Back to All Cheatsheet Libraries cheatsheets

Google Workspace for Education

Chromebook management, editions and licensing, Classroom, and the Admin console — the reference for school Google deployments.

Two separate licences, and people constantly conflate them

A Chromebook 1:1 programme needs both: a Google Workspace for Education edition (the user accounts, storage, and admin features) and a Chrome Education Upgrade licence per device (what actually makes the Chromebook manageable). Buying the first without the second is the most common procurement mistake in school IT.

Edition What it adds Notes
Education FundamentalsThe free core — Gmail, Drive, Docs, Classroom, Meet, and the Admin console.Free for qualifying institutions. Sufficient for many schools on its own.
Education StandardAdds security centre, advanced audit and investigation, and stronger device/data controls.The security tier — relevant once safeguarding and incident investigation become formal requirements.
Teaching & Learning UpgradeAdvanced Meet (larger meetings, recording, attendance), Classroom add-ons, originality reports.Licensed per teacher rather than per student, which keeps the cost manageable.
Education PlusEverything above, licensed across all staff and students.The full bundle; priced per student with education discounting.
Chrome Education UpgradePer-device licence that enables enrollment and policy management for a Chromebook.Separate from the Workspace edition. Perpetual per device, and tied to that device for its life — it doesn't transfer.

Enrollment is sticky — that's the feature

Unlike almost every other platform, a managed Chromebook cannot be un-enrolled by wiping it. Powerwash returns it to the enrollment screen still bound to your domain. For a school handing hardware to teenagers, that property is worth more than any individual policy.

1

Build the OU structure before enrolling anything

Organisational Units drive every policy decision. A typical structure separates staff from students, then students by year group. Get this right first — devices and users inherit policy by OU, and restructuring later is disruptive.

/Staff /Students/Year-7 … /Year-11 /Students/Sixth-Form /Devices/Shared-Carts /Devices/Kiosk-Signage
2

Enroll before anyone signs in

At the Chromebook's first sign-in screen press Ctrl+Alt+E and enroll with an account that has device-enrollment rights. If a user signs in first, you must Powerwash and start again — this trips up a lot of first-time deployments.

3

Place devices in the right OU at enrollment

Set the enrollment OU in advance so devices land where their policy lives. Devices can be moved later, but doing it in bulk after the fact is avoidable work.

4

Set sign-in restrictions

Restrict sign-in to your domain so personal Google accounts can't be used on school hardware. This single setting prevents a large category of safeguarding and support problems.

5

Configure apps, extensions, and URL policy per OU

Force-install required extensions, allow-list or block-list URLs, and control the Web Store. Younger year groups typically get an allow-list; sixth form a block-list.

6

Choose the right device mode for shared hardware

Managed Guest Session for shared carts — no sign-in, wiped at logout. Kiosk for signage or a single-purpose station. Standard managed mode for 1:1 devices.

7

Check the Auto Update Expiration date before buying

Every Chromebook model has an AUE date after which it stops receiving OS and security updates. Buying near-AUE hardware — especially refurbished — is a false economy and a security problem. Verify it before purchase, every time.

Feature What it does Notes
ClassroomAssignment distribution, collection, grading, and feedback.Free in all editions. Class creation can be automated by syncing from your MIS/SIS rather than teachers building classes by hand.
Originality reportsChecks student work against web sources and, at higher tiers, against your own school's past submissions.Limited runs in free editions; unlimited with Teaching & Learning Upgrade or Education Plus.
Practice setsInteractive assignments with automatic hints and feedback.Paid tiers. Genuinely reduces marking load for maths and science.
Meet for educationVideo lessons with host controls, breakout rooms, attendance, and recording at higher tiers.Ensure students can't start meetings without a teacher — a settings-level control worth checking.
Chromebook screen controlsTeacher visibility of student screens and tab restriction during lessons.Requires Education Plus/Upgrade, or a third-party classroom-management tool.
Guardian summariesAutomated email digests of upcoming and missing work to parents.Free, underused, and one of the highest-value features for parental engagement.
Safeguarding is a real requirement, not a checkbox
  • Web filtering is a legal requirement in many jurisdictions (CIPA in the US, KCSIE expectations in England). Chrome's URL blocklist alone is usually not sufficient — most schools pair it with a dedicated filtering/monitoring provider.
  • Filtering must follow the device home on 1:1 programmes, not just apply on the school network.
  • Monitoring tools that flag concerning search or document content are separate products from filtering — know which obligation each one satisfies.
  • Document who reviews alerts and how quickly. An unmonitored monitoring system is worse than none, because it implies assurance that doesn't exist.
Where What you'd do there Notes
Directory → UsersCreate, suspend, move, and reset accounts.Bulk operations via CSV or the Admin SDK. Suspend rather than delete when a student leaves mid-year — deletion destroys their Drive content.
Directory → Organisational UnitsThe policy hierarchy for both users and devices.Policy inherits downward and can be overridden per OU. Design this deliberately.
Devices → Chrome → DevicesDevice inventory, OU assignment, deprovisioning, and enrollment status.Deprovisioning releases the device but the Chrome Education Upgrade licence does not return to the pool.
Devices → Chrome → SettingsUser, device, and Managed Guest Session policies — sign-in restrictions, apps, URLs, power, updates.Note the distinction: user settings follow the person to any device; device settings apply to that hardware regardless of who signs in.
Devices → Mobile & endpointsBasic or advanced management for iOS/Android devices.Adequate for BYOD account protection; not a substitute for a real MDM on managed tablets.
Apps → Google WorkspaceTurn individual services on or off per OU.Typically restrict Gmail external mail for younger years, and disable services not in use.
Security → Authentication2FA enforcement, password policy, session controls.Enforce 2FA on all staff and admin accounts. Non-negotiable for accounts with access to student data.
Reporting → Audit & investigationLogin, Drive, admin, and device logs.The investigation tool at Standard/Plus is materially better than raw log export when handling an incident.

Gotchas

AUE dates will end your device's life on a fixed schedule
  • Every Chromebook model has an Auto Update Expiration date. After it, no OS updates and no security patches — the device becomes a compliance problem, not just an old laptop.
  • Check the AUE before purchase, including on refurbished stock where it's often close.
  • Build a replacement cycle around AUE dates, and record them in your asset inventory.
  • Google publishes the full model list; treat it as a procurement input, not an afterthought.
Chrome Education Upgrade licences are device-bound and non-transferable
  • The licence attaches to the specific Chromebook permanently. Deprovisioning does not return it to your pool for reuse on new hardware.
  • Budget accordingly: replacement devices need new licences, not recycled ones.
  • This surprises schools that assumed a per-seat model. Confirm current terms with your reseller before a large purchase.
Storage is pooled, and student leavers matter
  • Education editions provide a pooled storage allowance across the institution rather than unlimited per user.
  • Graduating cohorts left suspended-but-not-deleted continue consuming pooled storage indefinitely.
  • Establish a documented leaver policy: suspend, retain for a defined period, export if required, then delete.
  • Check the storage report before it becomes urgent — running out affects every user at once.
Student data carries specific legal obligations
  • FERPA (US) governs education records; COPPA applies to under-13s; CIPA ties filtering to federal funding. In the UK/EU, UK GDPR and the DPA apply with children treated as a vulnerable group.
  • Third-party apps and extensions added to student accounts may process student data — vet them and record the assessment.
  • Parental consent requirements differ by jurisdiction and age. Get this reviewed by someone qualified rather than assuming.
  • This page is a technical reference, not legal advice — involve your DPO or legal counsel for the compliance position.

Resources

Chrome device management Enrollment, policies, Managed Guest Sessions, and kiosk configuration. support.google.com Auto Update Expiration list AUE date for every Chromebook model — check before any purchase. support.google.com Education editions comparison Feature and pricing differences across Fundamentals, Standard, and Plus. edu.google.com Google Classroom help Teacher and admin guides, including guardian summaries and roster sync. support.google.com Admin SDK Automate user provisioning, OU moves, and device operations at scale. developers.google.com MDM for Education Cross-vendor education guide — Apple School Manager, shared iPad, and compliance. build.ty1er.com

Editions, storage allowances, and licence terms change — confirm current details with Google or your reseller. Compliance references are informational only, not legal advice. See MDM for Education for the Apple and cross-platform side.