Pupils, teachers, substitutes, parents. Same captive portal, different policies behind it.
At Vandelay Elementary every audience signs in with the email they already have. A pupil on @students.vandelay-elem.edu gets the student policy: three devices, school hours only, classroom VLAN. A teacher on @vandelay-elem.edu gets staff policy with more devices, full day, full LAN. A substitute follows the Class ID their teacher issued that morning. A parent at the autumn conference clicks Click-to-Connect once and forgets the network exists. SAML SSO via Google for Education or Microsoft Entra sits next to email login as a second path for schools that already federate. You don't need it on day one.
- Policy-based email login. Pupils sign in with @students.vandelay-elem.edu, staff with @vandelay-elem.edu. Each policy gets its own VLAN, device quota and access window.
- Class ID (conference Sign In). Teachers issue a short-lived class code for substitutes, field-trip evenings or visiting lecturers — no IT ticket.
- Self-Service Whitelisting for the small learning devices: document cameras, the class iPad fleet, an attendance kiosk. Teachers add them themselves.
- SAML SSO via Google for Education or Microsoft Entra as a second path, for schools that already federate.
- Parents and conference visitors via Click-to-Connect. 2h sessions, no front-desk involvement.
