A proposal to deploy a fully managed, content-filtered, and educationally enriched device environment across Acton's Chromebook and Windows laptop fleet — at zero ongoing cost.
What the board is approving and why it matters for this school.
Acton is not blocked waiting — Phase 2 can begin immediately, before EDU approval.
Both platforms are compliant by default under their EDU terms — Acton does not need to negotiate separately.
Who owns what — and the continuity risk the board needs to plan for.
| Role | Responsibilities | Time Commitment |
|---|---|---|
IT Lead 1 person required |
| 2–3 hrs/week rollout ~30 min/week ongoing |
Principal / Admin |
| ~1 hr/term |
Teachers |
| Ad hoc as needed |
All three platforms provide free, self-paced training — no external IT contractor needed.
Full implementation guide for deploying managed, content-filtered devices across the Chromebook and Windows laptop fleet. Every tool is free for verified schools.
Two device types, two free management platforms, one shared filtering layer.
Six tools. Zero cost. Covers every layer from identity to endpoint to network.
● Windows Defender (built-in, free) managed via Intune · No Apple devices in scope — Mosyle not required
12 weeks from first application to fully managed, policy-enforced fleet.
Verification is the critical path — start immediately. Audit every device while you wait.
Deploy on-campus filtering now — no EDU approval needed. Every device on school Wi-Fi is protected immediately.
Once EDU accounts are approved, enroll every device and push restriction profiles.
Issue school identities to every student and push the approved app set — including the full free-thinking toolkit.
Go live, train staff, and establish the lightweight process that keeps everything working term after term.
What is allowed, blocked, and managed — and which free tool enforces each rule.
| Category | Enforced By | Chromebooks | Windows | Staff |
|---|---|---|---|---|
| Google Classroom / Meet / Drive | Google Admin Consolefree EDU account | Allowed | Allowed | Allowed |
| Microsoft 365 Web Apps | Intune / browser policyfree M365 A1 | Allowed | Allowed | Allowed |
| Free Thinking Toolkit Tools | Cloudflare allowlistmanually whitelisted — see Tab 03 | Allowed | Allowed | Allowed |
| YouTube (EDU channels only) | YouTube Restricted ModeAdmin Console policy | Restricted | Restricted | Allowed |
| Social Media | Cloudflare category block | Blocked | Blocked | Blocked |
| Gaming & Streaming | Cloudflare category block | Blocked | Blocked | Blocked |
| VPN / Proxy Bypass Tools | Cloudflare + MDM policy | Blocked | Blocked | Blocked |
| Chrome Extensions | Admin Console / browser policy | Allowlist | Allowlist | Managed |
| App Installs (Desktop / Store) | Intune App Control | N/A · web only | Blocked | IT Approved |
| Incognito / InPrivate Mode | Browser managed policy | Blocked | Blocked | Managed |
| USB / External Storage | Intune / Admin Console | Blocked | Blocked | Managed |
| Personal Google / MS Accounts | MDM + browser managed policy | Blocked | Blocked | Managed |
| Developer Mode (ChromeOS) | Admin Console device policy | Blocked | N/A | Blocked |
Known failure points and their free mitigations.
Everything that must be confirmed before opening to students.
A curated set of free platforms chosen specifically to encourage inquiry, creativity, self-direction, and open exploration — not passive content consumption. Every tool is whitelisted in the IT plan and pushed to student devices as managed bookmarks.
The tools are only half the story. The philosophy determines how they're used.
Tools that teach students to construct, challenge, and evaluate ideas — not just accept them.
Platforms where the student controls the pace, depth, and direction of their own learning.
Platforms where students produce — writing, music, design, video — not just consume.
Build real things. Break them. Figure out why. Repeat.
Teach students to go to the source — to read the original, not a summary of a summary.
Add these to your DNS allowlist to ensure the toolkit isn't accidentally blocked by category filters.
| Domain | Tool | Block Risk | Action |
|---|---|---|---|
| youtube.com | TED-Ed, Khan Academy, Crash Course | High — blocked by "Streaming" category | Allow + Restrict Mode |
| archive.org | Internet Archive | High — frequently caught by content filters | Explicitly Allow |
| wikipedia.org | Wikipedia | Medium — user-generated content category | Explicitly Allow |
| kialo-edu.com | Kialo Edu | Medium — debate / social platform | Explicitly Allow |
| khanacademy.org | Khan Academy | Low — well-known EDU domain | Verify Accessible |
| scratch.mit.edu | Scratch | Low — MIT domain | Verify Accessible |
| phet.colorado.edu | PhET Simulations | Low — university domain | Verify Accessible |
| tinkercad.com | Tinkercad | Low — Autodesk domain | Verify Accessible |
| coursera.org | Coursera | Low — known EDU platform | Verify Accessible |
| gutenberg.org | Project Gutenberg | Low | Verify Accessible |
| artsandculture.google.com | Google Arts & Culture | Low — Google subdomain | Verify Accessible |
| musiclab.chromeexperiments.com | Chrome Music Lab | Low | Verify Accessible |
| ocw.mit.edu | MIT OpenCourseWare | Low — MIT domain | Verify Accessible |
| geogebra.org | GeoGebra | Low | Verify Accessible |
| si.edu | Smithsonian Open Access | Low — government domain | Verify Accessible |
| images.nasa.gov | NASA Library | Low — government domain | Verify Accessible |
Governing the use of Acton-issued devices, Acton accounts, and the Acton network — including data privacy and COPPA consent for students under 18.
Acton-issued devices and accounts are provided to support learning. This policy exists to protect students, staff, and Acton School — not to restrict curiosity or punish honest mistakes. Students are expected to use technology as a tool for discovery, creation, and communication. This document explains what that means in practice, what data Acton collects, and what rights students and parents hold.
By signing below, the student and parent/guardian confirm that they have read and understood this Acceptable Use Policy, consent to the creation and use of a school-issued Google Workspace account for the student named, acknowledge the data privacy provisions of Section 5 including the COPPA school official consent for students under 13, and agree to the terms of use outlined in this document.