"Blacklist": [ "1TTdYiJ_TgOlpNr-zYT8OpELbwPmz0-g1XymYql5l1ZA", "1b4xLJiWZ8OwXJ45kYyOdycT8Hs0cabIgPVKG-n_6tew" ]` Block 2 drive files by their file IDs `"Blacklist": ["@gmail.com"]` Block all shared files from @gmail.com accounts `"Blacklist": [ "[email protected]", "[email protected]" ]` Block all shared files from 2 specific owners `"Blacklist": ["@"]` Block all shared files from anyone, including users in your domain. Combine this with the BlacklistExceptions* option to achieve whitelisting specific owners. `"Blacklist": ["/Students/Grade 4", "/Students/Grade 5"]` Block shared file links from Grade 4 and Grade 5 students, including their sub-OUs. `"Blacklist": ["/Students//Exam"]` Block shared file links from Exam students on any grades, including their sub-OUs. `"Blacklist": ["/Staff"]` Block shared file links from any staff OU and sub OUs. `"Blacklist": [""]` Nah, using a single wildcard does not work.
Support since	Version 1.6.7

BlacklistExceptions

This is a subsidiary property of BlockDriveSharedLinks policy.

Description	Any file that matches the source in this list will be unblocked. Safe Doc accepts 2 forms of sources. 1) Specific owner emails. Support the * wildcard too. 2) Specific organizational units and sub OUs. Support the * wildcard too.
Data type	List of Strings
Default	`[]`
Examples	`"BlacklistExceptions": [ "@your.district.k12.us", "@brother.district.k12.us", "*@nonprofit.org", "[email protected]" ]` Allow shared files from your school domain, whitelisted school domain, external non-profit organization and trusted @gmail accounts. `"BlacklistExceptions": ["/Staff/Teachers"]` Allow shared file links from any teachers, including sub-OUs.
Support since	Version 1.6.7

DelegateAdminEmail

This is a subsidiary property of BlockDriveSharedLinks policy.

Description	A privilege-limited administrator email to allow Safe Doc access user and organizational unit basic information to perform drive file link filtering. To know which OU a shared file owner is associated to, Safe Doc needs to impersonate an administrator to get user and OU information from your school domain using your service account. A separate administrator account with minimum user read-only and OU read-only privileges is ideal.
Data type	String
Default	`""`
Examples	`"DelegateAdminEmail": "[email protected]"` [email protected] is an user account with limited admin privileges created specifically to read file owners' OU information.
Support since	Version 1.6.7

ServiceAccountEmail

This is a subsidiary property of BlockDriveSharedLinks policy.

Description	The email of service account you created in your Google Cloud Platform. To protect the service account information, we strongly recommend to encrypt it using the Service Account Encryption Tool for Safe Doc tool in the BlockDriveSharedLinks policy and set the value with the encrypted text instead of the plain email address.
Data type	String
Default	`""`
Examples	`"ServiceAccountEmail": "7a04e3d4373e5759f78e493ab296fb26ee93b...(truncated for demo purpose)"` Use an encrypted value of service account email for security. `"ServiceAccountEmail": "[email protected]"` It's also acceptable to use the plain email address.
Support since	Version 1.29.1

ServiceAccountPrivateKey

This is a subsidiary property of BlockDriveSharedLinks policy.

Description	The private key of service account you created in your Google Cloud Platform. To protect the service account information, please first encrypt it using the Service Account Encryption Tool for Safe Doc tool in the BlockDriveSharedLinks policy and set the value with the encrypted text instead of the plain private key. You're responsible to protect your own service account private key.
Data type	String
Default	`""`
Examples	`"ServiceAccountPrivateKey": "3251af946a10775edbb8080790b3c849d3b7...(truncated for demo purpose)"` Use an encrypted value of service account private key for security. `"ServiceAccountPrivateKey": "-----BEGIN PRIVATE KEY-----n MIIEvQIBADANBgkqhkiG9w0BAQEF...(truncated for demo purpose)"` It's also acceptable to use the plain private key, but it's not recommended.
Support since	Version 1.29.1

BlockWebPublish

BlockGoogleSearchGames

BlockClassroomUnenroll

Description	Prevent students from unenrolling classes in Google Classroom This feature is enabled if this option is true.
Data type	Boolean
Default	false
Support since	Version 1.7.0
Dropped support since	Version 1.34.5 Google supports Control whether students can unenroll themselves from classes starting from Oct 4, 2021.
Learn more	Prevent Students from Unenrolling in Classroom

BlockStickers

Description	Block certain not-so-nice stickers in Hangouts Provide the sticker name in this policy to remove those stickers from your students' Hangouts app and Gmail app. To find which value to be put in the policy, see this Sticker Names table. This policy is supplied with a list of strings. If this policy is not set, the default array will be used, ["Poop"]. If this policy is empty [], no stickers are blocked.
Data type	Array of strings
Default	`["Poop"]`
Examples	`"BlockStickers": { "Value": ["Poop", "Cheers", "Callouts_Internet_LMAO"] }` Block the Poop, Cheers and the LMAO stickers
Support since	Version 1.8.0
Dropped support since	Version 1.38.0 Google Hangouts was shut down in November 2022.
Learn more	Block Stickers in Hangouts

BlockMeetCaptions

NewTabPageUrl

BlockMeetRecord

Description	Disable the meeting recording feature in Google Meet. Prevent students from initiating meeting recording in Google Meet except the teacher. The meeting recording is blocked if this policy is set to true.
Data type	Boolean
Default	false
Support since	Version 1.11.0
Dropped support since	Version 1.32.1 Google Meet has addressed this issue, as documented in Record a video meeting, "You can record if: You’re the meeting organizer; You’re in the same organization as the organizer; You’re a teacher signed in to your Google Workspace account, but not a student."
Learn more	~~Disable Students Recording Meeting in Google Meet~~

BlockMeetPresent

Description	Disable the presenting screen feature in Google Meet. Prevent students from sharing their screens to take over the teacher's presentation, permanently without disabling it in Host Control. The presentation screen is blocked if this policy is set to true.
Data type	Boolean
Default	false
Support since	Version 1.11.0
Dropped support since	Version 1.36.0 Google has provided a replacement admin control for this feature. Please Google's announcement in New Google Meet management settings for admins.
Learn more	Disable Students Sharing Screens in Google Meet

BlockMeetAddPeople

BlockComment

BlockInFileChat

BlockMeetChat

Description	Disable the Chat feature in Google Meet. This policy stops students from posting chat messages in Google Meet. But students can still view messages posted by the teacher. This policy is an alternative permanent solution for all Meets as opposed to the Host Control that is on session basis. The Chat feature is blocked if this policy is set to true.
Data type	Boolean
Default	false
Support since	Version 1.13.0
Dropped support since	Version 1.36.0 Google has provided an admin control to disable the chat feature in Google Meet. Please see the announcement in New Google Meet management settings for admins.
Learn more	Disable Chat In Google Meet

BlockSendFeedback

BlockClassroomPeopleInfo

BlockAddImageByUrl

BlockEmailAsAttachment

BlockMeetJoinOrStartButton

Disable the Net meeting and join meeting code buttons in Google Meet home page

ScheduleRefreshChromeTabs

BlockGmailChat

Description	Disable the Chat feature in Gmail This policy disables the Chat widget at the left panel of Gmail. It prevents students from chatting in Gmail. The Google Chat service is not changed. The blocking is ON if this policy is set to true.
Data type	Boolean
Default	false
Support since	Version 1.15.0
Notes	Update in version 1.34.2 Dropped the support for this policy. The classic Hangouts widget in Gmail side panel can be turned off by disabling the Classic Hangouts service for the students OU. Later Google sunset the Hangouts service. Updated 1.42.0 Restored the support for this policy to block the Chat services in Gmail.
Works with
Learn more	Block Google Chat in Gmail

BlockEditorTemplates

Description	Mute all participants and lock muting in Google Meet This policy added a magic chat command in Google Meet, /muteall. This command allows teachers to mute all students at once while presenting the lecture, by opening the chat side panel and input /muteall. The difference of the chat command from the built-in mute all button on Feb 2021's Google Meet update is that students cannot unmute themselves. This chat command locks the muting until the end of meeting unless they refresh the page and rejoin the meeting. This feature is OFF by default.
Data type	Boolean
Default	false
Support since	Version 1.18.0
Dropped support since	Version 1.34.5. Google adds microphone management to the Host Control for Meet organizers since Oct. 21, 2021.
Learn more	Force Mute All Students in Google Meet

Description	Opt out anonymous Safe Doc error reporting To help us troubleshoot Safe Doc issues, Safe Doc automatically collects anonymous crash information. The error reporting excludes any personal identifiable information (PII) abiding by privacy laws like COPPA. See xFanatical Privacy Page for more information. Anonymous error reporting is ON by default. To opt out, set this policy to true.
Data type	Boolean
Default	false
Support since	Version 1.20.6