SkieHow do organisation defaults and rules reach schools and groups?
Defaults set at the organisation level flow down to every school, branch and group. Each lower level can refine them, and the most specific level applies last, except that a block set above cannot be allowed back below. This lets head office fix the essentials once while schools adjust what they are allowed to.
The structure is organisation, school, branch, group, student and device. A rule set at the top applies to everything beneath it unless a lower level changes it. This is how a trust with twenty schools can switch on the same hardening and the same web filter everywhere without visiting each school's settings.
Lower levels refine. A school may choose a different app list for its senior block, and a branch may add an extra schedule. Because the most specific level applies last, the group closest to the device usually has the final say on ordinary choices.
The exception is blocking. A block placed higher up cannot be undone further down. That is the line between defaults you want enforced and defaults you want people to adjust. If you want a setting to be adjustable, do not block it at the top. If you want it fixed, block it there.
Roles follow the same shape. An organisation admin can change the organisation defaults, a school admin handles the school, and a teacher or class admin sees only their own class. A practical tip is to keep the organisation layer short and strict, covering the hardening switches and the filter, and to push variety down to groups. Use the effective policy view to confirm any single device's end result.