SIMS NG and Supply Staff

[Jobos]

Primary here.

 

I'm looking at how to secure SIMS logons given to supply teachers. At the moment the office gives the supply a card with a domain logon and SIMS7 will open as it uses trusted auth. Now with the move to SIMS NG I have made a supply logon but if the office gives that out the supply will have the details they could use at home whereas SIMS7 will only work on-site. The obvious solution is the NG password gets changed after each supply teacher but what's the likelihood of the office changing it or telling me there is a supply in.

 

How do other schools handle this?

  

[ozydave]

Did you ever get an answer to this?

[NetworkDirector]

On 09/10/2026 at 12:54, Jobos said:

Primary here.

 

I'm looking at how to secure SIMS logons given to supply teachers. At the moment the office gives the supply a card with a domain logon and SIMS7 will open as it uses trusted auth. Now with the move to SIMS NG I have made a supply logon but if the office gives that out the supply will have the details they could use at home whereas SIMS7 will only work on-site. The obvious solution is the NG password gets changed after each supply teacher but what's the likelihood of the office changing it or telling me there is a supply in.

 

How do other schools handle this?

  

Don't give them access to SIMS at all, I would recommend printing them the Timetable off, and using Paper registers which get sent down to the office. 

[psydii]

Use conditional access policies to restrict the supply accounts to your wan ip and your managed devices.
 

Ideally have a hardware MFA token that is issued with their paperwork too, since all MIS access ought to be protected by MFA.

 

(if hybrid, you can also use AD Account login restrictions to restrict the times and pc’s to which they can logon)

Edited Sunday at 07:36 by psydii

[NetworkDirector]

11 hours ago, psydii said:

Use conditional access policies to restrict the supply accounts to your wan ip and your managed devices.
 

Ideally have a hardware MFA token that is issued with their paperwork too, since all MIS access ought to be protected by MFA.

 

(if hybrid, you can also use AD Account login restrictions to restrict the times and pc’s to which they can logon)

Can you do that in SIMS NG?

I would of said use Microsoft 365 as SSO, then lock that account to the WAN IP using Conditional access, and have a rotating password daily so that supply's don't have a static password to the account.

[psydii]

Sorry, yes I assumed 365 sso.

[Boredguy]

Well in theory, after half term is over PPG will roll out the new SNG login method which is the SSO for our own 365/Google tenancies to allow the CA rules

[psydii]

One could have sso already in place! (the initial user on-boarding t is/was painful, but once set up it's wonderful and we have CA policies in place for it)  I am so very much looking forward to SSO being the default, and the onboarding being straightforward.

 

If PPG can get that in place before classcharts remove their recommendation that we fall back to the MIS for attendance, I'll have 100 new users for them immediately.