In this article
You configure authentication factors separately for teachers and students. Student configuration additionally supports grade-level Alternative Methods, which override the primary factors for students at or below a specified grade.
Requirements
- Primary District Admin permissions.
- Passport Login enabled for your organization.
- Any factors you plan to use must already be configured as login methods (for example, AD LDAP must be activated separately if used as a first factor).
Configure MFA for teachers
- Navigate to Connect > Administration > Login Methods > Passport Login.
- Under the Teacher Authentication section:
-
- First Factor: select the primary authentication method.
- Second Factor: select the secondary authentication method.
- Grace Period (optional): enter a time window during which teachers can sign in without completing MFA. If left empty, MFA is required at every login.
- Click Save.
Result: All teachers in your organization must authenticate with the configured factors at sign-in.
Configure MFA for students
- Navigate to Connect > Administration > Login Methods > Passport Login.
- Under the Student Authentication section:
- First Factor: select the primary authentication method.
- Second Factor: select the secondary authentication method.
- Grace Period (optional): enter a time window during which students can sign in without completing MFA.
- (Optional) Click Add Alternative Method to define different factors for a specific grade and all grades below it.
- Click Save.
Result: All students authenticate using the primary factors, unless an Alternative Method applies to their grade.
How Alternative Methods work
Alternative Methods apply simpler authentication to younger students without changing the configuration for older students.
Each Alternative Method is applied to a specified grade level and all grades below it. If multiple Alternative Methods are configured, a student uses the one closest to — but not exceeding — their own grade.
Example: Primary factors: Active Directory + QR Code. Alternative Method set for Grade 6: Face ID.
|
Grade range |
Factors used |
|---|---|
|
Grades 1–6 |
Face ID |
|
Grades 7–12 |
Active Directory + QR Code |
Example with multiple alternative methods: Alternatives set for Grade 7 and Grade 8. A student in Grade 5 uses the Grade 7 alternative, as it is the nearest threshold at or above their grade.
Note
You cannot configure Alternative Methods without a primary method already set.
Troubleshooting
|
Symptom |
Cause |
Fix |
|---|---|---|
|
Factor options missing from dropdown |
IdP or factor not yet activated |
Activate the required IdP or factor under Connect > Administration > Login Methods first |
|
Students using the wrong factor after a grade change |
Grade data not yet synced |
Run a data sync to update student grade information |
|
Grace Period field not accepting a value |
Invalid format entered |
Enter a numeric value in the supported format |