Technical information

Kublio for school IT administrators

Sign-in

Staff and students sign in with the school's own Microsoft 365 or Google accounts. Kublio never asks a child for a new password.

Permissions

The only permissions Kublio requests are openid, email and profile. This is enough to know who signed in, and nothing else. Kublio cannot read mail, files, calendars or anything in the school's tenant.

Microsoft 365

The application id is 41833ff1-d9b3-48cb-8acd-87755371520f. A tenant administrator may need to approve it once.

Google Workspace

If your domain restricts third-party apps, Kublio must be marked as trusted under Security, then API Controls, then App Access Control. The Google application id will be published here when Google sign-in is enabled.

Network

Outbound HTTPS on port 443 only. Kublio needs no inbound ports opened and works behind an authenticated proxy.

Locally hosted option

A school can run Kublio on its own server, where sign-in is by class code and PIN and no student data leaves the school.