MFA / Security - Staff & Students

[Alastairb25]

Hi All,

 

Currently we do MFA for Staff

Students restricted to UK for sign in with no MFA

 

Had request to allow access from our Public IP without MFA

Thought about this, I am going with no..

Yes its a pain having to sign back in

Just because your onsite, Student could attempt to sign in and so forth so MFA still should be in place

 

Students

We Went with UK only due to VPN use and then Educated re not using free VPN

That said possible accounts do get compromised

So MFA for Students, but if so how do other Schools achieve this, if you have done it?

Also in light of phone ban this might not be practical

We use 365 related systems for Homework and so forth, so making just onsite from our Public IP would not be an option

 

Thanks,

Alastair

Edited July 3, 2024 by Alastairb25

[gszech]

Does anyone know how to implement MFA on Google so it only asks for two steps if the user is outside of the UK ?

[Davit2005]

Does anyone know how to implement MFA on Google so it only asks for two steps if the user is outside of the UK ?

 

Personally wonder why you would, you are saying no need to MFA anywhere in the UK cause it is trusted? Leaving your self wide open. You might as well not use MFA at all, lol.

Edited July 3, 2024 by Davit2005

[gszech]

Personally wonder why you would, you are saying no need to MFA anywhere in the UK cause it is trusted? Leaving your self wide open. You might as well not use MFA at all, lol.

 

Thanks for the help.

[Alastairb25]

It was better than nothing and flagged on a basic level VPN use

[jthompson]

Does anyone know how to implement MFA on Google so it only asks for two steps if the user is outside of the UK ?

 

Sadly it's not possible to do that with Google Workspace. None of the Context-Aware Access stuff will enable you to say that 2-step can be bypassed. The end-user ticking "trust this device" when signing in is the only bypass mechanism going, I believe.

[jmak]

Thanks for the help.

I can see that the tone of reply could grate, but the point is valid. If you're implementing MFA to improve security, allowing a bypass for anyone in the UK (or pretending by using a VPN) massively reduces the benefit.

[Alastairb25]

We do not use MFA for Students

Restrict to UK was an initial option while we think about the problem

Mobile phone ban in 24/25 year

Various systems use 365 so need access offsite

 

In similar scenarios how have other Schools handled this, eg if you did use MFA, how?

[Rob_D]

We only force MFA for staff at the moment. But we use conditional access policies to to bypass MFA for users on the school network (presenting from the school's external IP). No need for phones in school, but they'd be prompted for MFA when connecting from home. This seems to be the "standard"/most common way of setting up MFA at the moment. Edited July 4, 2024 by Rob_D

[jthompson]

Google Workspace here, but we're not able to enforce MFA for student accounts.

Context-aware access doesn't allow us to make MFA exceptions for on-premises sign-ins, and we have a policy of no mobiles in classrooms. We restrict student sign-ins to the UK, as that's about as good as we can do.

 

If we manage to get to 1:1 Chromebooks, then I think we could enforce MFA for students, on the assumption that the vast majority of student sign-ins on the premises will be on an already trusted device.

[Alastairb25]

In this case you would have Student use their own device for MFA?

I guess its fair to say most would have a smart phone nowadays

[Rob_D]

In this case you would have Student use their own device for MFA?

I guess its fair to say most would have a smart phone nowadays

Yes, if they're connecting from home then they're using their own device already.

Odds are pretty good they'll have access to a smart phone or tablet device at home (for a lot of them, I imagine they're using an iPad for their online homework anyway) and you can even MFA using a landline if you have to.

[jthompson]

I think under a 1:1 scheme we'd probably offer a security key as an alternative to just using an existing personal mobile. That way you're able to support those families that can't or prefer not to involve mobiles at all. My expectation would be that the majoirty would just opt for using an existing personal mobile for their MFA.