Supply Staff + Automated M365 Provisioning

[gsk]

Hi All,

 

Just wondering how you're all tackling the automated creation and deletion of M365 accounts for Supply staff to be able to access PCs via Intune, MIS via SSO, and emails?

 

Where Arbor is the MIS, for long term supply staff, we're currently recommending creation of a staff profile where they're excluded from the Workforce census and their contract dates entered accurately. We're getting a lot of push back regarding short-term supply, especially where they don't know until they arrive on site what their name is going to be. 

 

Thanks,

[DavR]

We do similar re long term supply, anyone who's going to be with us a long time gets treated as full staff, minus the tick box for SWF Census.

 

For on the day supply, we've found there's not much choice other than to have generic accounts, tied to a generic supply teacher profile in Arbor. It's up to you how many you have, whether you enable email (we don't), and how you rotate passwords, but in practice it seems inescapable. If we don't make generic accounts available, they end up getting another member of staff to logon for them, which is an even bigger security headache.

 

One useful restriction we do have on the suppy accounts though is Conditional Access to stop them being able to login from outside the school perimeter. It reduces the risk significantly.

[DrCheese]

Same as @DavR - We have a few generic accounts linked to generic accounts on Bromcom. They can't be logged on externally (Same Conditional access stuff)

We coded a PHP page donkeys years ago that lets a member of the cover team type in a supply teachers name with an time span (Up to 10 days) that the account is active for. After that's up, we change the password to a new one & update the system.

 

Long term cover (Eg a term) get created as a staff member like any other, but off census like you say.