Answering the 27 tender requirements: how it is done in the console

Simplified Authentication (SSO)

The console supports OIDC single sign-on against the identity system the ministry or the school already uses (Microsoft Entra ID, Google Workspace or another OIDC provider), alongside local accounts.

1. Left menu → System management → Single sign-on (visible only to the Administrator role).
2. Click Copy next to Redirect URI and register that address in the identity provider's application.
3. Fill in Issuer URL, Client ID and Client secret; optionally Allowed email domains and Username claim.
4. Click Test connection; when “Connection OK — provider configuration was read” appears, tick Enable and click Save.
5. Sign out and check that the sign-in page shows the Sign in with school account button.

Notes and limitations: OIDC / OAuth2 is supported. There is no SAML 2.0 connector and no direct connection to LDAP or Active Directory: an LDAP directory must be published through an OIDC provider (Entra ID, for example). Administrators always keep local-account access, so an outage at the identity provider never locks a school out of its own console.

Kiosk Mode / Child-Friendly Interface

The tablet stays in Kiosk mode on a single application or a small set of applications, with its own launcher; leaving it requires the password the school sets. For young students, turn on Kids mode: the multi-app desktop switches to big icons, sections (Learn, Read, Create, Tools), a name badge and a larger Raise hand button, with three looks by grade; locking and exit rules stay the same.

1. Left menu → Policy management → New policy, and type a name.
2. Under the Apps group turn on Kiosk mode (appKiosk), choose Single app, and tick that application in the Choose applications dialog.
3. How Kiosk is left depends on Show the exit-Kiosk button (showQuitKey), which is on by default (leaving it out of the policy means on). When it is on: in single-app mode, if a student presses Back or Home to leave the locked app, the tablet shows the exit-password box — Cancel, or 30 seconds without input, returns to the app; only the correct password leaves Kiosk. On the multi-app desktop, Exit is in the top-right menu and also asks for the password. When it is off: no password box appears, single-app mode goes straight back to the app, and the multi-app menu has no Exit.
4. Select the device groups and click Save and push.
5. For a young-student interface: in "Kiosk mode (appKiosk)" choose "Multi-app home screen", then turn on "Kids mode (big icons, sections, name badge; look by grade) (kioskChildMode)" and pick the grade; a preview of the tablet appears below. The name badge comes from the student roster.
6. Set the exit password under Left menu → Device groups → Edit → Kiosk exit password; one password per group, checked by the server. Five wrong entries on the same tablet lock it for 10 minutes; if the group has no password, no password can leave Kiosk. To end Kiosk for good, revoke the policy in the console.

Notes and limitations: Kids mode requires tablet client 4.2.4.2 or later and applies only to the multi-app desktop. The exit-password box on Back in single-app mode requires tablet client 4.2.5.1 or later.

Complete hiding of OS / settings / browser / app store

Android settings, browsers and app stores are hidden from the student's desktop and can no longer be reached from the status bar.

1. Left menu → Policy management → New policy. Policy items are listed in groups by purpose; turning a switch on adds that item to the policy.
2. Under the Apps group turn on Hide system apps (browsers, app stores) (hideSystemApps) and tick the Browsers and App stores categories; use Choose applications to name a specific app.
3. In the "Screen and display" group, turn on "Block the pull-down status bar (disableDropDownStatusBar)"; in the "Apps" group, turn on "Kiosk hardening (power menu, recents, status bar and Settings entry) (kioskHardening)" and keep "Disable status bar" and "Immersive full screen" on in its form.
4. Add Block installs from unknown sources (disableUnknownSources) and Block installing apps (disallowInstallApps).
5. Select the device groups and click Save and push.

Notes and limitations: Hide system apps and Kiosk hardening require tablet client 4.1.3.8 or later. If any device in the group runs an older version, the console warns on save with “N tablet(s) run too old a client; some settings will not apply” and names the devices affected: on those, these items have no effect until they are upgraded.

Blocking of exit gestures / system buttons

With the tablet pinned to the lesson application, the Home, Back and Recents buttons, the exit gestures and the power menu no longer take the student out of the application.

1. Apply the policy from point 2 (Kiosk single-app mode (appKiosk)) to the group.
2. In the "Apps" group, turn on "Kiosk hardening (power menu, recents, status bar and Settings entry) (kioskHardening)" and keep "Disable status bar" on in its form. "Disable the status bar (disableNotifyBar)" is the same action as the pull-down setting above: turn on one of them.
3. Add Block pop-up and overlay windows (disableCreateWindows) so that no application can cover the lesson screen.
4. Click Save and push and check on the tablet that no button or gesture leaves the application.
5. For one specific lesson use Left menu → Classroom → Class → Pin to an app.

Notes and limitations: Kiosk hardening and Block pop-up and overlay windows require tablet client 4.1.3.8 or later.

Remote app launching

From the console a specific application is opened on the student's tablet: on one device, on several at once, or across the whole class.

1. One device: Left menu → Device list → open the device → Send a command → Launch app → pick the application → Push.
2. Several devices: tick the checkboxes in the device list and click Bulk command.
3. The whole class: Left menu → Classroom → Class → Pin to an app, which also prevents leaving it for the time given.
4. Check the outcome on the device's Command history tab: Succeeded, Failed or No result yet.

Notes and limitations: In Kiosk mode, an application that is not on the the Kiosk app list reports a launch failure instead of pretending to succeed; add it to the list first. Offline devices run the command at their next heartbeat.

Screen control and pinning

Pinning the tablet to an application, remote screenshots, and a live view of the student's screen during the lesson.

1. Pin: Left menu → Classroom → Class → Pin to an app → pick the application and the duration → Pin; Unpin releases it early.
2. Single device: Left menu → Device list → open the device → Screen card → Take screenshot; the image **opens full size as soon as it arrives**, so there is nothing to look for, and it is also kept under the Screenshots and files tab.
3. Live view: on the device detail page, Live screen tab → send the Share screen command first, then click View screen; Stop sharing cuts it off.
4. The whole class: Left menu → Classroom → Class Monitor → Refresh round or Auto-refresh every 30 seconds.

Notes and limitations: Pinning requires tablet client 4.1.3.8 or later. [Do this once, at setup] Turn on the «ClassPad classroom screen view» accessibility service on the tablet. Without it, every remote screenshot and every classroom sweep makes Android ask the student to tap «Start» — that is the whole reason for «it prompts every time». On a single tablet: 1. Open «Settings» 2. Go to «Accessibility» 3. Find «Downloaded apps» (some models call it «Installed services» or «Downloaded services») 4. Tap «ClassPad classroom screen view» 5. Turn the switch on and confirm in the dialog the system shows You can also guide it from the console: Device list → pick the tablet → command panel → «Guide to finish setup: screen view and usage time (setup)» → Send. The tablet shows a short explanation with a button that jumps straight to step 2. Tablets where it is already on are not disturbed. For bulk setup, the USB setup tool turns it on as part of setup from version 1.3.0; for tablets set up earlier, connect them over USB and run the setup tool once more (`-grant-usage` only fixes the permissions and does nothing else). It walks through every connected tablet, skips the ones already done, and **appends instead of overwriting** — any screen reader or magnification service already on the tablet stays on. How to confirm it worked: send one «Remote screenshot». The tablet shows **no permission dialog at all**, and the image appears in the console within seconds. ⚠️ This cannot be done silently from the management side: enabling an accessibility service requires a system-level permission (WRITE_SECURE_SETTINGS) that Android does not grant to ordinary apps, ours included. So the only two ways are a tap on the device or the USB script. Once on, students cannot turn it off — the managed desktop blocks access to system settings. [What happens without it] From Android 14 on, the system requires fresh user consent for every screen capture. Without the service enabled, every screenshot and every supervision round makes the student's tablet show «Start recording or casting?», which the student has to accept — classroom supervision becomes impractical. With the service enabled that prompt is gone. [Even without the service, it no longer asks every time] From tablet client 4.1.8.0 on, when the accessibility service is off the student taps «Start» only for the FIRST capture of the lesson; for the next 40 minutes no further prompt appears, however many screenshots the teacher takes (measured on a real device: prompted on capture 1, no prompt on captures 2–4, each returning the screen as it was at that moment). The cost is that the system casting indicator stays in the tablet's status bar for those 40 minutes — the student can see at all times that their screen can be viewed, which we keep deliberately rather than weaken. It is released on expiry or when the teacher stops sharing; the next lesson asks for consent again. With the classroom-view service on there is no prompt at all and no standing casting indicator, so it remains the recommended setup. [The student still sees it] With the service enabled the notice comes from our own client: every time the screen is viewed, the notification bar shows «Your teacher viewed your screen», and tapping it explains what the school can and cannot see. This is a transparency requirement towards the student and is never skipped. The live view and the whole-class screenshot only work with a class in progress; a single-device screenshot is available outside class too, for technical support, and is recorded in the audit log.

Security, Hardware and Content Restrictions

A catalogue of more than ninety policy items covers security, hardware, application, network and time-window restrictions, applied per device group. New from 4.2.3.5: disable developer options, block adding users, block changing the wallpaper, disable Wi-Fi Direct, block copy and paste, a device watermark (school text, serial number and time tiled across the screen), system-update install windows and freeze periods, the default handling of runtime permissions (ask, grant automatically or deny automatically), and character rules for the unlock passcode (minimum letters, upper and lower case, digits and symbols).

1. Left menu → Policy management shows the existing policies, the device groups bound to each and the Enabled / Disabled switch.
2. After New policy, turn on what you need group by group: plain switches flip straight on, mode items (Kiosk, URL filtering) offer a choice of mode, interval items take minutes, and items with parameters open their form in place.
3. Select the device groups in the groups field and click Save and push.
4. If a device is covered by several policies, once it is enabled for this school, use When policies conflict to choose Strictest wins or Latest wins; before the mode is changed, the console shows which devices and which items would change.
5. To withdraw a restriction, turn that item's switch off or delete the policy: the console pushes the change to the devices again.

Notes and limitations: Disabling developer options also turns off USB debugging; when the policy is withdrawn, if USB debugging was on before, the factory-preinstalled build turns it back on automatically, while on the installable build it has to be switched on again in the tablet settings. Block copy and paste: Android has no standard switch for it, so the system keeps clearing the clipboard; it requires Android 9 or above. The watermark needs the overlay permission or the classroom-supervision accessibility service. Update windows and freeze periods are honoured by Android itself; whether the manufacturer's own updater honours them must be confirmed with the tablet manufacturer.

Complete blocking of open web browsing

The browser is limited to an allowlist of addresses, and the other browsers and app stores are hidden, so the student cannot browse freely.

1. Left menu → Policy management → New policy → Web and network group → turn on Browser URL filtering (internetRestriction) and choose Allowlist (only listed sites).
2. Click Edit URL list, choose Allowlist (only these are reachable) and type the permitted domains; Bulk import accepts a whole list pasted in.
3. Click Check syntax and, if warnings appear, Fix N automatically (the button states how many entries it will fix); then Save and push.
4. Complete the block with Hide system apps (Settings, browsers, app stores) (hideSystemApps) and with the multi-app home screen of Kiosk mode (appKiosk), leaving only the managed browser and the educational applications on that home screen.

Notes and limitations: Filtering is applied through managed application policies to both Chrome and ClassPad Browser (from 4.2.3.6; earlier versions covered Chrome only); both browsers enforce the same list with the same matching rules, and this works with the installable build of the client. Web views embedded inside other applications, and those applications' own traffic, are not controlled this way; for system-level filtering there is Domain filtering (system-integrated build only) (networkRestriction), which needs the manufacturer-signed build integrated into the ROM. If that build is not installed, the tablet reports the failure explicitly and never lets anyone believe the filter is active.

Deactivation of In-App Purchases / ads / pop-ups

With the app stores hidden, no application on the tablet can start an in-app purchase (the store's billing service is gone, so every purchase returns "billing unavailable"); family-filter DNS blocks ad domains in every browser and app; pop-up and overlay windows can be blocked.

1. Left menu → Policy management → open the policy you use (or New policy) → Web and network group → turn on Hide system apps (browsers, app stores) (hideSystemApps) and tick App stores. With the store hidden, no application on the tablet can start a purchase.
2. In the same group turn on Family-filter DNS (blocks ads and adult sites, enforces SafeSearch) (familyDns): ad domains are blocked in every browser and app.
3. Left menu → Policy management → open the policy you use (or New policy) → Screen and interface group → turn on Block pop-up and overlay windows (disableCreateWindows).
4. Add Hide system apps (Settings, browsers, app stores) (hideSystemApps) and Block installing apps (disallowInstallApps).
5. Limit traffic with Browser URL filtering (internetRestriction) in allowlist mode, leaving advertising and payment domains out.
6. Under Left menu → App management → App store pick only educational applications with no purchases and no advertising, and then, under Left menu → Policy management, use the multi-app home screen of Kiosk mode (appKiosk) to limit what students can open to those applications.

Notes and limitations: How it works and its limits: in-app purchases go through the app store's own billing service; once the store is hidden that service cannot be resolved anywhere on the tablet (checked on a real device in every test round). Ads are blocked by domain: an app that serves ads from the same domain as its content cannot be fully cleaned, so such apps should not be in the school catalogue. Family-filter DNS needs port 853 open on the school network; if it cannot connect, the tablet reports the failure instead of silently doing nothing.

Hardware restriction: camera/mic/BT/USB

Camera, microphone, Bluetooth, USB, external storage, NFC and hotspot are turned off by policy, with the option of allowing them temporarily during an activity.

1. Left menu → Policy management → New policy → Hardware and ports group → turn on Disable camera (disableCamera), Disable microphone (disableMicrophone), Disable Bluetooth (disableBtTransfer) and USB charging only (no file transfer) (onlyChargeUSB).
2. Add, where relevant, Disable external storage (disableExternalStorage), Disable NFC beaming (disableNFCMode) and Disable hotspot (disableHotspot).
3. Select the device groups and click Save and push.
4. One-off exception: Left menu → Classroom → Class → Temporarily allow hardware → tick Camera, Microphone, Bluetooth or USB file transfer and SD card, give the number of minutes and click Allow; Revoke temporary access cancels it earlier.
5. Scheduled exception: add Allow hardware only in scheduled periods (off otherwise) (hardwareSchedule).

Notes and limitations: The restrictions come back on their own when the temporary permission expires, even if nobody revokes it. Allow hardware only in scheduled periods requires tablet client 4.1.3.8 or later.

Real-time location / traceability / geofencing

The tablet reports its location on request and periodically, and from 4.2.3.5 also by schedule: set the daily start and end time and the interval, and it reports automatically within that window; the server compares positions with the group's geofences and records an alert when the device leaves the grounds.

1. Draw the geofence: Left menu → Alerts & compliance → Alert rules → Add geofence rule; a dialog with a map opens.
2. ① Choose the device group: right below, it says whether this group’s tablets are reporting their position. Entries and exits are only checked when a tablet reports its position; if they are not reporting, click Turn on scheduled location tracking for this group (every 15 minutes from 06:00 to 20:00 every day; needs client 4.2.3.5 or later).
3. ② Place it: type the school name or address in the search box and press Enter, or click on the map to drop the center; you can also use the group’s tablet positions as the center. Drag the green dot to move it.
4. ③ Size it: drag the white dot on the edge, or move the slider, to change the radius (200 m or more is recommended, because indoor positions drift). Dashed circles are the group’s other geofences; blue dots are where its tablets last reported.
5. ④ Enter a name, tick Leaving and/or Entering, and click Save. To change an existing geofence, click Edit in the list.
6. One-off query: Left menu → Device list → open the device → Send a command → Report location or Track location.
7. Entries and exits appear on the Alert log tab as Left geofence or Entered geofence, one record at the moment of the change (no repeat on every report while outside), and also under Left menu → Reports → Alerts, with Export alerts to CSV.

Notes and limitations: The console does not yet draw the route on a map: the position history is obtained through the device programming interface and in the school's full data export. Disable location (Android 9 and above) (disableGPS) requires Android 9 and above. No fix is never reported as success: indoors, in basements or where the sky is blocked there is no location signal. The Report location command then says so — “cannot obtain the device location (source: fused): no signal indoors or under obstruction; move the device near a window and retry”. You will not see a successful receipt with no new position, which would suggest the device had not moved.

Immediate remote lock and secure wipe

Screen lock and unlock and factory reset, on one device or several, delivered immediately to devices that are online.

1. One device: Left menu → Device list → open the device → Send a command → Lock screen; Unlock reverses it.
2. The whole class: Left menu → Classroom → Class → Lock class and Unlock class.
3. Wipe: on the device detail page, Send a command → Factory reset, and confirm the irreversible-operation warning.
4. Several devices: tick the checkboxes in the device list and use Bulk command.
5. Check delivery under Command history: the console states how many devices received the command straight away and which will pick it up at their next heartbeat.

Notes and limitations: If you use Google accounts allowed to unlock after a factory reset (FRP) (frpAdminEmails), the list cannot be left empty: the console refuses to save it, because an empty list would leave the tablet impossible to unlock after the wipe. To turn that protection off use Value 0, not an empty list.

Control of concurrently open tabs

The number of tabs a student keeps open can be limited: ClassPad Browser will not open a new tab above the limit, and Chrome is covered by a notice above the limit until the student closes the extra tabs.

1. Left menu → Policy management → open the policy you use (or New policy) → Web and network group → turn on Maximum open browser tabs (browserTabLimit) and enter the limit (for example 5). Turn the switch off to remove it.
2. The Chrome part needs the ClassPad classroom screen view accessibility service on the tablet (turned on once at setup); ClassPad Browser does not.
3. To leave no way around it: in the same group turn on Hide system apps (browsers, app stores) (hideSystemApps) and tick Browsers — Chrome and other browsers are hidden, ClassPad Browser stays.

Notes and limitations: How it works: Android offers no interface to count or close Chrome tabs and Chrome has no managed policy for it, so on the Chrome side the classroom accessibility service reads the tab count shown on the toolbar (only that number, never page content) and covers the screen with a notice above the limit; ClassPad Browser (our build of the open-source LineageOS Jelly browser) enforces the school's limit directly. Both paths are checked on a real device in every test round. How to distribute ClassPad Browser is described in point 15.

Screen recording at all times / on demand

Student screens can be recorded: for the whole class (ticked when the class starts) or on demand, started and stopped at any time. Recordings stay on the tablet; the teacher fetches the period needed and plays it in the console, and the server keeps it for 7 days. On-demand screenshots, class patrol and the live view are also available.

1. Whole class: Left menu → Classroom → Class → Start class → tick Record screens this class (each tablet records locally until class ends; fetch when needed). Recording stops when the class ends and is extended when the class is extended.
2. On demand: Left menu → Device list → open the device → Recordings tab → ① choose the length (15, 45, 90 or 240 minutes) → Start recording; the tablet's answer appears next to the button (for example "recording until 10:45"); Stop recording stops it at any time.
3. Fetch and play: same tab → ② choose the period (or Last 15 / 45 / 90 min) → Fetch recording; next to the button you see how many segments are being uploaded, their size and the time span; ③ uploaded 5-minute segments appear below and play in the page or can be downloaded.
4. On demand, single device: Left menu → Device list → open the device → Screen card → Take screenshot; the image is shown straight away.
5. On demand, the whole class: Left menu → Classroom → Class Monitor → Refresh round.
6. Continuous view during class: device detail → Live screen tab → send the Share screen command, set Frame rate (fps) and Max duration (minutes) → click View screen. A system consent dialog appears on the student's tablet with **Entire screen already selected**; the student just taps Start. To share a single app instead, tick “Share a single app (student picks)” under Advanced on the command.
7. The screenshots taken stay on the device's Screenshots and files tab for as long as their retention period lasts.

Notes and limitations: [Prerequisite: turn it on once, at setup] Enable the «ClassPad classroom screen view» accessibility service on the tablet: «Settings» → «Accessibility» → «Downloaded apps» → «ClassPad classroom screen view» → switch on and confirm. With USB setup from a computer, the setup tool turns it on automatically from version 1.3.0; for tablets set up earlier, connect them and run the setup tool once more (or with `-grant-usage` to only fix the permissions); you can also send «Guide to finish setup: screen view and usage time (setup)» from the console command panel, which shows a guide on the tablet and jumps straight to the settings page. Without it: from Android 14 on, the student must tap «Start» for every single capture, which makes whole-class supervision impractical — «it prompts every time» is exactly this step not being done. With it on, repeated screenshots were measured on a real device with no prompt at all (clause 6 has the full instructions and how to confirm). How it works and its limits: if the classroom accessibility service is off, the tablet answers that it cannot record and says what to turn on. Recordings stay on the student's tablet (last 3 days, up to 1.5 GB) and do not use the school network; only the period a teacher fetches is uploaded, and the server deletes it after 7 days. One frame every 2 seconds, about 67 MB per hour: enough to see what the student is doing, not smooth video. Nothing is recorded while the screen is off (the tablet is not woken to record); the recording shows "Screen off". At most 4 hours per recording; the tablet stops on its own at the end time, without needing the network. While recording, the student's notification bar always shows "Your teacher is recording this tablet's screen", and every start, stop and fetch is written to the audit log. Recording minors' screens needs a clear teaching reason; whether and how long to record is the school's decision and should be written into the school's data-processing rules. If the tablet is locked: Android does not allow the consent dialog over the lock screen. The tablet wakes the display and reports back honestly — “the device is locked, the screen capture consent dialog cannot be shown; ask the student to unlock and retry” — instead of hanging on “in progress”. A student tapping Cancel is also reported honestly; that is a normal product path.

Content control

Sites can be blocked by category (gambling, violence, drugs, dating, games, social networks, piracy, hacking and more — 11 categories) and pages by keyword, and all traffic on the tablet also goes through family-filter DNS that blocks adult, phishing and ad sites; which apps and addresses the student may use, and when, are controlled, and safe search is enforced.

1. Distribute ClassPad Browser (once): download https://classpad.owly.cn/download/classpad-browser-latest.apk → Left menu → App management → App store → Add app → Upload package → set it to Required under Assign to classes. Once installed, the school's tab limit, keywords and categories apply automatically.
2. Left menu → Policy management → open the policy you use (or New policy) → Web and network group → turn on Block site categories (ClassPad Browser) (browserCategories) and tick the categories to block.
3. Same group → turn on Blocked keywords (ClassPad Browser) (browserKeywords), one keyword per line: if any appears in the URL, search terms, page title or text, the whole page is blocked (the notice does not say which word).
4. Same group → turn on Family-filter DNS (blocks ads and adult sites, enforces SafeSearch) (familyDns): it applies to every browser and app.
5. Same group → turn on Hide system apps (browsers, app stores) (hideSystemApps) and tick Browsers: Chrome and other browsers are hidden, ClassPad Browser stays, so students only have the managed one.
6. Left menu → Policy management → New policy → Apps group → turn on Kiosk mode (appKiosk), choose Multi-app home screen and pick the authorised applications with Choose applications.
7. Turn on Browser URL filtering (internetRestriction), choose Allowlist (only listed sites) and define the domains with Edit URL list.
8. Add App time fence (allowed hours per app) (apptimefence) so that certain applications are only available in the hours the school decides.
9. Keep the approved catalogue under Left menu → App management → App store, and check the App distribution tab to see what is really installed on the tablets.

Notes and limitations: How it works and its limits: the category lists come from the UT1 blacklists of Université Toulouse Capitole (CC BY-SA 4.0, about 94,000 domains), refreshed on every server release and checked by the tablet once a day; matching is by domain, so expect a few misses and false positives. The adult list is too large for the tablet and is covered by family-filter DNS in every browser. Categories and keywords apply only in ClassPad Browser, so the complete set-up is "hide the other browsers, keep ClassPad Browser" (the last step above). URL allowlists and blocklists apply in both Chrome and ClassPad Browser (from 4.2.3.6), so they keep working after Chrome is hidden. ClassPad Browser is our build of the open-source LineageOS Jelly browser (Apache-2.0), published under our own signature. Every item is checked on a real device in every test round.

WEB filtering

Address filtering in allowlist or blocklist mode, applied to the tablet's browser through managed policies, with a built-in syntax checker.

1. Left menu → Policy management → open the policy you use (or New policy) → Web and network group → turn on Browser URL filtering (internetRestriction) and pick either Allowlist (only listed sites) or Blocklist (block listed sites); switching the item off revokes it.
2. Click Edit URL list, choose the mode and type the addresses; with Bulk import you can paste a whole block, one per line.
3. Click Check syntax: the console flags empty lines, misused wildcards, non-ASCII domains, duplicates and Chrome's 1000-entry limit; Fix N automatically (the button states how many entries it will fix) repairs the ones that can be repaired.
4. Save and push, then check on the tablet that a domain outside the list is blocked.

Notes and limitations: The scope is Chrome and ClassPad Browser on the tablet (both from 4.2.3.6). Web views embedded in other applications, and those applications' own traffic, do not pass through this filter; covering them needs Domain filtering (system-integrated build only) (networkRestriction), which requires the manufacturer-signed build integrated into the ROM. On the installable build, that item reports the failure instead of being treated as applied.

Virtual security console (cloud-based)

All management is done from a multi-user, multi-school web console, with nothing installed on the administrator's own machine.

1. Open the HTTPS address you were given in a recent Chrome or Edge and sign in with your account.
2. Left menu → Dashboard shows devices, online and offline, the day's pushes and alerts, last connection and devices per group.
3. Left menu → District gives the education authority a consolidated view of all its schools; each school sees only its own data.
4. Left menu → System management → Branding lets each school be given its own Console domain, name and logo.

Notes and limitations: It can be deployed as a cloud service or inside the customer's own data centre, as the ministry decides. The separation between schools is verified at acceptance: an account of one school cannot see or query another school's devices or classes.

Activity monitoring

Tablets report usage time per application, data usage, alerts and the outcome of every command; all of it can be queried and exported from the console.

1. Left menu → Reports and choose the range with Start and End and the device group, or All device groups.
2. Review App usage time, Data usage and Alerts; export with Export app usage, Export traffic or Export alerts.
3. Review Long offline to find the devices that have not connected for a while, with those that never connected at all listed first.
4. Per device: Left menu → Device list → open the device → the Device state, Installed apps and Command history tabs.

Notes and limitations: Usage data is sent by the tablet; a device that is switched off or off the network reports once it connects again. You can force a collection with the Collect app usage command from the device detail page.

Device control

Reboot, power off, brightness, volume, device name, unlock passcode, wallpaper, Wi-Fi configuration and time synchronisation are all managed from the console. From 4.2.3.5: several Wi-Fi networks in one push, with hidden networks, manual proxy or proxy auto-config, WPA3 and enterprise authentication (PEAP, TTLS), each one checked for acceptance by the system; mobile access points (APN), always-on VPN, and scheduled power on, power off and reboot.

1. Left menu → Device list → open the device → Send a command and choose Reboot device, Power off, Set brightness, Set volume or Reset unlock passcode.
2. By policy: Left menu → Policy management → open the policy you use (or New policy) → turn on Wallpaper (wallpaper), Preset Wi-Fi (wifiConfiguration) or Auto-sync date and time (synchronizeDateAndTime).
3. Lock-screen passcode requirements are set by policy: Left menu → Policy management → open the policy you use (or New policy) → Security group → turn on Lock-screen passcode (passCode) and set the passcode type (numeric / alphabetic / alphanumeric / complex), the minimum length and the auto-lock delay. Requires tablet client 4.1.7.8 or later.
4. For several devices use Bulk command in the device list, or bind the policy to the whole group.
5. Check every push on the device's Command history tab.

Notes and limitations: Scheduled power off and scheduled reboot work on the factory-preinstalled build; scheduled power on also requires a MediaTek or Unisoc tablet. On the installable build these three report failure honestly instead of showing success. The boot and shutdown animation and sound need the manufacturer's system support and are marked in the list itself as system-integrated build only. Pushing an APN needs a SIM card and Android 10 or above. Always-on VPN must name an installed VPN app; the VPN server and other parameters are sent through that app's managed configuration. Renaming the tablet inside Android is not possible: the system explicitly rejects it for device owners (“device owners cannot update device_name”). To name a tablet in the console, use Display name on the device detail page — that is the console's own name, it takes effect immediately and is what reports, device lists and the classroom wall show.

Classroom management

A class with a start and an end, a lock for the whole group, pinning to an application, messages to the class, pushing courseware to the whole class (a web address or a PDF, opened on the students' tablets right away), quick multiple-choice questions with live tallies, student hand-raising, a monitoring wall with the students' screens, and «Broadcast and class meetings»: the teacher's screen and voice broadcast to every tablet, teacher and tablets talking to each other, files sent over the local network, viewing student screens and student presentations; there is no native teacher application. Teachers can install the teacher view on their phone as an app: an icon on the home screen, full-screen use, and it still opens offline and says there is no connection.

1. Left menu → Classroom → Class → pick the class → Start class → give the Duration and tick, where relevant, Lock the class (unlocked automatically when class ends), Pin to an app and Temporarily enable hardware.
2. During the lesson use Lock the class, Unlock, Screenshot the class and Send to the class; Screenshot the class takes you straight to Class monitoring, where the screens are shown.
3. Push courseware: during the class choose «Push courseware», then either «Web address» with an https link or «File library» with an already uploaded file, and press «Push now». The tablets open it immediately; a PDF is shown page by page and can be paged back and forth. The confirmation names how many tablets received it, and tablets that are offline are not counted as successful.
4. Questions and hands: during the class, in «Classroom interaction» type the question, choose A/B/C/D or True/False and press «Ask the class». The question appears on the tablets at once and the bars on the teacher's side move as answers come in. «Close and show results» ends the question and clears it from the students' screens. A student taps «Raise hand» at the bottom right of the tablet desktop and appears in the teacher's list; «Called on» removes them from it.
5. Screen broadcast: once the class has started, in the «Broadcast and class meetings» card below the class page choose «Full screen, locked (students can only watch)» or «Window (students can follow along)»; to talk while you show, tick «Also broadcast my voice (uses the microphone)» → «Broadcast my screen» → in the browser window that opens, choose the whole screen or a single window to share. The card shows whether the lesson uses «Local network multicast», «Local network, one tablet at a time» or «Server relay», and how many tablets are watching; «Stop broadcasting» ends it, and End class stops it too.
6. Voice only: choose «Broadcast only my voice (no screen)» → «Start broadcasting my voice».
7. Class meeting: choose «Class meeting (teacher and tablets talk to each other)», tick «Turn on my camera too» if you want to be seen → «Start the class meeting». The tablets show a «Class meeting» page; a student's microphone only opens when they tap «Microphone: off (tap to talk)». On the teacher's side there are «My microphone: on», «My camera: on» and «Mute the class».
8. All classroom interaction needs the teacher helper running on the teacher's computer (until it is detected, «Start» in the card is greyed out, with «Download the teacher helper» and «It is running, check again» next to it): screen broadcast, teacher audio, class meetings, and sending a file over the local network (in the card, «Choose a file from the library» → «Send to class»); viewing a student's screen («View screen» in the student list); student presentations («Present» shows that student's screen on every tablet, «End presentation» takes it back; start with «Full screen, locked (students can only watch)» or «Window (students can follow along)» first). To use only these without broadcasting your screen, choose «No broadcast, just connect the teacher helper (view student screens, student presentations over the local network)» → «Connect the teacher helper».
9. Installing the teacher helper: in the card click «Download the teacher helper» → pick Windows, macOS (Apple silicon), macOS (Intel) or Linux for the teacher's computer → double-click to run it and keep its window open during the lesson. Once it runs, the card says «Teacher helper found on this computer».
10. Left menu → Classroom → Class Monitor → Refresh round or Auto-refresh every 30 seconds; click a thumbnail to enlarge it and Open device to go to that device.
11. When you are done click End class: the lock, the pinning and the allowed hardware are withdrawn; if nobody ends it, the server does so at the scheduled time.
12. From a phone, the teacher opens the console's mobile view, picks the class and uses Patrol once and Message.
13. Install on the phone: open the console's mobile view in the phone browser → Install on home screen at the top of the page (one tap on Android); on iPhone follow the hint: in Safari tap Share, then Add to Home Screen. From then on open it from the Teacher icon on the home screen.

Notes and limitations: [Prerequisite: turn it on once, at setup] Enable the «ClassPad classroom screen view» accessibility service on the tablet: «Settings» → «Accessibility» → «Downloaded apps» → «ClassPad classroom screen view» → switch on and confirm. With USB setup from a computer, the setup tool turns it on automatically from version 1.3.0; for tablets set up earlier, connect them and run the setup tool once more (or with `-grant-usage` to only fix the permissions); you can also send «Guide to finish setup: screen view and usage time (setup)» from the console command panel, which shows a guide on the tablet and jumps straight to the settings page. Without it: from Android 14 on, the student must tap «Start» for every single capture, which makes whole-class supervision impractical — «it prompts every time» is exactly this step not being done. With it on, repeated screenshots were measured on a real device with no prompt at all (clause 6 has the full instructions and how to confirm). Note: the teacher view is an installable web app (PWA): once on the phone's home screen it has an icon and opens full screen without going through an app store; it is not listed on Google Play or the App Store. The teacher helper only relays on the local network; everything is operated in the console. Class meetings currently need the teacher helper; meetings through the server without a helper are still being built. By design, students' screens can only be seen with a class in progress and stop being visible when it ends; the wall then still shows the devices, their connection state and their battery, but not the images. This module is mainly classroom **control**. «Push courseware» is its one teaching action: with a single operation the teacher has a web page or a PDF opened on every tablet, rendered by the client's own courseware view, so no reader application is needed and it still works while the browser is hidden. Students can close it from the top right; to keep them on the material, combine it with «Pin to application». Quick questions and raised hands both belong to classroom interaction: questions and answers are attached to this lesson and archived when it ends. Only one question can be open at a time in a lesson (two in parallel would make the tallies disagree). One tablet counts as one vote per question; a student who changes their mind can pick again and it replaces their own vote. Broadcast and class meetings (client 4.2.2.4 and later): on the tablet, «Class Live», installed together with ClassPad, shows the teacher's picture and plays the teacher's voice; students install nothing and tap nothing to watch. With «Full screen, locked» students can only watch the teacher, and the tablet returns to what it was when the broadcast stops; with «Window» the picture shrinks to picture-in-picture so students can keep working. The system chooses the path by itself: with the teacher helper, and the tablets on the same network segment as the teacher's computer, the picture is multicast on the local network — every tablet receives one copy at once, without using the school's internet bandwidth; on a different segment that the school routes to, it switches to sending to each tablet; if that cannot connect either, it goes through the server. Without the helper you can still broadcast your screen, relayed through the server, which uses the school's internet bandwidth when many students watch. When a file is sent over the local network, tablets that cannot receive it switch to a normal download, and the result appears in the task records as usual. First run of the teacher helper: when Windows Firewall asks, choose "Allow (private networks)"; if Windows says "unrecognized app", click "More info → Run anyway". On macOS, if it says the developer cannot be verified, right-click it and choose "Open"; when asked to "find devices on local networks", click "Allow" — otherwise multicast cannot be sent. For the school's IT staff: on the teacher's computer allow UDP 5640 (multicast), UDP 5641 (packet repair and keyframe requests), TCP 5642 (student screens) and UDP 5643 (class meetings), from the school network only. Where the student finds it: «Raise hand» sits at the bottom right of the tablet desktop, and also in the top bar while courseware is open. The answer screen cannot be dismissed with the back key while the student is answering — leaving it would keep that tablet at «not answered» on the teacher's side; the teacher closes the question to end it. Two limits in use: the courseware address must be https — the tablets block cleartext http for security, and the console rejects an http address on the spot; convert Word or PowerPoint to PDF or to a web page first. The feature needs tablet client 4.1.7.8 or later, and the console names each tablet whose version is too old at the moment you push.

Traceability (What and When)

Every write operation is recorded in the audit log with user, action, object, outcome, source address and date; each device also keeps the history of the commands it received.

1. Left menu → System management → Audit log and filter by date range and by All users or one specific user.
2. Open Details on a row to see the content that was pushed; password fields are masked.
3. Per device: Left menu → Device list → open the device → Command history tab, with Succeeded, Failed or No result yet and the date of the response.
4. Export with Export CSV to add the records to the institution's file.

Notes and limitations: Only write operations are recorded (pushes, changes and deletions); queries are not. The default retention is 365 days. The detailed reason for an installation failure is sent by tablets running a recent client: records from before that version show only Failed, with no cause, and that data cannot be filled in afterwards.

Search management control

When address filtering is turned on, the tablet also receives enforced Google safe search, YouTube restricted mode and incognito browsing disabled.

1. Left menu → Policy management → New policy → Web and network group → turn on Browser URL filtering (internetRestriction) and choose the allowlist or the blocklist.
2. Click Edit URL list, define the domains and click Save and push.
3. With that item active, the tablet's browser receives enforced safe search, YouTube restricted mode at the strict level and incognito disabled, with no further configuration.
4. Check on the tablet that a Google search reports safe search as on, and that the browser menu no longer offers an incognito window.

Notes and limitations: These three measures travel together with address filtering: with the item at Value 0 (Revoked (value 0, list has no effect)), safe search is not enforced either. If the school wants safe search without restricting domains, it is enough to enable the item in blocklist mode with a minimal list. It applies to Chrome and ClassPad Browser (from 4.2.3.6): in ClassPad Browser, Google searches are likewise forced to SafeSearch and incognito tabs are blocked; YouTube Restricted Mode applies in Chrome only.

Sending notifications/messages in real time

Messages to one tablet, to a selection or to the whole class, delivered immediately to devices that are online, as a dialog or as a floating notice.

1. The whole class: Left menu → Classroom → Class → Send to the class, and type the text.
2. One device: Left menu → Device list → open the device → Send a command → Send message → fill in Title, Message and Style (Dialog or Floating) → Push.
3. Several devices: tick the checkboxes in the device list and use Bulk command.
4. The console replies with how many tablets received the message and how many got immediate delivery; the rest receive it at their next heartbeat.

Application Management and Administrative Policies

Our own application catalogue and a student app store on the tablet, with package upload (Google Play split packages included), silent installation, per-class Required / Optional assignment (several apps can be assigned in one go), listings in three languages, allowlists, managed configuration and time windows per application. New from 4.2.3.5: an install blocklist / allowlist (non-compliant apps students install themselves are removed at once) and setting the default home app.

1. Left menu → App management → App store → Add app, then choose where the app comes from. Add from Google Play: type the app name or package name, or paste a Google Play link; once picked, the name, developer, category, descriptions in Chinese, English and Spanish and the screenshots come with it. The install source defaults to Google Play link (no package is uploaded; the student installs it from Google Play on the tablet, which must be signed in to Google); the alternative is Also upload the package for the school to host. Upload package: an APK or a zip of a Google Play split package; name, package, version, icon and signature are read automatically, and if the same app is on Google Play its descriptions and screenshots come along. Add to store takes you straight to Assign to classes.
2. To change it later, click Listing on the app card: category, summary, description and screenshots can all be edited; the name and description can be written per tab — Default / English / Español — and tablets show the one in their own system language.
3. Assign to classes: choose Required or Optional for each class. Required keeps it installed, and a tablet that joins later receives it at its next connection; Optional only lists it in those tablets' app store and Install on the tablet installs it silently. Push installs it once, right now, on the groups you choose.
4. Restrict its use from Left menu → Policy management → open the policy you use (or New policy) → with Kiosk mode (appKiosk), Managed app configuration (App Restrictions) (appPolicy) and App schedule rules (appSchedule).
5. Check on the App distribution tab what the tablets themselves report as installed, and update the client from Left menu → OTA → Client update.

Notes and limitations: A blocklist suspends the application (icon greyed out, it will not open), it does not uninstall it: taking it off the list makes it available again immediately. The install blocklist / allowlist governs new installations: a non-compliant app is removed as soon as it is installed; apps installed from the school app store, ClassPad itself and system apps are not affected. Removing an assignment does not uninstall what is already installed either. The console shows the signing-certificate fingerprint of the uploaded package and sends it along with the install command. The default home app cannot be set while Kiosk mode is on; when it is withdrawn, the Home button returns to the previous home app.

Branding management

Product name, logo, primary colour, own domain and the tablets' lock screen are customised per school from the console.

1. Left menu → System management → Branding, and fill in Product name, Primary color and Logo (Upload PNG / JPEG (≤2MB), or paste a link).
2. Fill in Lock screen message and Support phone for the tablets' lock screen; under Home screen wallpaper, pick an image from the file library or click Upload image to set the tablets' home screen wallpaper. Preview shows the lock screen.
3. Give the school's Console domain: entering through that address shows its name and its logo.
4. Click Save and sync to every device: the console reports how many devices it reached straight away.
5. For the look of the console itself: Left menu → System management → Custom theme (font, top bar, sidebar style, sizes and radii).

Notes and limitations: The logo, the message, the support phone and the home screen wallpaper are pushed by policy and work with the standard client. Changing the name and the icon of the management application itself on the tablet requires a build specific to the customer, agreed separately.

Global/group/individual reports + Zero-touch

Global, per-group and per-device reports, exportable to CSV. Zero-touch onboarding is done with a pre-import list of serial numbers or IMEIs; we do not use the Google Zero-Touch programme.

1. Global and per group: Left menu → Reports → choose All device groups or one group and the date range; export with Export app usage, Export traffic and Export alerts.
2. Per device: Left menu → Device list → open the device → the Device state, Installed apps and Command history tabs.
3. Zero-touch onboarding: Left menu → Device groups → pick the group → Pre-import list → paste one tablet per line (serial number, or serial and IMEI) → Add.
4. Switch on the new or factory-reset tablet with a network available: it joins the group by itself, without anyone touching the device; the list entry moves from Awaiting first boot to Enrolled.
5. As an assisted alternative: Left menu → Android enrollment → QR code enrollment → pick the group → QR code and scan it with the tablet's camera in the setup wizard.

Notes and limitations: What is missing: the Google Zero-Touch programme requires an authorised reseller account and tablets bought through that channel; it is not part of this delivery. Our alternative, the pre-import list by serial number or IMEI, achieves the same operational result on the project's tablets and is verified on real devices, but it is an implementation of our own and should be understood as such in the tender. The reports page can "Print / Save as PDF" with a header carrying the school name and logo, the period, the scope and the generation time; details can also be exported as CSV.

User management capability

Full management of the console accounts, with four roles (school administrator, teacher, school-wide operator and read-only); a teacher only manages the classes they teach, and smaller custom roles can be defined as needed. Multiple Android user profiles are not managed on the tablet.

1. Left menu → System management → User management → New user → Username, Password (at least 8 characters) and Role: School administrator, Teacher, School-wide operator or Read-only. A one-line description of what the role can do appears under the form.
2. A Teacher must be given the grades or classes they teach: they will only see and control those tablets; they cannot factory-reset, unenroll or clear the policies of a tablet (these cannot be undone, so only school administrators and school-wide operators can send them), and they cannot see the school's enrollment records or other classes' policies. Read-only accounts can see the whole school or only some classes.
3. Reset password, Disable and Enable cover the account's life cycle; no account can disable or demote itself.
4. Each person manages their own details and password under Account → My profile.
5. Optional: on the “User management” page, “Custom roles” → “New role”: start from the read-only, school-wide operator or school administrator base and untick the permissions you do not need (for example “principal who only sees reports”), then assign it in the “Custom role” column of the account table; a custom role can only be smaller than its base, never larger.
6. Optionally, connect the accounts to the institution's directory under Left menu → System management → Single sign-on (point 1).

Notes and limitations: What is missing: several Android users or profiles are not created on the tablet; the model is one student assigned to one tablet, registered on the class roster. Multiple profiles on the device depend on the manufacturer's firmware and are not verified on the project's tablets, so we do not commit to them.

On one page the school administrator sets up the model provider, which model each capability tier uses, which features are open to which roles, and daily and monthly spending caps.

1. Left menu → “System management” → “AI settings” → “① Model providers”: use ClassPad-hosted models, or click “Add provider” to connect the school's own provider.
2. “② Capability tiers”: choose a model for each tier. “Follow the latest model” below is on by default: when a newer version of the same line appears, both are tested with the built-in evaluation set and the new one is switched in only if it does not regress, keeping the old one as backup; it reverts automatically if things get worse, or click “Revert”.
3. “③ Switches and scope”: turn on “AI master switch”, turn on each feature you need and choose who it is “Available to”, fill in “Daily spending limit (USD)” and “Monthly spending limit (USD)”, then click “Save switches and scope”.

Notes and limitations: When a cap is reached AI pauses with an explanation and resumes the next day or month. The usage table on the same page shows the feature, model, latency and cost of every call.

Ask about tablet status in English, Spanish or Chinese; the answer comes back as a table.

1. Left menu → “Device list”, type a question in the box at the top (for example “Which grade 3 tablets have been offline for more than a day?”) and click “Ask AI”.
2. Click a row to open that tablet; click “Export CSV” to keep a copy.

Notes and limitations: Only the classes the signed-in account may see are searched.

Next to a failed receipt, an alert or a policy item you don't understand there is an explanation link; one tablet's problems can be summarised into a conclusion and next steps.

1. In a device's command history, in Left menu → “Alerts & compliance” → “Alert log”, or next to a policy item while editing a policy, click “What does this mean?”.
2. Left menu → “Device list” → open a tablet's “Device details” → click “Diagnose this tablet with AI”.

Notes and limitations: Each answer states which model wrote it and which known issues it used; it is advice only.

Describe what to restrict in one sentence and AI drafts the policy form; risks are checked automatically before saving, and AI can review them again.

1. Left menu → “Policy management” → “Describe in one sentence”, write the request and click “Draft it”; the draft fills the form below.
2. Check and edit each item, then bind classes; “Pre-save check” under the form shows how many tablets it reaches and what the risks are, and you can click “Ask AI to review”.
3. Tick “I understand” for each risk that needs confirmation before saving.

Notes and limitations: Apps not installed on the school's tablets and settings that would cut tablets off are never drafted; the result lists what was removed and what cannot be done.

The teacher describes the lesson in one sentence and AI drafts the lock, pinned app, temporary hardware access and screen recording.

1. Left menu → “Classroom” → “Classroom” → choose the class → “Start class”.
2. In “Class assistant” at the top of the dialog write one sentence (for example “whole class takes a quiz, only the survey app, collect in 20 minutes”) and click “Draft this class”; the form is filled in.
3. After checking it, click “Start class” to actually start the class.

Notes and limitations: Only that sentence and the names and packages of apps on the class's tablets are sent; no students, class names or serial numbers. Apps the class does not have installed are never pinned.

Published apps are checked for permissions, ads, analytics trackers, in-app purchases and target version, and rated by the standard of a student tablet.

1. Left menu → “App management” → “App store” → “Check” on the app card.
2. If needed, click “Ask AI whether it suits students” and AI explains what the app is, what to watch and a suitable age.

Notes and limitations: Only the permissions declared in the installer and the component names in its code are read; the app is not run. Apps added from a Google Play link have no installer and cannot be checked.

A weekly roll-up of online rate, alerts, command success rate and app use, with a list of things to handle; AI writes a short summary for the principal.

1. Left menu → “Reports” → “Weekly report” → “AI summary”.

Notes and limitations: The AI summary uses only the totals on the page, with no tablet, student or class information.

School IT can use Claude, ChatGPT or other MCP-capable tools with an API token to query tablets, review alerts and compliance, and send reversible commands.

1. Left menu → “System management” → “User management” → “API tokens” → “New token”; choose the role, whether it is read-only and which classes it covers.
2. After it is created, “Connect AI tools (MCP)” in the dialog shows the server address and a ready-to-copy connection command.
3. Factory reset, unenroll and clear policies requested by an AI tool only create a pending request: another administrator must click “Approve” in “Approvals” on the top bar before it runs.

Notes and limitations: The AI tool can see and do exactly what the token can; every action is recorded in the audit log with the actor “mcp:token name”. Data it reads is passed to the AI tool the school chose, under the school's own agreement with that tool.