# Managed student devices: no ClassGuard portal

Managed student mode connects an IT-deployed Chrome extension to the student's primary school Google Chrome profile. Students do not open a ClassGuard dashboard, enter a setup code, choose an account or approve a ClassGuard sign-in prompt. Staff keep their separate dashboard and school sign-in.

## One-time IT setup

1. Configure the school backend behind HTTPS and import the active student roster. Use Google directory sync, or an IT-approved mapping from each verified Google subject ID to its existing ClassGuard student record. Email alone does not enroll a device.
2. Configure the Google provider using `npm run configure:sso`. Register the school's `/api/sso/callback/google` address, approve the school Workspace hosted domains, enable students, and list the installed extension's stable ID. See [school SSO](sso-setup.md). The public classguard.org product website is separate from the school backend.
3. In Google Workspace administration, approve the OAuth application and arrange managed school Chrome sign-in. The primary Chrome account must also be available to Google's silent sign-in flow. Forced extension installation alone does not supply OAuth consent or create a signed-in Google session. If silent authorization requires interaction, ClassGuard records **IT setup required** and retries without opening a student prompt or enrolling a guessed account. Have IT verify this on a real managed Chromebook before rollout.
4. Force-install the approved extension for the student organizational unit using a supported Chrome distribution channel. Keep staff profiles in a separate configuration. This package does not create a Chrome Web Store listing or enroll a browser into Chrome management.
5. Apply the settings in `classguard/managed-student-policy.example.json`, replacing the sample school address with the real backend. These are extension managed-storage values, not a complete Google Admin policy export. Set `ManagedStudentMode: true`, `SchoolSSOProvider: "google"`, `SchoolServerURL`, and the intended school filtering rules. Use the normal example for website policy fields. IT can explicitly disable automatic screenshots with `AutomaticBrowserViewing: false`.
6. Assign saved classrooms to teachers. Restart the student browser/extension and test that the right student connects without opening a ClassGuard page. Start a teacher-authorized class and check the visible viewing notice, then end the class and verify screenshot updates stop.

## What students see

There is no normal extension popup, setup form, account chooser or student dashboard. If someone explicitly opens an extension settings address, it shows only the classroom connection status. The classroom viewing notice and extension viewing badge remain visible while an authorized class is active. This mode does not capture the desktop, camera or audio, and it does not start a class automatically.

## Identity and recovery

Chrome's primary profile ID is a routing hint, not proof of identity. The school service validates Google's signed ID token, Workspace domain, audience, nonce and expiry, and requires the signed subject to match that primary profile ID before issuing an enrollment session. The extension rechecks the profile after sign-in and before/after capture. Switching or signing out of the primary account invalidates the association; manual codes, another provider and the older Google enrollment session cannot be used as fallback in this mode.

The enrollment credential and bound profile ID stay in Chrome session storage. Credentials expire within one hour and renew silently when possible. A server restart requires reconnection. Missing account, consent, roster match, school connection or domain approval is an IT setup problem; students are not redirected to a login portal. Staff can inspect the existing extension status with `schoolEnrollmentStatus`; it contains no enrollment credential or student email. Normal school filtering remains active while identity setup needs attention; no classroom screenshot is uploaded without a verified enrolled account and authorized class.

This automatic primary-profile mode currently supports **Google Workspace in managed Chrome/ChromeOS**. Microsoft Entra ID, Clever and ClassLink SSO remain available through their separate sign-in flows; the extension does not claim to read their OS/browser identities silently. The feature has automated signed-identity and browser mocks; school OAuth approval, force installation and real-device silent sign-in still need a district pilot.

References: [Chrome primary profile identity and silent auth](https://developer.chrome.com/docs/extensions/reference/api/identity), [Google OpenID Connect and login hints](https://developers.google.com/identity/openid-connect/openid-connect).