Security: sign-in log, password rules and two-factor sign-in
See every sign-in try, set password rules, ask for a second factor or a passkey, and limit sign-ins by network, device and hours. Settings can differ per Entity, and every part comes with every plan.
PLANSEvery plan
The problem it solves
- Nobody can tell who signed in last night, or from where.
- Staff use short, easy passwords that anyone could guess.
- A former employee's login still works on a phone nobody remembers.
- Office records can be opened from any network at any hour.
How it works
- The administrator opens the Security app. Sign-ins are logged from day one; every other setting stays off until you switch it on.
- Under Security Settings, set password rules, the lock after wrong tries, session limits, two-factor sign-in and approved devices.
- Add IP rules to allow only the office network or to block addresses. Add sign-in hours per weekday, with holidays.
- To give one Entity its own rules, add it under Settings per Entity. Someone who works in several Entities meets the strictest of them.
- Follow it under Security > Activity: the sign-in log, open sessions, devices waiting for approval, and each login's password age and strength.
Everything it does
Sign-in log
- Every try on the web and in the apps, signed in or refused, with the reason
- How the person signed in: password, passkey, single sign-on or one-time code
- IP address, country and city when known, browser, system and device
- Kept 365 days to start with; passwords are never recorded, not even wrong ones
- A message to the person after a sign-in from a new device, when you switch it on
Passwords and locks
- Minimum length and strength, and the kinds of characters a new password needs
- No reuse of recent passwords, and expiry with a new password asked at sign-in
- Lock after wrong tries for a set number of minutes; an administrator can lift it earlier
- Ask for a New Password: the person chooses one at their next sign-in
- Portal users, such as parents, residents or customers, can be covered too
Two-factor sign-in and devices
- Two-factor sign-in for everyone or for chosen roles, with days to set it up
- A code from an authenticator app, or a passkey: fingerprint, face or security key
- A trusted device skips the code for 30 days to start with
- Approved devices only: a new device waits until a Security Administrator approves it
- Revoke a device and it is signed out at once
Networks, sessions and hours
- IP rules: allow only these addresses or block these, for everyone or chosen roles
- Sessions per login, idle time-out and longest session
- Sign one session out, or sign a person out everywhere
- Sign-in hours per weekday, closed on holidays, read in the Entity's time zone
- A rule that would lock out the person saving it is refused
Who uses it
AdministratorSwitches the rules on and reads the log.
Security AuditorReads the sign-in log, sessions, logins, settings and IP rules.
Security AdministratorChanges settings and IP rules, lifts locks, approves devices and signs sessions out.
Staff memberSets up the second factor where it is asked for, and signs their own other devices out.
Where you use it
- Web: the Security app in the back office
- The SmartMy phone apps: the same checks, with the code, new password and two-factor set-up screens
- The sign-in page: the reason when a sign-in is refused
What you control
Settings
- Security Settings: sign-in log, passwords, IP rules, sessions, two-factor, devices and sign-in hours
- Settings per Entity: one Entity with its own settings, copied from the default
- IP rules and sign-in hours for everyone, chosen roles or one Entity
- Sessions Allowed per user, on the user's Account Security tab
Approvals
- Device approval: a Security Administrator approves or refuses a device that waits
Notifications
- Login locked: to the person and the Security Administrators
- Device waiting for approval: to the Security Administrators, at once
- New sign-in to your account: to the person, when you switch it on
Questions
Is security an add-on?
No. Every security feature is in every plan of SmartMy School.Can an administrator see passwords?
No. Only the length and strength of a password when it was set, and its age.Can one branch have stricter rules?
Yes. Give that Entity its own settings. People who work in several Entities meet the strictest of them.Do the phone apps follow the same rules?
Yes. The apps ask for the code, a new password or the two-factor set-up, as the web does.Related features
ACROSS SMARTMY SCHOOLApproval chainsHomework, circulars, leave, certificates, fee structures, concessions, refunds and revaluations go to the right people in the right order. You set the chains up without code. Every decision is kept with who made it, when and why.ACROSS SMARTMY SCHOOLNotificationsSmartMy School tells parents, students and staff when something needs them: an absence, homework, a fee due, a result, a child leaving the gate. Every message also lands in one inbox in the Campus app and the portal. Each parent chooses their channels and their informational messages.
See your own school year run in it.
Tell us how many students you have, which classes you run and how you collect fees today. We will show you SmartMy School set up that way.