How do you manage agency cover access?

[mikeglover]

I have been asked to setup generic agency cover accounts for Arbor and Microsoft 365 so when an agency staff comes in to cover a lesson they are given an android tablet, given a username and password to access Arbor and Microsoft 365 where powerpoints will be shared with them on the lesson.

As they are agency, they will probably be just for that day and we will no longer see them again and another agency will be shared the details.

This quite a security concern sharing out login details with agency and one possible solution is automating rotating the password every single day, which I don't find appealing and a hack on a solution.

 

What do other schools do in this situation? Do they get accounts? Do you regular change the password?

I'd be curious on peoples thoughts on this.

 

Have a good day.

[3s-gtech]

Here - no name, no account. They're added by name to our MIS, which then syncs and creates their account. We then have an access trail. We don't use shared accounts. It means that every supply agency staff member has to be put into our MIS, but for safeguarding that seems like a small step.

[Devaleth]

Day-to-day supply - generic microsoft login. No MIS access. Laptop + generic staff lanyard loaned for the day from an an internal set managed by cover admin. Signed in as a visitor every day at reception.

Long term supply - personalised microsoft login + MIS access. Personal laptop and staff lanyard given which is allowed to be taken offsite. Sign in as member of staff at reception.

 

[Frodo_Baggins]

On 05/06/2026 at 12:21, 3s-gtech said:

Here - no name, no account. They're added by name to our MIS, which then syncs and creates their account. We then have an access trail. We don't use shared accounts. It means that every supply agency staff member has to be put into our MIS, but for safeguarding that seems like a small step.

 

We have discussed the same, how do you handle last minute cover where they arrive and need to teach straight away? (I know this is a school issue and not an IT one) - Do you have your scheduled tasks for account creation run more regularly? (currently our Salamander runs nightly)

[psydii]

dedicated cover accounts, restricted to specific laptops, with access to the cover folders only. passwords rotated on a weekly basis. Accounts can't be used unless on the specific cover laptop to which it is attached. (MFA enforced when devicename  does not match. Somebody in the IT office has the all the accounts in their Authenticator)

 

For anyone here longer than a few days, they go into the MIS and get a real account, and if they are here long enough, they get issued a non-covers/supply laptop.

[3s-gtech]

32 minutes ago, Frodo_Baggins said:

 

We have discussed the same, how do you handle last minute cover where they arrive and need to teach straight away? (I know this is a school issue and not an IT one) - Do you have your scheduled tasks for account creation run more regularly? (currently our Salamander runs nightly)

That's covered with our 'failing to plan is planning to fail' policy. Whoever booked them at 6am is welcome to put them in SIMS, where they'll sync across with our morning task. Otherwise, I have to do it when I come in and it'll usually be ready 15-20 minutes into the day.

[KK20]

we have a couple of generic agency account, they have conditional access for onsite logon only and a USB yubikey each.   There is a sharepoint document library for "cover work" and the accounts have access to this sharepoint folder.  Longer term agency get their own accounts.  Yubi pin get changed when the sheet of paper wears out or gets lost (usually weekly).  I was thinking about getting a token2 OTP card and burning them to an account (renaming the accounts if necessary), that will save changing yubi pins.

[FN-GM]

9 hours ago, Frodo_Baggins said:

how do you handle last minute cover where they arrive and need to teach straight away? 

 

How does your other schools processes manage this? For example, their health & safety site inductions etc

[Devaleth]

9 hours ago, FN-GM said:

 

How does your other schools processes manage this? For example, their health & safety site inductions etc

 

Info is provided on a pamphlet so supply can read at the earliest opportunity (or refer to when relevant). We also have posters scattered around the building detailing first aiders + safeguarding teams with photos.

 

For a new arrival whilst going through their vetting documents we'd be giving a quick explanation of how the school works, nearest head of department etc and how/who to contact for in class emergencies. On the way up to their first classroom we'd point out evacuation routes and assembly points.

 

If they're late we'll obviously rush through that as quick as possible whilst a person on call is baby sitting the class. However, a good induction could easily take 30 minutes or more which is just impractical at the best of times so it's very much sink or swim.

[FN-GM]

31 minutes ago, Devaleth said:

a good induction could easily take 30 minutes or more which is just impractical at the best of times so it's very much sink or swim.

 

Health and Safety should come above everything else.... Anyway not your wheelhouse!

[mikeglover]

Thank you all for your replies. It's given me some food for thought.

I'm liking the idea of restricting the login to a set of devices, they are going to be given Android Tablets which are intune managed home screens so I'm guessing I could setup conditional access so generic cover accounts can only access those Android Tablets and nothing else. If some one could point me to a guide I'd appreciate that as not something I've covered in intune.

If not, getting Yubi key so they have to plug that into the tablet to login sounds like a good idea.

 

Does seem to be an issue that others face which is reassuring that it's not just a unique procedural thing in our school.