Managed Google Account Issue #2

[Ditto]

For the first time ever after nearly four years of running with GSuite, we had a pupil log in to their Google account and was presented with a login challenge, where a code number was sent to their mobile phone. I believe the pupil must have entered their mobile number in to the 'Google Account'. It had all the behaviour that you'd expect to see with 2FA. I had a long chat with Google support and learnt a couple of things. This was a 'login in challenge' and not as a result of 2FA. We are an all-through school and recorded in Google's systems as a Primary and Secondary school. Pupils in those domains, should not get login challenges of this type. They're looking in to that. One other thing I learnt is you can temporarily (10 minutes) disable the check. Unfortunately without 100% IT cover during lesson times, and with 35 minute lessons, resolution would often be too late. In this instance the pupil had their phone in their bag, so we got by, but policy says they should be off or not even in the classroom.

 

As with my earlier #1 post, this all starts with the fact pupils are able to get into "Google Account" and enter stuff. As it's a 'managed account', we'd like to block all of that and avoid these issues.

 

Anyone else hit similar issues as it's looking like a feature request might be the only way forward.

[Dwigt]

We are getting login challenges every day for our students. I have contacted Google and they have been no help.

 

I'd say we average 10 a day, sometimes a lot more.

 

Any luck working out what's triggering them for you?

[Primus]

The login challenge tends to appear if students repeatedly get their password wrong.

 

I would turn off the ability for students to enrol in MFA. You can prevent students from editing the details in the Google account already in the admin console.

[Dwigt]

The login challenge tends to appear if students repeatedly get their password wrong.

I would turn off the ability for students to enrol in MFA. You can prevent students from editing the details in the Google account already in the admin console.

Thanks. We actually have that turned off already. The main issue with the login challenge is when students who don't have phones encounter it. The only solution I've found is to enable the 10 minute window for them as it happens. This is far from ideal.

 

The only thing I can think of trying is to put some info in to their Employee ID field and enable that as a response for the login challenge. The tricky bit is coming up something they'll remember. If they're already forgetting their password, giving them something else to memorise isn't ideal.

[Primus]

Sorry - the login challenge we get for students is simply the captcha style one. There's no need for students to have phones.

 

We set our passwords using AD and sync them to G Suite and prevent students changing their G Suite password because the two would get out of sync.

 

Have you got it set so that students can recover their own password?

[Dwigt]

Sorry - the login challenge we get for students is simply the captcha style one. There's no need for students to have phones.

We set our passwords using AD and sync them to G Suite and prevent students changing their G Suite password because the two would get out of sync.

Have you got it set so that students can recover their own password?

Our G-Suite users and passwords are synced from our school email (atomwide) so the students can't recover their own password, for the same reason as you.

 

I'm not sure why they're required to enter a phone number to pass the login challenge. A captcha sure would be much less hassle!

[Primus]

This has to be a setting in your admin console - we simply do not get these issues.

[Primus]

Have you got Login challenges turned on in the admin console?

[Dwigt]

Have you got Login challenges turned on in the admin console?

I don't have any options in the login challenge section of the admin console:

 

 

Is yours different?

[Primus]

No ours is the same - turned off.

 

Do you have the option turned on for students to be able to recover their account (different to change password I think).

[Dwigt]

No ours is the same - turned off.

Do you have the option turned on for students to be able to recover their account (different to change password I think).

So, I went digging through the support pages and found out that our organisation type was set to 'Higher Education', not 'Primary/Secondary Education', when it was created.

 

G-Suite support said that changing it should result in the SMS login challenge going away. So, fingers crossed, that should be that!

 

thanks for your help

[Ditto]

I must just be lucky with Google support as it's invariably excellent for me! The organisation type is key and changing to 'Primary/Secondary' should help. Interestingly, we had that setting and Google tracked it down as a known issue, which is apparently now fixed. Very interesting to see the mixed responses today. What I'd really like to have is the ability to stop the pupil's from entering a phone number into their account, which is the same situation with my 'Managed Google Account Issue #1' thread.

[Primus]

@Ditto - our students don't get the option to put their number into their account.

 

I can't actually find a setting that controls this but under directory and then profile editing we only allow them to change their photo.

 

Where are your students entering their mobile phone number? When staff or students here go into the my account section of Google they don't get any options like what you are talking about.