Safe Doc Configuration

This article is written for G Suite for Education (GSFE) Admins. Note Safe Doc configuration is not supported for personal gmail accounts.

At out of the box, Safe Doc eliminates these kids-inappropriate features in GSFE,

the image searching feature
the video searching feature
the Explore feature
the Dictionary feature
the link preview feature
the middle finger emoji
games in google search, e.g. Snake

But every chef has their own taste. With that in mind, Safe Doc supports policy configurations to customize which G Suite features to block. To get a better understanding how policy works, take a look at Google's how-to Configuring Apps and Extensions by Policy.

Policy Configuration Format

As you just discovered from the Google article, the policy formats depend on the platform. I only explain the format for Chrome OS because students commonly use Chromebooks in school.

In a nutshell, the configuration is a human-readable JSON file. A sample policy for Safe Doc is like

{
  "SafeDocLicenseKey": {
    "Value": "12345678-9012-3456-7890-1234567890"
  },
  "EnableExplore": {
    "Value": true
  },
  "EnableDictionary": {
    "Value": false
  },
  "EnableVideoSearch": {
    "Value": true
  },
  "EnableImageSearch": {
    "Value": false
  },
  "BlockAddVideo": {
    "Value": false
  },
  "BlockEmojis": {
    "Value": ["🖕"]
  },
  "BlockDocLinkPreview": true,
  "BlockDriveSharedLinks": {
    "Value": {
      "Blacklist": [
        "1TTdYiQ_TgOlpNr-zyT8OpFLbwPmz0-g9XymYql5l1ZA",
        "*@*",
        "/*/*"
      ],
      "BlacklistExceptions": [
        "114xLJiJZ8OwXJ41sYyKdycT8Hy0ccbIgPVPG-n_6tew",
        "*@school.us"
      ],
      "DelegateAdminEmail": "d.admin@test.xfanatical.com"
    }
  },
  "BlockWebPublish": true,
  "BlockGoogleSearchGames": true
}

The definition of each policy can be found in Safe Doc Policy List below.

Editing a policy value is simple. Check the data type of the policy.

If it's a Boolean, the value is either true or false.
If it's a String, the value is a text like "this is a text".
If it's a Number, type a number.
If it's an Array (or List), then the value is like ["a", "b", "c"].
If it's an Object (or Group), then enclose policy elements with a pair of braces { part1: true, part2: false }. An Object is like a folder in your computer containing more files.

But be ware of typos, a redundant comma or missing curly bracket will break the policy configuration.

Apply New Policy Configuration

First of all, test your policy configuration in an isolated Organizational Unit (OU) to see if the user experience is what you wanted.

When you're ready to deploy the policy configuration, follow these steps

Log into Admin Console.
Go to Devices > Chrome management > Apps & extensions.
Select your student OU with Safe Doc installed.
Click Safe Doc app.
In this Policy for extensions of right panel, copy and paste your tested policy configuration.
If everything is correct, click Save to take effect. Then Safe Doc in your students' Chromebooks will be automatically reconfigured.

Safe Doc Policy List

SafeDocLicenseKey

Description	The license key used to activate Safe Doc. With a valid license key, the Safe Doc extension will display the icon in GREEN. Otherwise, it's displayed in GREY. If not set or incorrect, the extension does not function.
Data type	String

EnableExplore

Description	Block the Explore feature in Docs and Slides. The Explore feature can be activated from the floating widget on the bottom right of app, context menu or app menu. If not set or false, the Explore feature is blocked.
Data type	Boolean
Default	false

EnableDictionary

Description	Block the Dictionary feature in Docs, Sheets, Slides, Forms and Drawing. The Dictionary feature can be activated from right-click context menu or app menu. If not set or false, the Dictionary feature is blocked.
Data type	Boolean
Default	false

EnableVideoSearch

Description	Block the YouTube Video Search feature in Slides, Forms and Classroom. The YouTube video search feature can be activated from app menu in Slides or side app bar in Forms or comment bar in Classroom. If not set or false, this feature is blocked.
Data type	Boolean
Default	false

EnableImageSearch

Description	Block the Google Image Search feature in Docs, Sheets, Slides, Forms and Drawings. The Google Image Search feature can be activated from app menu Insert > Image > Search the web, toolbar, context menu or side app bar in Forms. If not set or false, this feature is blocked.
Data type	Boolean
Default	false

BlockAddVideo

Description	Block the Adding Video feature in Slides, Forms and Classroom. This is a more aggressive policy than EnableVideoSearch. It completely removes the Add video option from Slides, Forms and Classroom. The Slides Insert > Video will be removed. The video buttons in Forms and Classroom will removed. If this policy is set to true, the Adding Video feature is blocked.
Data type	Boolean
Default	false

BlockEmojis

Description	Block certain insulting emojis in Gmail. Gmail has a feature to allow students to select emoji symbols when composing an email. This policy allows you to configure which emoji symbol should be blocked. This policy is supplied with a list of strings. If this policy is not set, the default array will be used, ["🖕"]. If this policy is empty [], no emojis are blocked. If this policy includes an *, the emoji feature is disabled.
Data type	List of Strings
Default	["🖕"]
Examples	Block middle finger, grinning face, smiling face with sunglasses emojis. ["🖕", "😀", "😎"] Block the emoji feature. ["*"] No block. []

BlockDocLinkPreview

Description	Block the link preview feature in Docs, Slides and Drawings. The link preview feature allows students to accidentally finding inappropriate images and contents on links.
Data type	Boolean
Default	true

BlockDriveSharedLinks

Description	Block certain Google drive shared links even students have access permissions This policy is more powerful than Admin Console's Drive Sharing settings in terms of drive access management for students. It gives teachers and administrators finer control on which drive information students can see. Note this policy has 3 child settings, Blacklist, BlacklistExceptions and DelegateAdminEmail. Safe Doc will determine whether to block a shared drive file by first matching the blacklist and matching the exception list. The DelegateAdminEmail setting is used in the process of content filtering.The details of these settings are included in this table below.
Data type	Object
Default	`{ "Blacklist": [], "BlacklistExceptions": [], "DelegateAdminEmail": "" }`
Examples	`{ "Blacklist": [ "1TTdYiJ_TgOlpNr-zYT8OpELbwPmz0-g1XymYql5l1ZA", "@", "/Students/Element School/Grade 4", "/Students/Element School/Grade 5", "/Staff/" ], "BlacklistExceptions": [ "@your.district.k12.us", "@brother.district.k12.us", "@nonprofit.org", "the.science.guy@gmail.com", "/Staff/Teachers" ], "DelegateAdminEmail": "d.admin@your.district.k12.us" }` For a Grade 3 student, s/he is blocked to open the google doc with id `1TTdYiJ_TgOlpNr-zYT8OpELbwPmz0-g1XymYql5l1ZA` only allowed to visit shared files from his/her school, whitelisted schools, trusted external organizations and personal @gmail accounts. Files owned by other emails are blocked. not allowed to see shared files from Grade 4 and Grand 5 students and staffs other than teachers, like administrators or technicians.
Blacklist
Description	The blacklist of Drive file sources. Safe Doc can block Drive shared files in 3 forms. 1) A specific Drive file ID. Safe Doc blocks specific Drive files if their file IDs are in this blacklist. 2) All shared Drive files from specific owners. Input an email or emails of file owners. Safe Doc detects the owner of file link and block it if the owner's email address falls into the blacklist. Support the * wildcard. 3) All shared Drive files from owners from specific organizational units (OU). Specify the Organizational Unit Path. The OU path is a different representation of OU separated by a forward-slash '/'. For example, /Students/Elementary School/Grade 1 equals to District Domain > Students > Elementary School > Grade 1. Safe Doc looks up the OU of file owner and blocks the file link if the OU is in the blacklist.
Data type	List of Strings
Default	[]
Examples	["1TTdYiJ_TgOlpNr-zYT8OpELbwPmz0-g1XymYql5l1ZA", "1b4xLJiWZ8OwXJ45kYyOdycT8Hs0cabIgPVKG-n_6tew"] Block 2 drive files with their file id ["@gmail.com"] Block all shared files from @gmail.com accounts ["b.buckley@gmail.com", "p.melendez@example.org"] Block all shared files from 2 specific owners ["@"] Block all shared files from anyone, including users in your domain. Combine this with the BlacklistExceptions* option to achieve whitelisting specific owners. ["/Students/Grade 4", "/Students/Grade 5"] Block shared file links from Grade 4 and Grade 5 students. ["/Staff", "/Staff/"] Block shared file links from any staff. [""] Nah, using a single wildcard does not work.
BlacklistExceptions
Description	Exception Drive file links to the blacklist. Any file that matches the source in this list will be unblocked. Safe Doc accepts 2 forms of sources. 1) Specific owner emails. Support the * wildcard too. 3) Specific organizational units. Support the * wildcard too..
Data type	List of Strings
Default	[]
Examples	["@your.district.k12.us", "@brother.district.k12.us", "*@nonprofit.org", "the.science.guy@gmail.com"] Allow shared files from your school domain, whitelisted school domain, external non-profit organization and trusted @gmail accounts. ["/Staff/Teachers"] Allow shared file links from any teachers.
DelegateAdminEmail
Description	A privilege-limited administrator email to allow Safe Doc access user and organizational unit basic information to perform drive file link filtering. To know which OU a shared file owner is associated to, Safe Doc needs to impersonate an administrator to get user and OU information from your school domain using a service account. A separate administrator account with minimum user read-only and OU read-only privileges is ideal. Learn more about service account in Google's document Perform G Suite Domain-Wide Delegation of Authority
Data type	String
Default	"" (an empty string)
Examples	"d.admin@your.district.k12.us"

BlockWebPublish

Description	Block the publishing Docs / Sheets / Slides to the web feature, which allows students to share their documents publicly in the internet. If the policy is set to true, Safe Doc will remove the menu item File > Publish to the web in Google Docs, Sheets, Slides and Drawings. If this policy is unset or false, Safe Doc does nothing to the feature.
Data type	Boolean
Default	false

BlockGoogleSearchGames

Description	Blocks mini games (Snake, Tic tac toe, Pac-Man etc.) in Google search results if this policy is enabled. If this policy is unset or false, Safe Doc does nothing to the google search.
Data type	Boolean
Default	true

BlockClassroomUnenroll

Description	Prevent students from unenrolling classes in Google Classroom This feature is enabled if this option is true.
Data type	Boolean
Default	false

Takeaway

Configuration is an important characteristic of software. Luckily Google provided this option to remote configure the behavior of Safe Doc. If you encountered issues with the configurations, please leave a comment, email us at support@xfanatical.com or ask on our support community.