Built for UK education · Works with Microsoft 365
Phone-free MFA
for every student.
Security expectations now reach every cloud account — students included. Student MFA adds a second factor to student Microsoft 365 accounts using a memorable pattern, PIN or passkey — nothing to install, nothing to carry, nothing to confiscate. By default, students are only challenged when they sign in away from your network — challenge every sign-in if your policy needs it.
- Pattern sign-in types a different code every time — like a one-time code
- Starts in report-only mode — nothing enforced until you say so
- From £2 per student a year — 30 days free, set up in minutes
Why student MFA is hard
Students don't have authenticators
Security frameworks, MFA guidance and cyber-insurance requirements increasingly expect a second factor on every account — but authenticator apps assume a personal smartphone. Many students don't have one, and many settings don't allow one.
Hardware tokens don't scale
Keys and tokens get lost, shared and broken. Issuing, replacing and supporting thousands of physical devices for young learners is a full-time job nobody has.
Blanket MFA breaks the classroom
Challenging every sign-in, everywhere, grinds lessons to a halt. The risk you actually need to control is access from outside your network — not a supervised classroom.
How it works
Student MFA plugs into Microsoft Entra ID as an external authentication method — the same mechanism Microsoft provides for enterprise MFA providers. No agents, no DNS changes, no password sync.
-
1
Connect your Microsoft 365
A Global Administrator approves two one-time permissions from the guided wizard. That's the only technical step — the platform configures your tenant automatically.
-
2
Choose who and where
Pick the security group that contains your learners, then choose your challenge scope: off-site only (paste in your site's public IP ranges and on-site sign-ins are trusted) or always require MFA for every sign-in. You can switch between the two later with one setting in the portal.
-
3
Issue sign-in methods and go
Import learners straight from your directory and issue patterns or PINs in bulk, downloaded once for distribution. Start in report-only mode, review the sign-in logs, then enforce with one switch.
Everything you need, nothing to babysit
Memorable patterns
A shape on a grid instead of a number. The grid shows fresh random digits every sign-in, so the typed code changes every time — behaving like a one-time code, which defeats shoulder-surfing and code sharing. Learners can change their own pattern at sign-in, no staff needed.
Deviceless PIN
A memorable PIN of up to 6 digits as a simple fallback second step. Hashed with bcrypt, never stored or shown in clear, rate-limited with automatic lockout.
Passkeys ready
Learners with a device that supports passkeys can step up to phishing-resistant sign-in. PIN and passkey coexist per learner.
Challenge where you choose
By default, a trusted-network policy means no MFA friction in the classroom — only remote sign-ins are challenged. Need the strict posture where cloud accounts always use MFA? Flip one setting in the portal to always require MFA and the policy in your tenant is updated for you.
Report-only rollout
Policies are created in report-only mode by default. Validate impact in your sign-in logs before a single learner is challenged.
Bulk import from your directory
Load learners straight from the security group you already maintain — or CSV if you prefer. Already-enrolled learners are skipped automatically.
Simple code distribution
Generated PINs and pattern codes download once as a CSV for controlled hand-out, and are emailed automatically to each learner's recipient contact (parent, guardian or tutor). Staff can also set a temporary PIN on the spot — the learner is asked to choose their own at the next sign-in.
Full audit trail
Every challenge, success, failure, lockout, reset and admin action is recorded in an append-only audit log you can review any time.
Leave any time
Self-service offboarding reverts every change made to your tenant and gives you the exact commands to revoke our access. Your tenant, your control.
Security & data protection first
- Minimal data. We hold names, usernames and enrolment state — nothing more. No safeguarding data, no lesson content, no tracking.
- Secrets are never stored in clear. PINs are bcrypt-hashed; patterns are encrypted; passkeys use public-key cryptography.
- Tenant isolation. Every organisation's data is scoped to its own tenant id at the database layer.
- UK data residency. Hosted on Microsoft Azure in the UK.
- You stay in control. Access is granted by your own admin consent and can be revoked by you at any time.
- No lock-in. Offboarding reverts every policy and method we created, and you can delete all platform data permanently.
- Least privilege. The platform requests only the Microsoft Graph permissions it needs to operate, documented openly.
- Transparent behaviour. A built-in diagnostics page shows administrators exactly what the platform can see and do.
Built for MSPs and multi-site groups
Student MFA is multi-tenant from the ground up, with a three-tier management model designed for managed service providers and education groups.
Portfolio management
See and manage every organisation you look after from one portal — students, admins, audit and service state per site.
Delegated administration
Fine-grained roles at platform, partner and site level. Give each team exactly the access they need and nothing more.
Service controls
Suspend and reactivate service per site instantly — useful for billing and lifecycle management — without touching the customer's tenant.
Simple per-student pricing
Every plan starts with a 30-day free trial — full feature set, no card details needed. Then priced per active student, per year. No setup fees, no hardware, no surprises.
Single site
£2 per active student / year
One organisation, self-managed through the portal. Minimum £750 per year.
- Self-service onboarding
- All sign-in methods included
- Email support
Group / Trust
From £1.50 per active student / year
Multiple sites under one agreement with central visibility. Volume tiers by total student count.
- Everything in Single site
- Cross-site dashboard & reporting
- Priority support
MSP Partner
Wholesale partner pricing with resale margin
Resell and manage Student MFA across your customer base.
- Partner portal & delegated roles
- Volume pricing
- Co-branded rollout material
Typical cost: a 900-student secondary school pays £1,800 a year — less than most schools spend replacing lost hardware tokens, with nothing to buy or hand out.
Requires Microsoft Entra ID P1 (included in Microsoft 365 A3/A5) assigned to the students in scope — a Microsoft prerequisite for Conditional Access and external authentication methods.
Frequently asked questions
Do students really not need a phone or app?
Correct. The second factor is a memorable pattern or PIN entered on the same device they're signing in with, or a passkey if the device supports one. There is nothing to install and nothing to carry.
Will students be prompted in the classroom?
Not unless you want them to be. By default your public IP ranges are registered as a trusted location, so on-site sign-ins skip the challenge and only off-site sign-ins are prompted. If your policy or assessment requires MFA on every sign-in, switch to always require MFA in the portal settings — the Conditional Access policy in your tenant is updated for you, and you can switch back at any time.
What happens if a student forgets their PIN?
Staff can reset it from the portal in seconds — the new PIN is emailed to the learner's recipient contact (parent, guardian or tutor). If it's needed right away, staff can set a temporary PIN and hand it over on the spot; the learner is then required to choose their own PIN at the next sign-in. Repeated wrong attempts lock the account temporarily and are recorded in the audit log.
Does this help with MFA compliance requirements?
Security guidance, assessment schemes and cyber-insurance policies increasingly expect a second factor on cloud service accounts, including learners'. Student MFA closes the "students have no second step" gap without devices, and the always require MFA option matches the strict reading that cloud services must always use MFA. The pattern option goes further: because the grid shows new random digits at every sign-in, the code the learner types is different every time — a static, reusable code is never exposed. Passkeys add phishing-resistant sign-in where devices support them. Your assessor or insurer decides what satisfies your specific requirements, so be precise in your evidence about which learners use which method — the per-student reporting gives you exactly that.
How much does it cost?
£2 per active student per year for a single site, with a £750 annual minimum. Groups and trusts start from £1.50 per student per year with volume tiers, and MSP partners get wholesale pricing. A typical 900-student secondary school pays £1,800 a year. Every plan starts with a 30-day free trial, no card details required.
What do we need before we start?
A Global Administrator account to approve the connection and a security group containing the students in scope. If you choose the off-site-only challenge mode, you'll also need your site's public IP ranges (skip these if you challenge every sign-in). Students also need Microsoft Entra ID P1 licences (included in Microsoft 365 A3/A5).
How long does setup take?
Typically under fifteen minutes: approve the connection, pick your student group, choose when to challenge, import students and download their sign-in codes. Policies start in report-only mode so you can validate before enforcing.
Does this affect staff?
No. Everything is scoped to the student group you choose. Staff sign-in methods and policies are untouched.
How does the 30-day free trial work?
Every organisation gets the full product free for 30 days — all sign-in methods, policies and support, no card details required. Because policies start in report-only mode, you can run a genuine pilot and see real sign-in data before deciding. If you don't continue, offboarding removes everything self-service.
Can we leave?
Yes, at any time, self-service. Offboarding reverts every change made in your tenant, gives you the commands to revoke our access entirely, and lets you delete all platform data permanently.
Protect every student account this term
Start your 30-day free trial: sign in with a Global Administrator account and the guided wizard does the rest. Report-only first — nothing is enforced until you choose.