Tiaris guide
Prepare classrooms
Create group-based classrooms and give teachers access to managed computers.
As an Owner or Manager, open Classrooms. Enable Classroom Mode for the organization and in the computers’ Blueprint, then release and apply that configuration through the normal update workflow.
In Policy → Classroom baseline, choose All supported apps or an app allowlist, and optionally configure HTTPS site, exact page or path rules. Save the Policy and release/apply its signed Blueprint configuration. Teachers cannot edit this administrator baseline. Classified students use one managed GNOME Classroom session; Taskbar and Dock change its presentation. Operators and unclassified recovery accounts retain their existing access, homes and documents.
The baseline is active before any lesson and returns after End or valid expiry. It has no lesson identity or countdown. Lessons intersect its permissions with reviewed installed launchers; they cannot grant an app or website the baseline forbids. Missing or invalid installed baseline evidence blocks student interaction. A legacy enabled configuration receives an explicit default only when a new signed composition is generated and applied with the new runtime; old installed artifacts do not change automatically.
Create a classroom from one or more Computer groups. You can create a group and select its computers here. Groups have stable identities, so renaming one keeps the classroom link. Use Manual selection for a classroom with an individual computer list. Existing classrooms keep their manual selection. Group roster changes apply to future admissions; computers already in an active lesson keep that lesson until it ends or authority is explicitly revoked.
Invite staff with the Teacher role through People and assign classroom View or Conduct permission. View permits status and roster access; Conduct permits teaching. Teachers use normal sign-in and personal account settings. The administrator workspace handles setup, grants and emergency End. Administrators who also teach can switch to the teaching context explicitly.
For shared-room lessons, classify each eligible local workstation account in Settings → Sign-in sources, in its Local Account Profile: choose Student for an individual learner or Shared student for a shared login. Keep teacher, administrator and unknown accounts Unclassified. The signed Blueprint apply delivers this trusted classification to the workstation. A shared login is reported as a shared account, not attributed to a particular learner. This classification is required for new manual lessons as well as automatic sign-in admission; older active lessons keep their existing behavior.
Teachers choose lesson apps and optional websites themselves. Apps must already be installed through the usual software workflow. Starting a lesson does not install software. The classroom shows each computer’s reported installed apps and which apps support temporary restrictions.
Shared-room participation and live policy changes require workstation runtime candidate 1.0.98 to be separately installed and qualified. Native and browser qualification are separate from a Manage deployment; browser candidate qualification is pending. Do not assume these features are available until the administrator confirms the installed, qualified component versions.
App restrictions require the new qualified workstation runtime with native GNOME Taskbar/Dock Wayland input controls. Website restrictions additionally require the exact signed managed-browser component. Enabling Classroom Mode in the Console installs neither component. Ask your administrator to check installed versions before use. Offline, signed-out, locked or unsupported computers explain why they cannot participate.
Revoke a teacher grant, remove manual computer membership, archive a classroom or disable Classroom Mode to begin release of affected authority. Managers can explicitly take over and end a lesson. Check pending cleanup before assuming an offline computer has released its temporary controls.