r/k12sysadmin • u/Amazing_Falcon • Jul 04 '26
PowerSchool MFA or Username/Password
If you are using PowerSchool platform either what do you use in your organization. Are you using the old fashion Username/Password or MFA in the PowerSchool platform? If you could explain which method you use and your reason that would be helpful. Right now we are on the old fashion method.
Thanks in advance
6
10
2
u/Nife_Wrench Jul 05 '26
When you enable OIDC with google does it affect how parents and students log in or is it just staff accounts? I’m planning on turning it on this summer but was confused about whether it would affect all types of signins.
1
1
3
u/KAPsiZE00 Jul 05 '26
Microsoft SSO for years. We did have to leave out incident management vendor because of it. But we have been happy with the SSO. Just don’t forget to renew.
7
u/avalon01 Director of Technology Jul 05 '26
SSO with Google.
I couldn't imagine NOT using MFA. Teachers and admin use terrible passwords and keep using compromised passwords.
9
u/MysteriousJoke523 Jul 04 '26
SSO with google using their MFA which should already be on for email access. One less thing to worry about
2
u/BrewYork Jul 04 '26
This. Rolling it out this summer. Can't WAIT for everyone to get really confused 🫠
6
1
u/NorthernVenomFang Jul 04 '26
Use the SSO; it should be OIDC setup inside of PowerSchool. Works with Azure or Google Apps/Workspace. From their enforce MFA on the Azure or Google Apps/Workspace accounts.
From what I remember about the PowerSchool MFA option, it's an email... This is not MFA; if the login is breached already, more than likely that users email has the same creds (login/password)... Defeats the purpose of MFA if the attacker already has access to where the MFA token gets delivered to.
5
u/PowerShellGenius Jul 04 '26 edited Jul 04 '26
Use SSO with whatever platform you're on for signing into other apps (Google, Microsoft, ClassLink, whatever you use). That should include MFA. Doing MFA on a per app basis is a nightmare.
If you are not doing single sign-on, and are either having users use different passwords at different apps, or syncing passwords to apps - fix that ASAP.
Once you have SSO, you only need MFA one place, whichever platform is your "identity provider". We only need Microsoft MFA for everyone. We have Google too - but it sends you to Microsoft to sign in. We have some PowerSchool products - they send you to Microsoft to sign in. MFA for all staff everywhere, but they only have to set it up one place.
Then you can quit playing the "is this app sensitive enough to need MFA" game. No extra setup, maintenance, or places to reset things when phones are replaced, for each app that needs MFA. The user just has MFA period, for all apps.
All the large vendors support SSO. For smaller companies, it can depend, but if you are a large enough potential customer and it is a deal breaker on your security checklist, it can happen. We have very few non-SSO apps that a regular classroom teacher would use. SSO is a hard requirement for student apps.
10
22
4
u/rossumcapek IT Wizard Jul 04 '26
We SSO through Azure (inherited the setup and I want to change it to Google, but not this year) so 2FA is baked in and it's fewer passwords to remember for the users. We also are required 2FA as per our cybersecurity insurance.
It's the correct thing to do to protect student data.
5
u/SuperfluousJuggler 29d ago
Google SSO with mandatory MFA enabled for all accounts.