Setting up Music Ace Maestro at your school

1. Allow these websites

Add these to the allow list of your web filter (GoGuardian, Securly, Lightspeed, Cisco Umbrella and the like) and firewall. Allow them by name; category rules sometimes misfile a music-education site.

Please don't inspect or rewrite our traffic

Music Ace plays music in the browser with a real-time audio engine. It relies on security headers that tell the browser it may run that engine (Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy). A proxy or SSL-inspection appliance that strips or rewrites response headers makes lessons fail to load or play without sound. Please exempt the addresses above from SSL inspection, or make sure your appliance passes headers through unchanged.

Bandwidth

The first time a device opens a lesson it downloads the music engine and lesson media; after that the browser keeps a copy. If a whole lab starts at once on a slow connection, open Music Ace on each device once beforehand, or let a caching proxy serve the repeats.

2. Sign in with Google (schools on Google Workspace)

If your school's email is on Google Workspace, teachers and students can sign in with their school Google accounts; nobody needs another password.

Google Workspace for Education requires an administrator to approve a third-party app before users designated as under 18 can sign in to it. Until you do, students see Error 400: access_not_configured (or admin_policy_enforced if the app is blocked). To approve Music Ace:

1. In the Google Admin console, go to Security → Access and data control → API controls → Manage Third-Party App Access.
2. Choose Configure new app and search for our OAuth client ID:
   843830659412-bdfb9j9070rlb4l5c8nc698kdvfe2ega.apps.googleusercontent.com
3. Choose the organizational unit that holds your students (or your whole domain) and set access to Trusted.

Music Ace asks Google only for the user's name and email address (the openid, email and profile scopes). It never reads Gmail, Drive, Classroom or any other Google data.

3. Sign in with Microsoft (schools on Microsoft 365 / Outlook)

If your school's email is on Microsoft 365, teachers and students can sign in with their school Microsoft accounts. Harmonic Vision is a Microsoft verified publisher.

Many districts don't let users approve apps for themselves. In that case the first student to try sees "Need admin approval" (error AADSTS65001 or AADSTS90094). An administrator with the Global Administrator, Cloud Application Administrator or Application Administrator role approves Music Ace once for the whole organization, either way:

• Open this link while signed in as that administrator and accept:
  https://login.microsoftonline.com/common/adminconsent?client_id=9991ca36-1721-4f6d-bbc3-56ae588473a9&redirect_uri=https://teacher.harmonicvision.com/
• or, in the Microsoft Entra admin center, open Enterprise applications → Harmonic Vision → Permissions and choose Grant admin consent. The app appears there after anyone in your organization has tried to sign in once.

If your tenant requires user assignment for enterprise apps, also assign the Harmonic Vision app to your teacher and student groups. Conditional Access policies apply as usual.

Music Ace asks Microsoft only for sign-in and the user's name and email address (openid, email, profile and offline_access). It requests no Microsoft Graph permissions: no mail, files, calendar or Teams data.

4. Devices and browsers

• Use a current version of Google Chrome or Microsoft Edge on Chromebooks, Windows or Mac. Keep ChromeOS and browsers updated; the audio engine relies on recent browser features.
• Browser extensions that block content (ad blockers, some filter extensions) can stop sign-in or lessons from loading. If one device misbehaves and another doesn't, try a guest window first.
• Sound starts after the student's first click or tap; browsers require that. Check that the device's volume isn't muted by policy.

5. MIDI keyboards

• Students can play along on a USB MIDI keyboard. Any class-compliant USB keyboard works without drivers on Chromebooks, Windows and Mac.
• MIDI needs Chrome or Edge. Safari does not support MIDI devices in the browser.
• The first time, the browser asks whether the site may use MIDI devices. Students must choose Allow; on managed devices, make sure your policies don't block that permission.

6. Headphones, Bluetooth and latency

Music Ace's rhythm games score the student against the beat, so the time between a note being played and it being heard matters.

• Wired headphones are best. They add no noticeable delay and keep a lab quiet.
• Bluetooth earbuds and speakers add delay, often a tenth to a third of a second. Students hear the music late and rhythm games feel "off". Use wired headphones where you can; if you must use Bluetooth, keep each student on the same pairing so the delay stays consistent.
• USB and Bluetooth audio adapters vary too; if one device feels late and the next doesn't, compare their audio output first.

7. Trackpads and mice

Many lessons ask students to drag notes onto a staff. That is easy with a mouse and harder on a trackpad, which most Chromebooks have.

• Watch our short video on dragging notes with a trackpad (link below), and show it to your students.
• On a Chromebook, turning on tap-to-click (Settings → Device → Touchpad) helps many students.
• For younger students, an inexpensive USB or wireless mouse makes dragging much easier.

8. Email

Teachers and students receive account email from us: sign-up confirmations, password resets and support replies. Product news goes only to teachers who opt in. Please allow mail from harmonicvision.com and news.harmonicvision.com through your mail filter, especially for student mailboxes that only accept mail from inside the district.

9. Accounts, rostering and shared devices

• Teachers can add students themselves, import a class list, or (for ClassLink districts) have classes come from your rostering system automatically.
• On shared or lab devices, students should sign out at the end of class. Signing out of one Harmonic Vision site signs them out of all of them.

10. Student data privacy

We collect only teacher and student names and email addresses, plus lesson progress and game scores. We never sell data or use it for advertising. Read Student data privacy at a glance; our Data Privacy and Security Plan and signed state privacy agreements are available on request.

11. Troubleshooting