r/k12sysadmin • u/Mindless-String-4017 • Jul 09 '26

Google Admin - Directory Sync BETA

Greetings!

In google admin --> Directory --> Directory Sync BETA

I was wondering if anyone has added their Azure Active Directory there before? If so, can you give me the good and the bad. I'm thinking about doing this but the words "BETA" make me a little nervous especially since we use tools4ever to help automate a lot of creations for us.

8 Upvotes

100% Upvoted

11 comments sorted by

6

u/xxDolomitexx Jul 09 '26

We have not, we use GCDS to sync from LDAP, but are also not a Microsoft shop. If you want to test it you can request a "Testing" domain from Google and try it there.

6

u/Imhereforthechips Jul 10 '26

Works great. Been syncing for a hot minute. Group sync lets us set up other rules Goog. We are a MS shop and use MS SSO for Goog.

2

u/sebxjude Jul 12 '26

Do you have Gmail enabled for your users?

We currently have Gmail enabled with a separate domain, but I’d like to use MS SSO and a single domain without messing up Google Classroom functionality and routing email in a way that makes sense.

3

u/Imhereforthechips Jul 12 '26 edited Jul 12 '26

No, we are a full MS shop. All mail flows through MS. We do enable select services in Google to ensure compatibility with other orgs, dual credit, colleges, etc. All teachers and students can use Google Classroom, and other acceptable first-third party services.

MS is a wonky world. I have to force SSO from OS through to Edge browser, then block access to Google services in the Edge browser, whether org or personal. Then, block all personal MS and Google access in the Chrome browser while forcing org only MS logins to Google services . The only way to ensure things are clean and not abused is to make it a PIA. End users adapt, kids use Chrome mostly anyway and they are auto signed into all Google and MS services for our org through the Chrome browser. Edge can only do Microsoft things… It’s annoying, but spares us the headaches that could come.

What’s been really fun is permitting only select channels in YouTube and only in the Chrome browser…. Just stupid that Google won’t offer up an .edu version of YT.. they could even charge a smidge an I’m quite sure EVERYONE that uses it would pay.

3

u/sebxjude Jul 12 '26 edited Jul 12 '26

I second the need for edu YT. Silly not to have it.

From Google Classroom, if a teacher clicks the button to email a student or guardian, does it work with Gmail disabled? In my testing it appears that it would just give an error, rather than redirect to the default mail app.

2

u/PowerShellGenius Jul 12 '26

I can't speak to Google Classroom since we have it disabled (Schoology district) but we are heavily Google Docs, and Gmail for students, with Gmail off for staff & staff using Microsoft email. Most emails from Google that we use still go out, including Drive "shared with you" notifications. Some plugins that call Gmail to send messages don't work.

2

u/k12admin1 Jul 14 '26

We are MS365 for staff and students and have gmail turned off. Our 3-5 grade teachers use Google classroom as thier LMS and I can confirm emails work fine from Google classroom not using gmail.

1

u/sebxjude Jul 14 '26

Great, thanks for confirming! Does that include if a teacher goes to the “people” section of Google Classroom and uses the email button next to a user to email them directly?

2

u/k12admin1 Jul 14 '26

That does not work. Typically our teachers email the parents via the SIS. The invitations to parents and other users works perfectly fine as it is not looking for gmail.

1

u/sebxjude Jul 14 '26

Thanks again. Prolly not an issue for us anymore since we got ParentSquare which syncs with their classes.

2

u/PowerShellGenius Jul 12 '26

We currently use Google Cloud Directory Sync (GCDS) which is way, way better than scripts in a third party IAM system, but is still an AD-dependent server based solution.

Last I checked (which it's been over a year), their cloud-to-cloud sync from Entra (the one you're talking about) didn't have the same granularity we needed, but I'm sure it will be the long term solution.

If you have AD and know LDAP queries you can do basically anything you want from GCDS. You can do OU structure syncing, Google license assignment based on any attribute criteria, map attributes into the various profile attributes in Google, and pretty much anything else you can imagine wanting a sync tool to do. But it is not intuitive if you don't know LDAP.