In short: MFA for schools is expected in England: the DfE cyber security standards say MFA must be enabled for staff accounts that can reach cloud services or remote access to on-site systems, and for IT admin accounts. Cisco Duo covers Microsoft 365, Google Workspace, remote access and admin logins, with tokens and security keys for staff without a work phone.
What the DfE standards say about MFA
The Department for Education's *Cyber security standards for schools and colleges*, part of its digital and technology standards, include a standard to control and secure user accounts and access privileges. The current version on gov.uk (updated 16 September 2026) says MFA must be enabled for:
- All staff accounts with access to cloud services, or with remote access to on-site systems
- All IT administrative accounts
It also asks schools to apply MFA to accounts and cloud applications used by staff working away from the site, to always use enhanced security such as MFA where staff handle confidential, personal or sensitive personal data, and to protect the firewall's administrative interface with MFA where available.
The standard says MFA should use at least two pieces of evidence from a list that includes a password, a text message code (for staff only), an automated phone call, a secure portable device, a security key, a known or trusted account and a biometric test. Where MFA is not available, it asks for a more complex password instead. It notes that passkeys may be an alternative where staff use a dedicated device, and that you may need alternatives or extra support for anyone with accessibility needs.
The DfE says schools should already be meeting this standard. If you are not, it asks for a structured, well-managed roll-out as soon as possible. The senior leadership team's digital lead is accountable for the standard, IT support carries it out, and both should check with IT leads in any wider organisation, such as a multi-academy trust. Read the full standard on gov.uk.
Staff without work phones
The biggest practical question in most schools is not technology but phones. Many teachers, teaching assistants, site staff and supply staff have no work mobile, and some are unwilling to use a personal phone. Duo gives you several options, and you can mix them by group:
| Option | How it works | Good for |
|---|---|---|
| Duo Mobile on a personal phone | Duo Push or passcodes, with no access to the rest of the phone | Staff who are happy to use their own phone |
| Hardware tokens | A key-fob that shows a one-time code | Staff without a smartphone, or who prefer not to use one |
| FIDO2 security keys | A physical key touched to sign in; phishing-resistant | Shared classroom computers and IT administrators |
| Platform authenticators | Windows Hello or Touch ID on a school-issued laptop | Staff with their own assigned device |
Tokens and keys need a simple process for issuing, recording and replacing them, especially when staff leave or lose one. Ask us for a quote on tokens and security keys, and we can set up the process with your office team. The DfE standard's point about accessibility applies here too: check that every member of staff has a method they can use comfortably.
Google Workspace and Microsoft 365 schools
Most schools run on one of two platforms, and Duo works with both:
- Google Workspace for Education: Duo Single Sign-On acts as the SAML identity provider, so staff sign in to Gmail, Drive and Classroom through Duo. Users can be synced from Google, and Duo Directory can provision accounts back to Google. See Duo for Google Workspace.
- Microsoft 365: Duo can be registered as an external MFA method in Entra ID, which needs Entra ID P1 or P2 for each user signing in with Duo, or your domain can be federated to Duo SSO. Check which Entra ID features your education licences include. See Duo for Microsoft 365.
The same standard also suggests considering single sign-on for staff who use several systems, so that one protected sign-in reaches all of their applications, which is exactly what Duo SSO does. Pupils are not in the DfE's MFA list, so schools typically apply Duo to staff groups and keep a separate approach for pupils, based on their own risk assessment. Duo SSO and Duo Directory are included from Duo Essentials.
MIS, remote access and admin accounts
Staff accounts reach more than email. Work through the other systems that hold personal data or give access to the network:
- MIS and other cloud services: if staff sign in with their Microsoft or Google account, protecting that sign-in covers the service. If it has its own login, check whether it supports SAML so Duo SSO can sit in front of it, or switch on its own MFA
- Remote access to on-site systems: put Duo on the VPN and on remote desktop for staff and IT support working off site
- IT administrative accounts: use separate admin accounts with MFA on servers, cloud consoles and the firewall's management interface
- Supplier access: make sure your IT provider's and other suppliers' remote access also goes through MFA
Multi-academy trusts
For a trust, Duo works best as one shared service rather than a separate set-up per school. A single Duo account can protect the trust's Microsoft 365 or Google tenant, with groups and policies for each school or staff type, consistent standards across the trust, and one set of reports for the trust's leadership and board.
Licensing is per user across the trust, so new schools can be added as they join. We usually roll out school by school, avoiding exam periods and the first weeks of term, with a short briefing for staff and a help desk process for lost phones and tokens. Our Duo setup guide shows the steps.
How we help schools and trusts
Forever Systems works with schools, academies and trusts to plan and run MFA roll-outs: we review which accounts the DfE standard covers, choose methods for staff with and without phones, connect Microsoft 365 or Google Workspace, and give your digital lead a clear record of what is protected. MFA sits alongside the standard's other expectations, such as a cyber awareness plan for staff, and many schools also work towards Cyber Essentials.
Contact us to talk through your school or trust, or to ask for a quote.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do schools have to use MFA?
In England, the DfE cyber security standards for schools and colleges say MFA must be enabled for staff accounts with access to cloud services or remote access to on-site systems, and for IT administrative accounts. The DfE says schools should already be meeting this standard.
Do pupils need MFA under the DfE standards?
The DfE's MFA list covers staff accounts and IT administrative accounts, not pupils, and it marks text message codes as an option for staff only. Schools can still choose stronger sign-in for older pupils based on their own risk assessment.
Can schools use text message codes for MFA?
Yes, for staff. The DfE standard lists a text message code as one acceptable piece of evidence for staff. Duo supports SMS passcodes, but app-based Duo Push, hardware tokens and security keys are stronger, and with Duo Essentials or above you can choose which methods each group may use.
How can staff without a work phone use MFA?
Duo supports hardware tokens that show a one-time code and FIDO2 security keys, as well as Windows Hello or Touch ID on a school-issued laptop. Staff who are happy to can use the free Duo Mobile app on their own phone.
Does Cisco Duo work with Google Workspace for Education?
Yes. Duo Single Sign-On can act as the SAML identity provider for Google Workspace, so staff sign in to Gmail, Drive and Classroom through Duo. Duo SSO is included from Duo Essentials.
Can a multi-academy trust manage Duo centrally?
Yes. One Duo account can cover the whole trust, with groups and policies for each school, licensed per user across the trust. We can run the roll-out school by school.