The general rule of thumb is that the Assure service is agentless as long as the data is traversing the firewall or web filters that we're collecting data from. This refers to the firewall data and web filter data logs that we're gathering.
When it comes to the other environments that you're tapping into like Google Workspace and Microsoft 365, it has no dependency on the firewall and no dependency on an agent because we're using an API to connect to those environments and extracting all the necessary information regardless of where the student is, when, or what device the student is using. As long as it's authenticating to those environments and picking up activity, we will be able to extract this information.
If a student is using their devices off-campus, the only way for us to gather the firewall logs is if they're connecting back to the school environment using Palo Alto Networks GlobalProtect, Fortinet FortiClient, or similar clients.