Multi-factor authentication in schools: a usable rollout

Decide which accounts need attention first

Multi-factor authentication, usually shortened to MFA, combines different ways of proving identity. It makes a stolen password less useful to an attacker, although the strength of the protection depends on the method and the surrounding account controls. It is part of account security rather than a replacement for it.

Start by listing administrative accounts, email, remote access and services holding sensitive information. Include supplier access and accounts used by school leaders or finance staff. The DfE Cyber Security Hub highlights privileged accounts and externally accessible services as important places to apply MFA.

Record where the school already has MFA, where it is optional and where it is unavailable. An account that can bypass the normal sign-in route through an older method may need additional work. Ask IT support to check actual enforcement rather than relying on the presence of an enrolment screen.

Choose methods people can use reliably

The NCSC distinguishes between methods with different resistance to phishing and other attacks. Where supported and appropriate, phishing-resistant methods such as FIDO2 security keys or suitable passkeys offer advantages over codes that a user can be tricked into entering on a false sign-in page.

The school still needs to consider compatibility, accessibility, recovery and support. Test the chosen method on shared workstations, staff laptops and relevant remote-access services. A security key that works on an office desktop may need a different connector or arrangement for another device.

Do not assume every member of staff has a suitable personal smartphone or is willing to use it for work. Offer a school-supported alternative. Explain what an authenticator application does and what information the school can or cannot see, based on the actual product and configuration.

Pilot the whole journey

A useful pilot includes enrolment, ordinary sign-in, a forgotten token, a replacement device and account recovery. Involve staff with varied working patterns, including part-time colleagues and people who use accessibility features. Record where instructions are unclear before extending the rollout.

Give staff a scheduled opportunity to enrol with support available. Avoid enabling enforcement immediately before a reporting deadline or a school holiday without cover. Keep the explanation concise: which account is changing, what to prepare, where help is available and when the new method becomes required.

Test that the person can complete the task after restarting or returning the next day. An assisted first login does not demonstrate that the everyday process is understood.

Make recovery as careful as sign-in

A strong authentication method can be undermined by a weak help-desk reset. Establish how staff identity is checked when a token is lost or a phone is replaced. Do not rely solely on information that could be found in a public staff directory or a convincing urgent message.

Where the platform supports multiple approved recovery methods, enrol them deliberately and explain their use. Store recovery material securely, with access appropriate to its sensitivity. Avoid distributing reusable recovery codes through ordinary shared documents or email threads.

Emergency administrative access needs a separately designed process. Document who can use it, how it is protected and how use is reviewed. Test that it works without turning it into a convenient daily bypass.

Teach the unexpected-prompt response

Staff should know that an approval request they did not initiate is something to report, not something to accept to make it disappear. Explain the school's reporting route and how to stop using a suspicious sign-in page. Training should use the actual screens and language people will encounter.

Do not promise that MFA makes phishing impossible. Codes, approvals and compromised sessions can still create risk, and financial processes still need independent verification. Keep software updated and review account alerts alongside authentication controls.

Keep enrolment current

Add MFA setup and recovery arrangements to staff onboarding. Remove or transfer access appropriately when roles change, and revoke access when someone leaves. Include temporary staff and external support accounts in periodic reviews.

Check for accounts with incomplete enrolment, unnecessary exemptions or methods that no longer meet school requirements. Assign an owner and expiry date to any exception. A temporary workaround should not become an unrecorded permanent access route.

Finally, evaluate whether the rollout reduced exposure without creating unacceptable barriers. Review support requests, failed sign-ins and recovery incidents. Connect the findings to the wider school cyber security plan and staff onboarding process, so authentication stays manageable as people and systems change.