MFA for Schools: Securing Staff and Admin Accounts in Perth

Schools hold some of the most sensitive data outside healthcare - student records, family contact details, welfare and behavioural notes, and increasingly, financial information for fees and payments. That makes staff and administrative accounts a genuine target, even though schools rarely think of themselves as a likely one.

Why Staff and Admin Accounts Matter Most

The realistic risk for most Perth schools isn't a student account being compromised - it's a staff or administrative account. A compromised teacher or admin account can expose entire class lists, family contact details, or financial systems, and is far more likely to be specifically targeted by phishing or credential-stuffing attacks than a student login.

MFA for Staff Accounts

This is the straightforward part - the same principles that apply to any business apply here. Staff and administrative accounts should have MFA enabled without exception, prioritised in this order:

• IT administrators and system owners - the highest-value accounts, since compromise here can affect everything else.
• Finance and enrolment staff - access to financial systems and family personal information.
• Teaching staff - access to student records, gradebooks, and communication platforms.
• Leadership and pastoral care staff - often have access to the most sensitive welfare-related student information.

Where possible, app-based or phishing-resistant MFA is preferable to SMS codes, for the same reasons that apply in any business setting.

Why Student Accounts Need a Different Approach, Not MFA

We don't recommend rolling MFA out to students themselves, particularly in primary and early secondary years. Practically, young students can't reliably manage a second factor - a personal phone, an authenticator app, or a hardware key - and the support burden of constant lockouts usually outweighs the security benefit. It can also raise its own privacy and parental-consent questions that most schools don't need to take on.

A more proportionate control for student accounts is restricting where sign-in can happen at all, rather than adding a second factor to how it happens. For schools that issue or manage student devices, a Conditional Access policy can be configured to only allow student account sign-in from those known, managed devices - meaning a stolen or guessed password is far less useful to an attacker if it simply won't work from an unrecognised device in the first place. This shifts the security burden onto device management, which the school already controls, rather than onto the student.

A Practical Approach for Perth Schools

1. Enforce MFA on all staff and admin accounts - no exceptions, prioritised by access level.
2. Use Conditional Access to restrict student sign-in to managed devices - for schools that provide or manage student devices, rather than relying on MFA for student accounts.
3. Review admin account exclusions regularly - "break glass" or legacy exemptions are a common, quietly-forgotten gap.
4. Train staff specifically - school staff are routinely targeted with invoice fraud and credential phishing dressed up as parent or department communication.

Where to Start

If staff MFA coverage hasn't been reviewed recently, that's the highest-value place to start - it's the single change most likely to prevent the kind of account compromise that actually affects schools.

Frequently Asked Questions