- Google change on Manifest Version 3 (MV3)
- What does this mean for GAT Shield and Teacher Assist customers?
- Shield requirement
- Step 1 -Install the extension
- 1. Open Google Admin Console -> Chrome Browser -> Apps & Extensions
- 2. Select the desired Organizational Unit
- 3. Click on '+' button and select option 'Add the Chrome App or extension by id'
- 4. Select 'From a custom URL' and fill in the Extension ID and URL
- 5. "Select 'Force install' for the 'Installation policy' option.
- 6. Fill up 'Policy for extensions'
- 7. Click 'Save' in the top right corner.
- View extension ID and URL
- Allow Teacher Assist Extension through Firewall
- Result for Teacher Assist Manifest Version 3 (MV3)
- Recommended Admin settings
Google change on Manifest Version 3 (MV3) #
All Chrome-based browsers are affected by changing the extension standard called Manifest Version 2 (MV2) to one called Manifest Version 3 (MV3). Those changes are major architectural changes that Google (creator of Chrome Browser) says will improve performance and security.
GAT Labs has been preparing for these changes for the last 2 years. This change is mandatory and will affect nearly all extensions deeply integrated with Chrome, including Shield.
Please migrate before the 1st of July 2024 to ensure your domain will be up-to-date with Chrome updates.
In this document, we will cover the steps to install the Teacher Assist extension. It’s a tool that allows Google Classroom teachers to view and control their students within the classroom environment via the Chrome Extension for your Google Workspace environment.
What does this mean for GAT Shield and Teacher Assist customers? #
Firstly, this is unavoidable; you will have to deploy a new version of GAT Shield and Teacher Assist.
We are making this process seamless and providing a migration tool to help you move any configuration you may have in your existing GAT Shield to the new GAT Shield and Teacher Assist.
Shield requirement #
GAT Shield is a prerequisite extension that must be installed alongside Teacher Assist.
Teacher Assist is a Chrome extension that the Super Admin of the domain must install via the Google Admin console.
Below, we will cover how to deploy the Teacher Assist extension to your users.
Important: Teacher Assist – can be installed only for specific Organization Units – such as Students OU
Step 1 –Install the extension #
1. Open Google Admin Console -> Chrome Browser -> Apps & Extensions #
You can also click here to open that page.
2. Select the desired Organizational Unit #
3. Click on ‘+’ button and select option ‘Add the Chrome App or extension by id’ #
4. Select ‘From a custom URL’ and fill in the Extension ID and URL #
Copy values for the extension that you are installing – from Teacher Assist!
When the ID and URLs are added, click on the “Save” button
5. “Select ‘Force install’ for the ‘Installation policy’ option. #
When the Extension is saved, select the ‘Force install’ policy to force installation in the browser. You may also tweak other settings for your needs.
6. Fill up ‘Policy for extensions’ #
Copy values for the extension that you are installing, in this case, Teacher Assist
7. Click ‘Save’ in the top right corner. #
View extension ID and URL #
To access and view the Extension ID and URL, navigate to Teacher Assist > Admin > Extension deployment
Copy the ID, URL, and Policy for an extension from here and use them above.
Allow Teacher Assist Extension through Firewall #
Note: Depending on your firewall setup, there might be restrictions that do not allow traffic to Teacher Assist.
Please check your Firewall settings and allow the following URLs:
To install the extension, you need to whitelist the following domain: https://extension.gattool.com
Additionally, need to whitelist domains based on region.
For US (Global) domains (no prefix) – US (default) region
- wss://shield.generalaudittool.com
- stun:turn.generalaudittool.com:3478
- turn:turn.generalaudittool.com:3478
- stun:stun.l.google.com:19302
- stun:stun1.l.google.com:19302
- stun:stun2.l.google.com:19302
- stun:stun3.l.google.com:19302
- stun:stun4.l.google.com:19302
For EU domains (eu- prefix) – EU region
- wss://eu-shield.generalaudittool.com
- stun:turn.generalaudittool.com:3478
- turn:turn.generalaudittool.com:3478
- stun:stun.l.google.com:19302
- stun:stun1.l.google.com:19302
- stun:stun2.l.google.com:19302
- stun:stun3.l.google.com:19302
- stun:stun4.l.google.com:19302
For UK domains (uk- prefix) – UK region
- wss://uk-shield.generalaudittool.com
- stun:turn.generalaudittool.com:3478
- turn:turn.generalaudittool.com:3478
- stun:stun.l.google.com:19302
- stun:stun1.l.google.com:19302
- stun:stun2.l.google.com:19302
- stun:stun3.l.google.com:19302
- stun:stun4.l.google.com:19302
Result for Teacher Assist Manifest Version 3 (MV3) #
When the Teacher Assist extension is deployed, the end-users must be logged into a Google Chrome browser with School/Domain accounts.
The extension will appear under their Chrome extensions list.
Finally, the Students’ activity will be displayed for the Teachers to see in the Google Classroom sessions
Recommended Admin settings #
We recommend enabling settings in the Google Admin console for the domain to prevent Users (students) from interfering with the Teacher Assist extension and any extensions.
Enable these settings in Devices > Chrome > Settings > Users & browsers settings
Some of these settings are mandatory.
Apps and extensions #
On the above-selected page, scroll down and navigate to the Apps and Extensions area, find the Task Manager settings, and switch it to Block users from ending processes with the Chrome Task Manager.
Description: Task Manager can be used to tamper with the Chrome browser’s normal operations.
User experience #
The following settings are highly recommended for schools using enrolled Chromebooks.
These settings prevent students from bypassing the network firewall and installing Android apps like VPNs and other web browsers on their Chromebooks.
- Multiple Sign-in access – Block multiple sign-in access for users in this organization
- Sign in to secondary accounts – Block users from signing in to or out of secondary Google accounts
On the same page, scroll down to User Experience > Multiple sign-in access and Sign in to secondary accounts
Scroll up on the same page to the User experience > Developer tools.
In “Configuration“, set the option to “Not Allow”.
- Developer tools availability – never allow use of built-in developer tools
- Extensions page developer mode – Do not allow use of developer tools on the extensions page
Description: Developer tools can be used to disable extensions. Google also recommends disabling these tools in most cases. This can be disabled for Student OUs only.
Security #
The following three options are recommended for schools with enrolled Chromebooks. These settings prevent students from bypassing or tampering with the GAT Shield and Teacher Assist extension
Scroll to the Security tab
Find and apply the settings
- Incognito Mode – Disallow Incognito mode.
- Description: In the incognito mode, the extensions do not work
- Browser history – Always save browser history.
- Description: Saving browser history is recommended so that when incidents occur, there is an audit trail that staff members can investigate
- Clear Browser History – Do not allow clearing history in the settings menu.
- Description: The ability to clear browser history on the Chrome Browser may allow users to tamper with GAT Shield Browser reporting features.
Content #
Scroll down further to the Content tab
- Screenshot – set it to Allow users to take screenshots and video recordings
Description: Disabling screenshots will cause problems with the GAT Shield Alerting functionality.
Save settings #
When all the settings are adjusted and set up, click on the blue Save button on the bottom left.
Configure Device Settings #
We recommend that these options be configured on your domain for your Chrome devices. Not all are mandatory.
From the Google Admin console, navigate to Devices > Chrome > Settings > Device settings
In the left sidebar, select the Organizational Unit that contains your Chromebooks, then configure the following policies to match these values..
Enrollment and access #
In the Enrolment and access setting, configure the settings
- Forced re-enrolment – Force device to automatically re-enroll after wiping
- Verified access – Enable for content protection
- Verified mode – Set to require verified mode boot for verified access
Sign-in settings #
On the same page, scroll down to Sign-in settings
- Guest mode – Disable guest mode
- Sign-in restrictions – Restrict sign-in to a list of users
- Add an allowed list – you must enter your domain
Teacher Assist is deployed to all students, but only ChromeOS devices are seen #
It could be a case where Teacher Assist is deployed domain-wide to all users, and yet the data is only shown on ChromeOS devices. You can check this setting.
Adjust the settings for Chrome management for signed-in users
Navigate to Devices > Chrome > Settings > Users and browsers settings > Chrome management for signed-in users
Set it up to: Apply all user policies when users sign in to Chrome, and provide a managed Chrome experience.
Google’s management and configuration for Chrome activity #
Referring to: Manage user profiles on Chrome browser, and View and configure apps and extensions
When the Teacher Assist extension is installed, every student who logs into their Chrome Browser with their School credentials will have the extension automatically synchronized.
The Chrome user cannot override this setting.
