SkieWhich settings can be locked at organisation level in Skie so lower levels cannot change them?
An organisation admin can set rules at the top that schools, branches and groups cannot change below, such as hardening switches and the web filter. Rules flow down, and the most specific level applies last, but a locked setting stops that. The always-blocked list of VPN, proxy and alternative browsers applies whatever any list says.
Delegation only works when the centre can say these things are not negotiable. Locking at organisation level is how you say it.
The settings in question are the ones in your policy that affect safety and tamper protection: the hardening switches such as blocking factory reset, safe mode, developer options and uninstalling Skie, the web filter, and some switches that are global, such as blocking unknown sources. Which of them you lock, and which you leave adjustable, is your decision. Optional switches, like disabling the camera or Bluetooth, can be set at organisation level and either locked or left to lower levels.
Some protections are not adjustable by anyone. The always-blocked list covers more than 50 alternative browsers and all VPN, proxy and DNS changer apps, whatever an app list says. Blocking beats allowing in every combination.
To check what is in force, use the effective policy view on a device and the where-used view on a shared policy. The impact preview shows what a change will touch before you publish. The audit log records who changed what.
The roles line up with this. Organisation admins set and lock. School admins, branch heads and teachers work within it. Skie does not currently offer white labelling or SSO, so locks are about settings, not branding.
Practical tip: lock fewer things than you think and explain each one in your policy. Over-locking pushes staff to ask for exceptions, while a short, clear list is easier to defend.