I work in IT for higher education and we're facing a challenge with dual enrollment students who take university courses taught at their local high schools. These students need university accounts for email and class material, which requires multi-factor authentication (MFA). They're mainly using Microsoft Authenticator on their cell phones, but some students don't have smartphones at all, so we've offered OTP apps and security keys as alternatives. However, many high schools are now enforcing no cell phone policies during classes, which complicates things. We need to find a way to maintain security without making the authentication process a hassle for these students. Has anyone else dealt with this, or do you have suggestions?
4 Answers
If they're serious about banning cell phones, it’s time to gather pricing on alternatives like Yubikeys or hardware OTP tokens. These can get costly, but they might be necessary since no MFA is really unacceptable in today’s world. You could also consider managed mobile devices, but again, that can get expensive and impractical.
You might want to explore conditional access policies that exempt those student accounts from MFA when they're accessing from the school's network. Using specific laptops or Chromebooks could simplify this a lot, especially if they can proxy back to the school's network.
It sounds like this is more about policy than tech. Have the university clarified that cell phones are a requirement for dual enrollment? If not, biometric authentication could be a solution. Fingerprint or facial recognition works well as an alternative to cell phones. You could also look into Yubikeys—parents might be willing to sign for them and they can be reused each year.
What about using Windows Hello for Business? Additionally, why does reauthentication have to happen every 14 hours? For most cases, including my job, 8 hours is already frustrating!
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures