Overview

 

itopia Labs Roster Sync allows you to automatically assign existing groups of students to your Classes, saving you the time of manually adding students into a new system and making sure that every class list stays synced.

If you currently use Google Workspace, Microsoft Azure, or ClassLink, you’ll be able to quickly transfer your class rosters into CloudApps Classroom (CAC). CAC will also periodically connect to your rostering platform and update the students and/or instructors assigned to your Classes.

Once you’ve integrated, the platform will sync once a day between 8PM and 10PM Eastern time (UTC-5) by default. You can force a sync for a specific Class from the Class's Settings view in the CAC Admin Portal.

 

✅ Tip We are regularly adding new platforms to Roster Sync, so let us know if you don't see your preferred platform!

The roster sync configuration is different for every platform, but the CAC Admin Portal walks you through every step. You can also find more info on each platform below.

 

In this article, we'll review:

• Starting your roster sync
• Syncing with Google Workspace
• Syncing with Microsoft Azure
• Syncing with ClassLink

 

Start your roster sync

 

1.  From the District tab of your dashboard, locate the ⚙️Configuration tile.   

2.  In the Roster Sync Integration section, click Configure. Then, select the platform you'll be syncing:

• Google Workspace
• Microsoft Azure
• ClassLink

 

Follow the steps for your preferred platform below!

 

Sync with Google Workspace

 

Roster Sync for Google Workspace lets you connect your CAC Labs to Google Groups or Google Classrooms. You can choose how to assign students and instructors to each Class using G Suite Groups or Google Classrooms. 

Log in to your Workspace organization as a user with the Super Admin role, select Google Workspace from the configuration options, then follow the prompts in CAC to complete the configuration.  

 

Step 1: Configure domain-wide delegation

 

To enable Roster Sync for Google Workspace, you’ll first need to configure domain-wide delegation in your Workspace organization. This allows the itopia CloudApps service account to access membership and rosters from your Google Workspace directory.

Domain-wide delegation allows a specific service account to authenticate in your organization and have specific scopes of access throughout your Google Workspace environment. For more information on scopes, refer to Google's documentation on OAuth 2.0 scopes.

 

When you configure Roster Sync in the Labs Admin Portal, Labs prepares a dedicated service account for your District and provides you with detailed instruction on enabling domain-wide delegation in your environment.

 

The OAuth 2.0 scopes required by itopia Labs are:

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.groupMember.readonly
https://www.googleapis.com/auth/classroom.courses.readonly
https://www.googleapis.com/auth/classroom.rosters.readonly
https://www.googleapis.com/auth/classroom.profile.emails

 

Click Save when you've completed all necessary fields. 

 

Step 2: Apply a Google security group to a Lab

 

Once the Google Classroom rostering integration is complete, you can select a Google Classroom or Google Workspace security group when creating a new Lab.

Just type the name of the group or classroom when creating a new Class. CAC will search your Google Workspace tenant for the groups or classrooms and will roster the labs accordingly.

 

 

Sync with Microsoft Azure

 

Roster Sync for Microsoft Azure lets you connect your CAC Class assignments to Azure groups, including unified groups, security groups, and distribution groups. 

To enable Roster Sync for Microsoft Azure, you’ll need to authorize the Labs service account to access your Azure domain using the Microsoft Graph API. For more information on the Graph API, refer to Microsoft's documentation.

 

When you enable Roster Sync for Microsoft, Labs will allow you to choose how to assign students and instructors to each Class: Azure Group or Direct Assignment. If you choose Azure Group, you can begin typing the name of a group. Labs will search your Azure domain and provide you with auto-fill options.

When you configure Roster Sync in the Labs Admin Portal, Labs provides an automated process for requesting the necessary permissions and allowing you to grant access. You will need to sign in to your Azure domain as an account with global administrator permissions in order to grant access on behalf of your organization.

 

The Graph access scopes required by itopia Labs are:

User.Read.All
Group.Read.All
GroupMember.Read.All

 

Limitations of Roster Sync with Microsoft Azure

 

Microsoft Azure groups include a setting called hide group membership. This setting prevents enumerating the members of the group by non-administrators or external service accounts such as that used by itopia Labs. As such, Labs is unable to sync Class assignment to Azure groups that have been configured with the hide group membership setting enabled.

The hide group membership setting is not visible in the Azure web console; you must use the Azure Shell or other API access to check the configuration of this setting. Microsoft does not provide explicit documentation of this setting; however, the setting is discussed briefly in the New-UnifiedGroup cmdlet documentation.

 

Sync with ClassLink

 

CloudApps Classroom supports both single sign-on (SSO) and Roster Sync with ClassLink. You can configure CloudApps Roster Sync to automatically assign students to specific CloudApps classes, and students can easily access their CloudApps sessions from their ClassLink LaunchPad.

CloudApps uses the ClassLink REST API to retrieve the latest rostering data directly from your Roster Server. CloudApps automatically refreshes this data daily, or you can perform a manual sync in a specific CloudApps Class to refresh the data immediately.

 

Step 1: Configure Roster Server Permissions in ClassLink

 

First, you'll need to add the CloudApps app to your ClassLink Roster Server and grant the necessary permissions. Detailed documentation is available from ClassLink here.

 

1.  Access your ClassLink LaunchPad with an administrator account

2.  From the LaunchPad, open your Roster Server.

3.  On the Roster Server navigation bar, select Apps → Add App.

4.  Search for itopia CloudApps → click the + Add button for the app when it appears.

5.  Once it's added, open the itopia CloudApps app and specify the permissions you wish to grant:

• CloudApps only needs permissions to the students, teachers, and other users you plan to assign using Roster Sync.
• You can also select the Course or Classes that contain the students and teachers. ClassLink will automatically grant permission to the users enrolled in those classes.

 

Step 2: Enable Roster Sync in CloudApps

 

In order to assign your students to CloudApps Classes using their ClassLink identities, you'll need to configure Roster Sync in CloudApps to connect to your ClassLink organization.

 

1.  Log into the CloudApps Admin Portal as a user with Editor or Owner permissions for your CloudApps District.

2.  Navigate to the District Dashboard: open the navigator (in the top-center of the screen), select the correct District from the drop-down menu (if you have access to more than one District), and click Manage District

3.  In the Configuration card, click Configure under Roster Sync Integration.

4.  In the Roster Sync wizard, select ClassLink → click Next.

5.  If you have already completed Step 1 in this article, you can simply click the Sign In With ClassLink button and sign into the popup window as a ClassLink administrator.

6.  Once you've signed in, CloudApps will read some information from your ClassLink account and display it for validation. If everything looks correct, click Save.

 

Step 3: Publish CloudApps in ClassLink

 

Once you've configured the necessary access in the previous steps, you can publish the itopia CloudApps app for your students and teachers. The CloudApps app will automatically sign users into the CloudApps User Portal, where they can launch their CloudApps sessions for their assigned classes. Detailed documentation from ClassLink is available here.

Teachers and administrators will still need to sign in to the CloudApps Admin Portal using a Google or Microsoft account.

 

1.  Access your ClassLink LaunchPad with an administrator account.

2.  Launch your ClassLink Management Console (CMC) app.

3.  In the Management Console navigation, expand Applications → click Add & Assign Apps.

4.  Search the App Library for itopia CloudApps. When it appears, click Add.

5.  Assign the application to your desired profile or group → click Save.

6.  You can repeat steps 3-5 to publish the itopia CloudApps Admin Portal app for your teachers and administrators.

 

Your assigned users will now be able to launch CloudApps and will be automatically signed into the User Portal.

 

Assign Users to Classes in CloudApps

 

After completing the steps above, you'll be able to use Roster Sync to assign ClassLink users, groups, classes, or courses to Classes in CloudApps. Once Roster Sync has been configured, you'll see the ClassLink interface in the New Class wizard, allowing you to select one or more ClassLink items to which the Class can be assigned:

 

Once you've created the Class, you'll see your ClassLink students listed in the Class Roster.

Roster Sync periodically updates the roster data from your Roster Server, but you can trigger a manual sync using the Sync Now button.