Search the Community

We can't be the only ones scratching our heads over this one! Supply staff. Schools can't run without them but from an IT and safeguarding perspective, they sit in this really awkward middle ground. They need enough access to actually do their job on the day, but they're in and out so fast that proper account management often goes out the window. So what are you all actually doing? I know a lot of schools are still handing out a shared "supply" login at the front desk. I get why as it's quick and easy when someone rocks up at 8:15am, and need to be teaching within 30 minutes. But then MFA comes along and suddenly nobody can agree whether it should be on a phone, whether it should be a hardware key, what kinda device they get to access, do you just generate one-time passcodes... and then the password gets written on a Post-it, and before you know it you've got no idea who's actually been logging in and whether the account has been reset nightly. Most of this has just grown organically because schools are busy and people are just trying to get through the day. But I think it's worth trying to figure out what a sensible approach actually looks like, especially as Cyber Essentials and general expectations around account security keep moving the goalposts. Are you using named accounts for supply? If so, how are you turning those around quickly enough when someone's booked last minute? Have you found a way to make MFA work that isn't a complete nightmare in practice? Or are you still in the "we know it's not ideal but here we are" camp? Not here to judge anyone, cause I know this is a constantly moving target. I'm genuinely curious what's working (or not) for people, and how we can work this out as a sector.

Hi all, I lead a small IT team comprising of myself and 4 techncians managing just under 50 schools. I am making it a requirement that all our schools we have global administrator access to have app based MFA setup for access. Currently we have an office mobile receiving SMS codes which we request from our admin staff who are in office during the weekdays which we need to request over teams. I don't find SMS authentication secure and this also limits our access to our portals when attempting to do out of hours work. My ideal setup would be app based authentication that can be shared with all my technicians using a single login. I'm aware MS authenticator can be signed in on multiple devices, however I'm seeing conflicting reports on whether the passcodes actually sync across devices, or whether restoring the accounts saved on another device will de-activate the device the accounts were backed up from. Any one else in a similar position or have suggestions on best practice to work around this?

Good afternoon, I have been a long term watching in the forums and seen that a lot of schools are starting to move to onedrive for homedrives and sharepoint for network drives, Just a few questions : I would be mapping the shared network drive using the ondrive GPO - how does this work with MFA? How have people got round the 256 character limit, as teachers love having subfolders, was it just a culture change? Finally, how do you manage student logins, as adding the sharepoint using the gpo can take anywhere from 5mins to 8hours. Thanks and regards

We oversee multiple schools that have transitioned to a cloud-based infrastructure without maintaining any on-site servers. To accommodate this shift, we've set up Microsoft 365 accounts for all individuals, including students. As you might be aware, starting in March, Microsoft will mandate the use of Two-Factor Authentication (2FA), a move that presents significant challenges, especially for our student users. To address this, we're considering implementing a conditional access policy that would waive the 2FA requirement when users are connected to the school's network. We're in discussions with the LCC to facilitate this through the use of their external IP addresses as designated trusted locations. The hurdle we're facing is the initial mandate for users to configure 2FA, which serves as a "baseline" security measure. This requirement could potentially disrupt the user experience significantly, especially since our schools with hybrid server setups, currently rely on Single Sign-On (SSO) policies. Does anyone know of any solutions or workarounds?

Hi, I want to setup mfa for only teachers and staff. I need the ability to set conditional mfa?? I guess I need a subscription, would this subscription be for just me (the admin to make the changes) or everyone affected by my changes? cheers

Hi all, I work in a MAT that's looking at deploying MFA across all of our staff users. We've initially ran a script to enable this manually using a CSV however now we want to be able to automate the MFA process for newly onboarded staff without having to do this manually. Microsoft have proposed Conditional Access as this prevents staff from having to enter 2FA codes within the classroom however as a result of adding the external IP as a trusted location, this bypasses the setup of MFA for new staff. This making it a security risk as if the account was compromised and MFA hadn't been configured then the bad actor could just configure the app codes to bypass MFA. We have over 2500+ staff so we're looking at some sort of automation but so far the only help Microsoft have provided is to disable trusted locations or to ask staff to configure MFA upon first sign in manually by visiting the MFA setup link. Does anyone know of a way to automate the process so it changes the MFA status from Disabled to 'Enabled' so they are then forced to configure setting up MFA or any best practice on how to overcome this? We're keen to keep the trusted location as this then allows the staff to bypass MFA within the classrooms.

Ever since enabling MFA our PSF software is unable to send remittance emails PSF as expected have been completely useless for support on this issue, when I run a test under the SMTP settings i get a sucessfull check returned however the software is still unable to send emails and comes back with an SMTP response error Had anyone had a likewise issue?

Hello all, Our Finance team look after Wisepay so up until now, I've not had to do anything but they have been in contact explaining that Wisepay have introduced MFA and it looks like its live and necessary for our school now. https://support.communitybrands.uk/s/article/WisePay-How-to-setup-Multi-Factor-Authentication Ideally, I don't want to ask staff to install an app on their phone so would prefer to use a browser extension. Has anyone got any experience or recommendations? What are others doing to resolve this? Many Thanks

Hi, I work for a medium size MAT, I've just completed a migration of all of our schools individual O365 tenants to a single MAT tenant. This has made management much easier for me working at the centre however it has highlighted some bad practice around password security for a small number of staff. Currently I only have the default MFA enforced for administrators policy enabled, but i'm now looking to possibly roll this out to all users. I'm leaning more towards azure conditional access rather than just the default MFA enabled/disabled in O365, however there's an additional licencing cost to consider with this option. Has anyone gone through this process before? How did it go for you and what policy did you implement on MFA? For those who have enabled MFA by default for all users, were there any unexpected issues you've had to overcome?

Hi All, I've been testing MFA on our remote desktop server but come across an issue I just can't get my head around. We have MFA enabled for all our staff and a lot of them have simply used the text code method rather than the app. I've followed the below guide on setting up MFA for Remote Desktop: https://docs.microsoft.com/en-gb/azure/active-directory/authentication/howto-mfa-nps-extension-rdg Which works so long as you use the phone app verify or phone call. I'd like to be able to use all the methods which looking at this guide is possible if you use PAP authentication. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension#determine-which-authentication-methods-your-users-can-use What I can't figure out is where to set this and if its evening supported on Server 2012 R2? Hopefully someone who's already set this up can help. Thanks, Rob

Hi, So I have been playing with MFA and I can enable this on users accounts however I want to use conditional access so the staff don't get a prompt when inside school. I have logged it with Microsoft but we cant get it working or Microsoft. I think we may need an additional license. We have Office 365 A1 Plus for faculty. Thanks in advance