MFA Security Issues

How to Manage Microsoft 365 MFA for K-12 Schools Without Student Devices

WPS Content Manager Oct 1, 2026 869 views

Question details

K-12 schools need a method to manage multifactor authentication (MFA) for students who do not have personal phones, email accounts, or security keys.

How to Manage MFA for K-12 Schools Without Personal Student Devices

Product: Microsoft 365
Device & OS: not provided
Scenario: Administrators need to configure authentication for a K-12 environment using Microsoft 365 A1 licenses, which lack Entra ID P1 and Conditional Access.
Observed behavior: Enforcing standard MFA policies blocks students from signing in because they lack the required hardware or secondary accounts for verification.

Before you start

Ensure you are signed in to the Microsoft Entra admin center with Global Administrator or Security Administrator credentials.

Solution 1Recommended

Disable Security Defaults in Microsoft Entra

Turn off security defaults to allow password-only sign-in for students who cannot complete MFA challenges.

Microsoft strongly encourages keeping security defaults enabled to protect against identity attacks. However, K-12 environments with Microsoft 365 A1 licenses may need to disable them because they lack the Conditional Access features required to exclude students from MFA dynamically.

Sign in to Microsoft Entra

Access Properties

In the left-hand navigation menu, expand 'Identity', click on 'Overview', and select 'Properties'.

Manage Security Defaults

Scroll to the bottom of the Properties page and click on the 'Manage security defaults' link.

Disable the feature

Set the toggle to 'Disabled'. You may be prompted to provide a reason for disabling it (e.g., users lack devices). Click 'Save' to apply the changes.

Disable Security Defaults in Microsoft Entra

Security Risk Warning: Disabling security defaults removes baseline protection for your entire organization. You must immediately secure your administrative accounts using alternative methods.

Solution 2

Enable Legacy Per-User MFA for Administrators

Manually enforce MFA on sensitive administrative or staff accounts after security defaults are disabled.

Free Microsoft Office alternative

Looking for a Simpler Solution? Try WPS Office for Education

Managing complex cloud environments and MFA policies for thousands of students can overwhelm school IT departments. If you need a powerful, offline-capable office suite that doesn't require constant cloud authentication or heavy administration, WPS Office is an excellent, budget-friendly alternative.

Free and lightweight office suite perfectly suited for school computersHighly compatible with Microsoft Word, Excel, and PowerPoint formatsWorks seamlessly offline without requiring complex MFA or cloud sign-insFamiliar, tabbed user interface reduces the learning curve for young students

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I use Conditional Access to bypass MFA for students?

Conditional Access policies require Microsoft Entra ID P1 or P2 licenses. Standard K-12 deployments often use the free Microsoft 365 A1 license, which does not include these advanced conditional access features.

Are there alternative MFA verification methods for students without smartphones?

Yes, hardware OATH tokens (such as FIDO2 security keys) can be used instead of mobile phones. However, distributing hardware keys to an entire student body often incurs prohibitive costs for school districts.

What exactly happens when I turn off security defaults?

Turning off security defaults removes the organization-wide requirement for users to register for and use multifactor authentication. It allows basic password authentication, which solves the sign-in issue for students but increases the overall security risk for the tenant.

Can I enforce MFA for teachers but leave students as password-only?

Yes. Once you disable security defaults, you can use the legacy per-user MFA settings in the Microsoft 365 Admin Center to manually enable multifactor authentication for teachers and administrators while ignoring the student accounts.

Microsoft Office Security Issues