MFA for administrators overview
MFA is mandatory for all SchoolDay admin accounts and adds a second verification step at sign-in.
Note: In districts on the Authentication engine, MFA uses an authenticator app, and SMS is not available. Vendor accounts are not affected. For details, see Migrating to the Authentication engine: FAQ.
What it is
Multi-factor authentication (MFA) requires you to verify your identity with two steps — your password plus a second factor — before accessing your SchoolDay admin account.
What it does
MFA prevents unauthorized access even if your password is compromised. Each sign-in requires both your credentials and a live verification code from a registered factor. This applies to all admin accounts without exception.
Why use it
MFA is mandatory for admins. SchoolDay enforces it by default to protect district data and admin-level access. If a registered factor becomes unavailable, recovery codes provide a fallback path.
Main components
The factors you use depend on your account type.
Districts on the Authentication engine
- Authenticator App (required): Time-based one-time code (TOTP) generated by an app such as Google Authenticator, Microsoft Authenticator, or Authy. SMS is not available.
- Recovery codes: Single-use backup codes generated at MFA setup. Used when your authenticator app is unavailable.
Other districts
- SMS (required): One-time code sent to your registered mobile number. Default and mandatory factor.
- Authenticator App (optional): Time-based one-time code (TOTP) generated by an app such as Google Authenticator, Microsoft Authenticator, or Authy. Secondary factor.
- Recovery codes: Single-use backup codes generated at MFA setup. Used when your primary factor is unavailable.
Vendors
- SMS (required): One-time code sent to your registered mobile number. Vendor admins use SMS only.
- Recovery codes: Single-use backup codes generated at MFA setup. Used when your registered phone is unavailable.