Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Choose the identity provider that can securely authenticate the people in your school or trust across the applications they actually use—and that your team can administer, support and recover when something goes wrong. Test its coverage, MFA, permissions, account lifecycle, trust boundaries, resilience and supplier terms against your requirements before signing a contract. This guidance focuses on schools in England; schools elsewhere in the UK should check their own national education and procurement guidance.
What an identity provider does—and what DfE Sign-in is for
An identity provider (IdP) authenticates a user and can pass that sign-in to connected applications. A school’s identity and access-management approach may also help provision accounts, assign access and disable accounts when people leave or change roles. Those capabilities depend on the design and the applications connected to it; choosing an IdP does not automatically bring every school system under central management.
The Department for Education (DfE) cloud standard recommends using a centrally managed identity and access-management approach across current and future cloud services, including curriculum systems. It says: “To meet your data protection and safeguarding obligations, you should use a central ID and access management tool.” Schools should test the approach across their systems and document how users are added and removed.
DfE Sign-in has a narrower purpose: it provides access to DfE online services. DfE’s sign-in help does not present it as a general-purpose IdP for a school’s MIS, learning platform, email, curriculum applications or locally hosted systems.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
Start with the people, applications and devices to cover
Before comparing providers, make an inventory of who needs access, what they need to use, and how their access should change over time. Include systems that are cloud-hosted as well as remote-access and locally hosted services. This inventory becomes the basis for requirements, provider questions and a pilot test plan.
| Inventory area | Record |
|---|---|
| People and roles | Staff, pupils, administrators, governors, temporary staff, contractors and trust-level roles; note any distinct school-level responsibilities. |
| Applications | MIS, learning platforms, email and collaboration, curriculum services, remote access and locally hosted systems. Record which user groups need each one. |
| Devices and sign-in contexts | School-managed devices, approved personal devices and any restrictions that affect sign-in or MFA. |
| Lifecycle events | Account creation, role or school changes, departures, temporary access, emergency access and account recovery. |
| Ownership | Who approves access, who administers it, and who is responsible for each application and identity source. |
For each application, identify the system that should be authoritative for a user’s identity and relevant role or group information. In a mixed environment, write down which system supplies that information and how changes reach each connected service.
Set non-negotiable security and usability requirements
DfE’s cyber-security core standard requires MFA for staff accounts that access cloud services or remote access to on-site systems, and for IT administrative accounts. The standard states: “MFA (multi-factor authentication) must be enabled for all: staff accounts with access to cloud services or remote access to on-site systems; IT administrative accounts.” It also calls for access to be limited to what each user needs and accounts to be disabled when a person leaves the role.
Turn those requirements into questions that can be checked in a demonstration, pilot and contract:
- Can the provider enforce MFA for the staff and administrative accounts covered by the DfE standard?
- Can administrators assign role-appropriate access, separate administrative access from ordinary use, and produce useful audit evidence?
- Can the school disable an account promptly and reliably when a person leaves or no longer needs access?
- What recovery and emergency-access procedures exist, and who can use them?
- Can the sign-in process meet accessibility needs and work for younger users and people with English as an additional language?
Do not assume one MFA method will suit everyone. DfE’s MFA guidance identifies computer-based authenticator apps, biometrics and USB security keys as possible options where phones are not allowed or suitable. A key is an authenticator used with an identity service, not an identity provider by itself. Check the selected provider’s compatibility, account policies, device ports, deployment logistics and recovery process before choosing hardware.
Compare three identity architectures
A school or trust can standardise on one platform, use one primary directory to federate sign-in to other services, or deliberately retain separate identity environments for different users or applications. The right pattern depends on the application estate, the trust’s operating model and the risks it is prepared to manage.
| Architecture | What to assess |
|---|---|
| One identity platform across the trust | Consistency, common user experience and central administration versus migration effort, school autonomy, support capacity and the possible impact of a trust-wide outage or compromise. |
| One primary directory with federation | Application coverage, sign-in configuration, provisioning direction, role and group mapping, failure handling, added complexity and responsibility boundaries between suppliers. |
| A deliberately mixed environment | Whether separate platforms meet distinct teaching or operational needs, and whether the resulting duplicate administration, account confusion and support burden are manageable. Clearly signpost which service users should use for each purpose. |
The National Education Network’s MAT design guidance discusses both standardisation and deliberate combinations—for example, Microsoft collaboration alongside Google for teaching and learning—and stresses clear signposting. It also warns that visibility across schools in a shared Active Directory system can mean compromise at one school affects the wider trust. Treat that as a design risk to investigate, not a claim that every shared directory has identical exposure. Assess the actual permissions, network and directory boundaries, and incident containment arrangements in the proposed design.
A Microsoft submission hosted on GOV.UK describes integration possibilities involving Google, Microsoft Entra ID and Okta, including federation and provisioning paths. It is a vendor submission in a competition context, not a neutral comparison or endorsement. Use it to frame technical questions, then verify the proposed configuration with product documentation, a proof of concept and clear contractual responsibility boundaries.
Build a shortlist scorecard
Apply the same questions to every candidate. Require written answers or demonstrable evidence for material requirements; do not give credit simply because a provider is already familiar or included with another service.
| Evaluation area | Evidence to request or test |
|---|---|
| Application coverage | Which inventoried systems support the proposed sign-in method, and what configuration is needed for each? Identify unsupported systems and the proposed alternative. |
| Provisioning and lifecycle | How are users created, changed and disabled? Which roles or groups are passed to applications, in which direction, and how are failures detected? |
| MFA and access controls | How are required accounts covered by MFA? Can the school apply least privilege, separate administrative roles and review access? |
| Trust boundaries and delegation | Can trust administrators delegate school-level administration appropriately? What can each school see or change, and how would compromise be contained? |
| User experience and accessibility | Can staff and pupils follow the intended sign-in path on school-managed and approved personal devices? Are accessible or alternative methods available where needed? |
| Availability and recovery | What availability commitment, support hours, escalation route, maintenance arrangements and recovery objectives apply? What happens to access during an outage? |
| Privacy and supplier security | Where is data hosted, how are international transfers handled, how is data encrypted and retained or deleted, and which supplier personnel can access it? |
| Implementation and exit | What migration work, support skills and ongoing administration are required? What are the exit arrangements, data-export options and costs? |
| Total cost | Request a written, school-specific offer covering licensing, implementation, support, migration and exit. The cited guidance does not establish neutral comparative pricing for school IdPs. |
Test integrations with a scoped pilot
Use the application inventory to build a test matrix rather than relying on a general product demonstration. DfE’s cloud standard calls for testing across systems and making the identity-management route the only way users can log on where that standard applies.
- Select representative applications and users. Include key curriculum and operational systems, different user groups, and any locally hosted or remote-access services that are in scope.
- Verify the sign-in configuration. For each application, test the intended protocol and configuration, including the user experience on school-managed and approved personal devices.
- Test the identity lifecycle. Create a test account, change its role or group, remove its access and confirm how each connected application responds. Check failures and who receives them.
- Test security and recovery. Verify MFA enforcement, permissions, administrative separation, audit evidence and the documented account-recovery and emergency-access paths.
- Record gaps and owners. For each failed or unsupported case, record the operational consequence, workaround, responsible party and whether the design remains acceptable.
Include contract and support discussions in the pilot: confirm who configures each integration, who responds when it breaks, and whether the promised support and recovery arrangements match school operations.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check supplier, privacy and resilience evidence
DfE says school leaders remain responsible for due diligence when choosing suppliers. Ask for evidence relevant to the proposed service and contract, not just general assurances. Cover:
- Data hosting locations and arrangements for international transfers.
- Encryption in transit and at rest, data retention and deletion, and supplier personnel access.
- Relevant security certification evidence, staff vetting and training.
- Incident response, breach notification terms and escalation contacts.
- Backup arrangements and tested disaster-recovery and business-continuity plans.
- Service availability targets, maintenance arrangements, support hours, escalation routes and recovery objectives.
Availability percentages are easier to assess when translated into potential downtime. DfE’s cloud guidance gives the following approximate conversions for a 24/7 cloud service; they are illustrative figures, not measured performance claims for named providers.
| DfE availability figure | Approximate downtime per month |
|---|---|
| 99% | 7 hours |
| 99.9% | 45 minutes |
| 99.99% | 5 minutes |
The guidance page does not state a year for these approximations. Ask when users need access, how the provider calculates and reports availability, what exclusions apply, and what remedy the contract offers. Trial the service before committing; a published target alone does not establish how well a particular service will perform for your school.
Agree governance before procurement
Set decision rights and operational ownership before choosing a supplier. DfE’s cyber-security standard assigns planning accountability to the senior leadership team digital lead and technical action to IT support, with the DPO, HR or business professionals, safeguarding lead, wider trust IT leads and suppliers involved as appropriate. For a trust, agree who approves the architecture, who manages trust-wide settings and who handles school-level administration.
The Academy Trust Handbook 2026 says trusts should be working toward DfE digital and technology standards and meeting six core standards by 2030. DfE’s Plan technology for your school service supports self-assessment and progress tracking, including multi-school assessments for multi-academy trusts. These are governance resources, not identity-provider product comparisons.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Make the decision against evidence, not brand familiarity
There is no neutral school-specific provider ranking established by the cited material, nor a verified comparison of provider pricing, measured implementation outcomes or independent performance. Select the service—or deliberate combination of services—that meets your documented requirements, works with your actual application estate, fits your trust’s governance model and is supported by evidence and acceptable contract terms.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
