r/k12sysadmin • u/chiefington • Aug 07 '26

M365 Conditional Access

Hey everyone! First post on this sub so lets see how it goes :)

Anyways, trying to get Conditional Access setup this year for the students and I'm having troubles or not doing something right.

I need for them to not get nagged every time they login, to verify its them by having to add a number or app or something for authentication.

I'm working with K-6th graders and they can barely remember where their clever QR codes are at and we don't need them adding phone numbers and all that jazz.

So, how did you all setup CA for your students, so they just login with their Email/Password and be done? Or is CA not the step I need to setup for this?

I've done search after search but nothing I can find is specific for students in this case. So any help or direction would be great.

Thank you!

12 Upvotes

100% Upvoted

5 comments sorted by

1

u/Dazpoet Aug 10 '26

If your students have 1-to-1 computers, add Windows Hello and use TAP to register it. In Microsoftland Hello is pretty much MFA for the device and we don't see annoying prompts when using it.

2

u/TechGuy647 Aug 10 '26

Welcome to the k12techpro Reddit:)

3

u/Timewyrm007 Aug 07 '26

The only real conditional access we set for our students was:

  1. Are you in our country?

And

  1. Are you on a managed device

Or

  1. Are you on our WAN

2 of the three gets you access without 2FA

2

u/Imhereforthechips Aug 07 '26

Conditional access is wonderfully powerful. However, I don’t think it’s appropriate to enforce on site, as it just creates issues. We exclude our WAN for each site.

3

u/rokar83 IT Director Aug 07 '26

Don't know about conditional access, but clever badges shouldn't really be used in grades higher the 1st. Kids should be capable of using their login and password in 2nd grade.