Multi-factor authentication for K-12: a practical rollout

What does a practical K-12 MFA rollout look like?

A practical K-12 multi-factor authentication rollout protects the accounts attackers value most first: administrators, then staff who handle student, finance and HR data, then email and remote access for everyone. It plans ahead for shared devices, substitutes, account recovery and the school calendar. CISA lists MFA first among its priority steps for schools and calls phishing-resistant MFA the standard to work toward.

CISA's K-12 report accepts that districts may need a phased approach, starting with the highest-risk systems, such as virtual private networks and student information systems, and high-priority accounts. It asks that system administrators and other privileged users enroll first, preferably with phishing-resistant MFA, and that districts regularly look for accounts without MFA. It also names common gaps: recently onboarded staff and people who moved to a new phone [1].

This week: export a list of accounts with administrative rights in your email, identity and student information systems, and note which already use MFA.

Choose methods: phishing-resistant where it matters most

Not all MFA is equal. CISA ranks methods by how well they resist phishing, push bombing (repeated prompts until someone taps approve) and SIM swapping [2].

CISA describes number matching, where the user types a number shown on the sign-in screen into the app, as one of the best interim mitigations for organizations not yet ready for phishing-resistant MFA [3]. The stakes are real: CISA and the FBI report that the Scattered Spider group has impersonated employees to persuade help desks to reset passwords and move MFA to attacker-controlled devices, and they recommend phishing-resistant MFA for webmail, VPNs and accounts that reach critical systems [4].

This week: check which MFA methods your identity platform currently allows, and turn off push approvals that lack number matching.

Use what Microsoft 365 and Google Workspace already include

Many districts can start without new licenses. In Microsoft Entra ID, security defaults are available at no extra cost and are aimed at organizations on the free tier. They require all users to register for MFA, require MFA at every sign-in for listed administrator roles, and block legacy authentication. Users register the Microsoft Authenticator app, which shows a number to enter at sign-in, and Microsoft removed the 14-day registration grace period starting July 29, 2024. Custom rules through Conditional Access need at least a Microsoft Entra ID P1 license [5]. Microsoft also now requires MFA for sign-ins to the Azure portal, Microsoft Entra admin center and Intune admin center, with enforcement for the Microsoft 365 admin center beginning in February 2025, and it states that organizations cannot opt out [6].

In Google Workspace, administrators can let users enroll in 2-Step Verification, track enrollment, then enforce it by organizational unit or group. A new-user enrollment period of one day to six months gives new accounts time to set up, administrators can exclude text and phone codes, and the "only security key" option now also accepts passkeys [7]. Google is also gradually rolling out mandatory 2-Step Verification for administrator accounts, with organizations on Workspace for Education among those now in scope and roughly 90 days' notice for super administrators and 60 days for other admins [8].

This week: confirm whether security defaults, Conditional Access or Google 2-Step Verification enforcement is active in your tenant, and for which groups.

A phased rollout plan

Timing and communication

Schedule enforcement dates away from state testing windows, the first weeks of school, grading deadlines and payroll or fiscal year-end close. Summer and the weeks after school settles are usually kinder to the help desk. Announce each phase at least two weeks ahead, explain why in plain language, offer enrollment sessions at each campus, and send a reminder two days before enforcement. Track enrollment weekly and follow up personally with the last few holdouts.

This week: mark your district's testing windows and pay dates on a calendar and pick a target date for phase 1.

Shared devices, substitutes and younger students

MFA belongs to a person, not a device, so shared classroom and lab computers work when each staff member carries their own factor. Some staff will decline to use a personal phone; budget for district-owned security keys so that choice never blocks enrollment. For substitutes and other short-term staff, give limited accounts with only the access they need. In Microsoft Entra ID, a Temporary Access Pass is a time-limited passcode, configurable for one-time or multiple use, that helps users register a method on first sign-in or recover after losing one [9].

Younger students raise different questions. Districts commonly weigh:

• What data and systems the account can actually reach
• Whether students have a reliable second factor without a phone
• Reading level and the classroom time lost to sign-in problems
• Whether older students or student workers hold staff-like access that warrants MFA

One reasonable approach is to require MFA for staff first and reduce student account risk through single sign-on, limited permissions and monitoring. Record your decision and revisit it each year.

This week: list every role that uses shared devices and decide which factor each will carry.

Break-glass accounts and help desk recovery

Before you enforce MFA broadly, make sure you cannot lock yourself out. Microsoft recommends two or more cloud-only emergency access accounts, protected with a passkey (FIDO2) or certificate-based authentication, excluded from Conditional Access policies that block sign-in, monitored with alerts on every use, stored securely, and validated at least every 90 days [10].

1. Verify identity. Call back on a number already on file, or confirm with the person's supervisor.
2. Require more for privileged accounts. Administrators reset in person or by video with ID.
3. Issue short-lived recovery codes. Use one-time passes with brief lifetimes, and log who issued each.
4. Notify the user. Send an alert to the account owner after any MFA change.

In the K12 Cyber Forward portal, MFA progress can be tracked as an improvement plan item with owners and dates, with enrollment reports kept in the evidence locker. For the business case, see For superintendents, and for how MFA appears on insurance applications, see Preparing for cyber insurance renewal in Georgia.

This week: write a one-page MFA reset procedure for the help desk and test both break-glass accounts.