In a recent episode of the Cloud Design Box podcast, Martin Byford-Rew, Head of Digital Systems at King Edward VI Foundation, discusses the importance of multi-factor authentication (MFA) in schools and the strategies that institutions can use for successful implementation.
MFA offers significant advantages in educational settings.
By introducing an additional security layer, MFA safeguards against unauthorised access, even if a password has been breached.
The rise of cyber threats in education is alarming. And with schools now managing more sensitive digital information than ever before, cyberattacks pose risks to student addresses, financial details, staff information and other personal data tied to HR, Finance and other departments.
Schools must elevate their cybersecurity strategies beyond weak passwords and outdated practices.
Meet Martin Byford-Rew
Martin has extensive experience in education technology, previously working as a Microsoft 365 trainer and consultant. He has collaborated with Cloud Design Box on several SharePoint intranet projects, helping schools and multi academy trusts (MATs) build secure and efficient digital systems.
Now, as Head of Digital Systems at King Edward VI Foundation, Martin is leading the implementation of robust cybersecurity measures in schools.
What is Mutli Factor Authentication (MFA) for schools?
MFA serves as a digital barrier against harmful cyberattacks. Users must log into a system with two or more verification factors, such as emails or accounts.
Many of these additional verification factors, such as receiving a taxt code on your phone after entering your password or using Face ID to unlock your phone, are likely familiar to you. You might have also encountered similar verification requests during payments through your banking app. This familiarity can help ease the transition to MFA.
Make Multi Factor Authentication (MFA) work for schools
While the prospect of rolling out MFA across a school or MAT may seem daunting, Martin shares practical strategies to make the transition smoother.
His insights show that the process is manageable and beneficial for the school’s security:
Prioritise staff accounts first
MFA should be rolled out across staff accounts first, then explore ways to extend MFA to students where possible.
“It’s not optional for staff, because there’s such sensitive data that teaching staff have access to. You’ve got to be so careful, because obviously, if any of that stuff leaks out, it’s really, really bad,” explains Martin.
Set up conditional access rules to bypass MFA
Martin gives a great tip for reducing login friction and frustration:
For trusted school networks or managed devices, you can set up conditional access rules to bypass MFA:
“If you’re in a school on a school network that has known IP addresses, you can put those IP addresses into a conditional access policy that will mean the user won’t be challenged for MFA because we know they’re in school and they’re likely to be a member of staff or student.”
Integrate MFA with other platforms
Many Management Information Systems (MIS) and curriculum websites can secure their data using Microsoft 365 or Google Workspace.
Martin emphasises:
“Certainly, an MIS or an HR data or a finance system should have [MFA]… If you do adopt this for your organisation, for your school using Microsoft or Google, and then you can leverage the existence of that to give enhanced protection to your MIS, then that’s a good thing to do.”
Regular training and support
Training is essential. Many students and staff may struggle with digital security changes, and providing them with the skills and knowledge is crucial for maintaining good cybersecurity discipline. This ongoing support will make everyone feel prepared and supported in the face of cyber threats.
Choose the right MFA methods for your school or trust
Conditional access
This effective method exempts students from MFA when using a school network but requires MFA when accessing systems from any other network, such as from home.
Fast Identity Online (FIDO) key
This is a device that students can plug into ports on any of the devices being used. It allows rapid second authentication, but misplacing the device can risk security and workflow.
Personal devices
This allows each student to have a tablet or laptop that integrates smoothly into the school’s network and simplifies authentication. However, this method could incur substantial costs for the school.
Single sign-on (SSO)
SSO pairs excellently with MFA to deliver a seamless and secure login experience. Users only need to remember a single set of credentials, reducing the risk of weak or reused passwords. Combining SSO with MFA provides a convenient yet robust security solution.
Other tools worth a mention
Authenticator apps – Use trusted authenticator apps, such as Microsoft Authenticator, Google Authenticator for a secure and easy-to-use option.
Hardware security keys – Ideal for staff who need a highly secure, phishing-resistant method.
SMS or email codes – These are common but less secure than other MFA options.
Schools can’t afford to ignore MFA – so what’s next?
As cyber threats advance, schools must adapt.
Contact our team of Microsoft 365 experts today to talk about making Microsoft 365 more secure.
Watch the full podcast for expert insights on implementing MFA in schools.
