ChromeOS Onboarding: Part 2 - Google Apps for Education Admin Console

With Part 1 completed, you can now move on to the Google Admin Console to set up API controls and delegation. Follow the steps below to continue:

Part 2: Google Apps for Education Admin Console

1. Login to Google Workspace Admin Console:
   • Visit Google Workspace Admin Console.

Organizational Units Setup (Best Practice):

• Ensure all your organizational units are set up accordingly.
• Place all students and devices in their respective OUs (e.g., Top level OU > Students OU > Grade).
• Refer to this guide for details on setting up an organizational unit.

2. Navigate to API Controls:
   • In the Google Workspace Admin console, go to Security > Access and data control.
   • From the drop-down list, select API Controls.

3. Manage Domain-Wide Delegation:
   • Scroll to the bottom and click on Manage Domain-Wide Delegation.

4. Add New API Client:

• • In the API clients list, click Add New.
  • Paste the Client ID from Part 1 of the onboarding guide in the Client ID field.

5. Copy and paste the following scopes into the OAuth scopes field (ensure to copy the entire string below): 

• The scopes can be found on the school dashboard by going to, Settings >> ChromeBook Settings

• API Scopes for Device and User Sync:

https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.device.chromeos,https://www.googleapis.com/auth/admin.directory.device.mobile.action

• Additional API Scopes for Roster Sync:

#Note: The below API Scopes should only be added if you are using edMesh Classroom Management Tools for Teachers.

https://www.googleapis.com/auth/classroom.rosters.readonly, https://www.googleapis.com/auth/classroom.courses.readonly, https://www.googleapis.com/auth/classroom.profile.emails, https://www.googleapis.com/auth/classroom.profile.photos

• Once entered, click Authorise.

6. Verify API Client:
   • You should now see the API client in the list.

7. Enable Classroom API (if applicable):
   • If you added the roster sync scopes, enable the Classroom API in the Google Developer Console.
   • Log in as a Super Admin user at Google Cloud Console.
   • Select the project created in Part 1 (e.g., edMesh High).
   • Search for "Classroom" in the search field, select Google Classroom API, and click Enable.

Great job on completing Part 2! 

Now move on to Part 3. You're halfway there - keep it up!

Don't hesitate to reach out.
We're here to help!