SkieCan a student join a phone hotspot to get on an unfiltered network?
They can still join, but the filter does not stay behind. Skie sets the filtering DNS on the device, so it applies on any network, and hotspot and tethering are blocked on managed devices. Wi-Fi settings can also be locked after setup, if you choose to.
Network-level filters have one known weakness: a different network is a different path. A student with a second phone shares a hotspot, joins from the managed tablet, and the school firewall is no longer in the way.
Skie does not depend on the school network. The filtering DNS is a device setting, locked by the device owner, so lookups go to the filter on any Wi-Fi or mobile data. That is why joining a hotspot does not remove filtering. The exception is a network that blocks the encrypted DNS port, where the device uses that network's DNS and the dashboard flags it.
Skie also blocks the device from being a hotspot or tether itself, so a managed phone cannot give other kids an open path. Wi-Fi settings can be locked, as an optional switch, so students cannot add networks at all. Admins can push Wi-Fi profiles, stored encrypted, if the device should join only known networks.
Mobile network settings can be locked and airplane mode can be locked, if you want those kept as set. Disabling mobile data entirely is not available yet.
Tip: for a hostel or exam hall, combine a Wi-Fi lock with the filter. For a college where students use their own SIM data, rely on the filter that travels with the device and on the compliance score to show it is active.