Trace Id is missing
September 14, 2022

Prince William County Public Schools creates a more cybersafe classroom with Microsoft Purview

Prince William County Public Schools (PWCS) in Virginia has a reputation for innovative education of K–12 students. It’s just taken a step further by rolling out Microsoft Purview Communication Compliance and Microsoft Purview eDiscovery. This is good news for parents and educators as a new tool to help in the identification and prevention of cyberbullying in the virtual classroom. Microsoft Purview Communication Compliance provides the tools to help organizations detect regulatory compliance violations including Family Educational Rights and Privacy Act (FERPA) and Children’s Internet Protection Act (CIPA), such as inappropriate sharing of sensitive or confidential information and harassing or threatening language. 

Communication Compliance can also be used to help detect the sharing of inappropriate images or text that can carry harmful innuendo to the most vulnerable of us: young students taking their places as good digital citizens in an evolving world. Built with privacy by design, usernames are pseudonymized by default, role-based access controls are built in, investigators are explicitly opted in by an admin, and audit logs are in place to ensure user-level privacy.

Prince William County Public Schools

“The biggest reward for us is when a counselor or principal thanks us for passing on a compliance alert from Microsoft Purview that showed that a student needed support. We’re there for our kids, and with the right tools, we can be more proactive than ever before.”

AJ Phillips, Director of Information and Instructional Technology, Prince William County Public Schools

Children and young adults explore technology with legendary ease. Prince William County Public Schools (PWCS) in Virginia wants to ensure that their explorations are safe. Now that students often have their own mobile devices and use dedicated laptop devices at school, they can access vast amounts of information and communicate with peers without the traditional in-person adult watchfulness that protected previous generations. But PWCS has found a way to be an unobtrusive, yet protective, virtual presence. It turned to Microsoft Purview to better understand the digital schoolyard, gaining insights into the use of school-provided devices to share harmful or inappropriate content (often inadvertently) that could result in a policy violation or potential cyberbullying—and tactfully intervene. It’s an education innovation that can change the game for cyberbullying prevention for children of all ages, everywhere, and it helps PWCS with data compliance needs.

Building a vision for classroom computing

With its academic specialty programs at all grade levels, commitment to teacher development, and instruction in language, technology, and career readiness, PWCS is lauded as an innovative district. This second-largest school district in the Commonwealth of Virginia owes much of its success to its whole child emphasis—such as initiatives to maximize health and safety in school and on sports fields. It considers the future, with energy conservation measures for its buildings that preserve resources for the next generations.

PWCS also leads the way in classroom technology—the Virginia Department of Education consults with the district on best practices. But the perennial budget shortfalls for technology in schools capped how far the district could run with its vision. It wasn’t until the nationwide COVID-19 lockdowns that AJ Phillips, Director of Information and Instructional Technology at PWCS, could secure funding for her goal of one-to-one devices for all students. “We go above and beyond to ensure that our students get what they need to be ready for the future,” she says.

Mastering hurdles with a unified Microsoft solution

Receiving funding to provide a device to every student met one of Phillips’s budget goals but created other concerns. Her department’s charge swelled to 90,000 student devices, not including teacher devices like headphones, classroom cameras, interactive whiteboard panels, and a Canvas learning management system (LMS). She has a small cybersecurity team led by Randyll Newman, Supervisor of Student Data and Information Security at PWCS. Newman’s team quickly turned to IT administration and productivity solutions. Microsoft Power Automate helps streamline routine IT tasks and free up the team to focus on more innovative work while keeping them on track and ahead of evolving situations with visualizations from Power BI. Finally, PWCS uses Azure Active Directory for identity management to ensure all student and teacher sign-in credentials remained safe.

And because many of those students spend holidays in the countries where extended family live, Newman appreciates the Impossible Travel feature in Microsoft Defender for Cloud Apps, which separates distant sign-ins by legitimate users from hacking attempts.

With the influx of data coming from the suddenly expanded landscape, the team used Microsoft Purview to address data governance and compliance concerns. They create data policies within Microsoft Purview that apply its rules and standards for data safety. School districts must protect personally identifiable information (PII) about students, teachers, and staff. Schools in the United States also need to protect students’ educational records under the Family Educational Rights and Privacy Act (FERPA) and restrict inappropriate or harmful internet content under the Children’s Internet Protection Act (CIPA). “Our job is to protect student and staff data, no matter what,” says Phillips. “Because we have Social Security numbers, health data, and other sensitive data in our student information systems and enterprise resource planning system, we must have a robust information security system in place.”

Staying ahead of stressful influences

The social isolation of the early stages of the pandemic profoundly affected today’s youth. “We’ve seen an uptick in emotional stressors for kids, possibly due to COVID-19,” says Phillips. “It may also be that some of that stress was there before, but without the tools to understand the undertones in the content that our students were exchanging, we weren’t aware of it. With our commitment to innovation, we are leveraging technology to see more than we did previously.”

Districts also face the challenge of protecting a sophisticated user base that lacks life experience. PWCS protects this vulnerable population with Microsoft Purview while also safeguarding their privacy, because the default pseudonymization of usernames coupled with role-based access controls preserves student confidentiality. If a situation requires contact with a student, investigators can access that information only through a system administrator. “We’re trying to protect our students from themselves in some cases,” says Newman. “We use the capabilities and features within Microsoft Purview to make sure that confidential information is properly handled and help keep harmful content away from our students.”

PWCS uses role-based access control to restrict access to sensitive data and apply customized security controls. Microsoft Purview Communication Compliance provides the tools to help detect regulatory compliance violations including FERPA and CIPA, such as inappropriate sharing of sensitive or confidential information and harassing or threatening language. Built with privacy by design, usernames are pseudonymized by default, role-based access controls are built in, investigators are opted in by an admin, and audit logs are in place to ensure user-level privacy. At PWCS, the district uses Communication Compliance to detect potentially damaging content that’s shared across applications.

Because kids often use images, acronyms, and emojis as a sort of social shorthand, Newman values the solution’s machine learning abilities, which help to zero in on the harmful messages. “Communication Compliance has great algorithms that we can train to identify the true intent behind seemingly innocuous images,” he says. “We adults might think that a frog emoji is a harmless, cute picture, when it’s really a coded way of calling someone ugly. Now we’re developing a protective shield around those images.” His team also uses Communication Compliance to detect inappropriate content in the diverse languages used by PWCS students. Sorting out the myriad ways that language can be used to wound is key to protecting students. Some words in the English language, for example, lose their everyday innocence when used in another. With so many students who speak other languages, it’s possible for student trying to bully to use a word in their native language, hoping to fly under the radar.

Enriching PWCS’s continual learning culture—a two-way conversation

Phillips sees her role as an IT leader in a K–12 setting as much more than IT strategy and administration. It’s the opportunity to teach upcoming generations about the importance and ethics of digital citizenship. That means using the capabilities within Microsoft Purview fully and with sensitivity. The district starts with Microsoft Purview Data Lifecycle Management to retain and refine and automate retention policies that ensure compliance.

The ability for students to store and share questionable content on their mobile devices—which sync to their OneDrive accounts—adds to the responsibility the school feels for detecting data misuse. PWCS administrators use Microsoft Purview eDiscovery to search for and tag sensitive content, in email and instant messages, even within third-party systems like its Canvas LMS—and protects that content even when sharing it with Microsoft Purview Information Protection. “With encryption standards in Microsoft Purview, we can better protect sensitive information not only within Prince William County, but when we share it with external parties,” says Newman. “In the future, we’ll also draw metrics from these technologies that will better illustrate our data security status and drive our resource requests.”

While Newman respects the creativity and innovation that come so naturally to digital natives, he knows that the potential for abuse lies on the other side of that technology aptitude. He and Phillips work with students in a down-to-earth way, constructively engaging with those who push the boundaries on things like compromising virtual private networks (VPNs) so that they can better protect PWCS assets while educating those students on cybersecurity. They make a point of sitting down with the young boundary-pushers, making it clear that no harm has been done, but kindly laying out the framework for ethical online behaviors. And to keep the educational benefit moving in both directions, Newman and Phillips ask those students to show them how they’ve attempted to circumvent security boundaries. “Having those conversations helps us understand how to best protect our network,” says Phillips. “If an eleventh-grader can impinge on our security, so can a hacker.”

Phillips and Newman regard the district’s relationship with Microsoft as a mutual learning experience that helps everyone. Their experiences provide a compelling example of a cost-effective, highly secure model for other districts.

Amplifying safety with a proactive approach

PWCS prioritizes a safe learning environment that stays out of the way. As Phillips puts it: “We’re not Fort Knox, but we’re not the Wild West, either. With Microsoft Purview, our students and staff don’t think about how we’re protecting them from harmful content. That’s exactly our goal.”

Those gains in data security converge in a more proactive stance for PWCS. “We’re pushing this progress forward, looking at some of the Communication Compliance features, like the Report a concern feature,” says Phillips. Students will be empowered to report concerning messages that they receive, like cyberbullying or sharing of malicious links, with this feature. “The biggest reward for us is when a counselor or principal thanks us for passing on a compliance alert from Microsoft Purview that showed that a student needed support,” she concludes. “We’re there for our kids, and with the right tools, we can be more proactive than ever before.”

Find out more about Prince William County Public Schools on Twitter, Facebook, and LinkedIn.

“Communication Compliance has great algorithms that we can train to identify the true intent behind seemingly innocuous images.... Now we’re developing a protective shield around those images.”

Randyll Newman, Supervisor of Student Data and Information Security, Prince William County Public Schools

Take the next step

Fuel innovation with Microsoft

Talk to an expert about custom solutions

Let us help you create customized solutions and achieve your unique business goals.

Drive results with proven solutions

Achieve more with the products and solutions that helped our customers reach their goals.

Follow Microsoft