Managing school supplier and service account access
School supplier and service accounts should have clear organisational ownership and controlled access. Identify the account’s purpose, authorised users and recovery arrangements before adding another login. This guide concerns managing accounts with the relevant providers; reading public Schools Direct resources does not open a retail account or grant access to an external service.
Record ownership and the purpose of access
Create an account register showing the provider, service, school owner and responsible administrative role. Keep credentials in the school’s approved secure system rather than in the register itself. Distinguish ordinary use, purchasing approval and account administration; one person may need a login without needing authority to change billing or add users.
The DfE cyber security standard supports access appropriate to staff roles and a controlled process for joiners, movers and leavers. Apply these principles through the school’s IT and finance arrangements. Avoid establishing a critical account around a personal email address that the school cannot manage during a handover.
Test recovery before an absence creates a problem
Ask the authorised administrator to verify recovery contacts and the provider’s supported security features through the approved process. Implement authentication requirements with the IT team, including appropriate multi-factor protection. Do not circulate recovery codes or passwords by ordinary email to make cover easier.
For a shared purchasing service, nominate the school role that receives operational messages and the authorised users who can place or approve requests. Rehearse what happens if the usual administrator is absent. The school should know the legitimate recovery route without needing to impersonate a departed member of staff.
Review access when roles change
Include supplier and service accounts in staff handovers. Remove or adjust access through the authorised process when duties change, and check any scheduled orders, notifications or billing contacts associated with the departing user. A change to a mailbox does not necessarily change every provider record linked to it.
Record account changes and the approving role. Review unused accounts and services with the relevant business and technical leads before closure so records or ongoing obligations are handled appropriately. If access appears compromised, use the school’s incident process promptly rather than continuing through an unexplained login or payment request.
Action checklist
- Record the school owner and purpose of each account.
- Separate use, purchasing and administrator permissions.
- Verify secure recovery and authentication arrangements.
- Include accounts in role changes and staff handovers.
Common questions
Should a school share one password so any staff member can order?
Use the provider’s supported authorised-user arrangements and the school’s access controls. Individual accountability and appropriate permissions are preferable to an uncontrolled shared credential.
Sources and scope
Source titles are provided for reference. Check the current original guidance and your school's circumstances before making a policy or compliance decision.
- Schools Direct editorial — Original school resource planning guidance and worked examples. Checked 1 November 2026.
- Department for Education — Meeting digital and technology standards: cyber security core standard. Checked 1 November 2026.