Better District Control of Two-Factor Authentication (2FA)

Better District Control of Two-Factor Authentication (2FA)

2/1/2026

We improved Two-Factor Authentication (2FA) within SchoolInsight to help districts use our system more securely.  Our initial version was opt-in for employees, and allowed volunteers to try out our new, more secure, login mechanism.  With the latest release, districts can now require 2FA for selected users, who will be prompted to configure it upon login.  This can help improve security in a few ways.  We suggest requiring 2FA for high permission user accounts like SuperUsers and Financial Users.  Security conscious districts could require 2FA for every employee.  For employees who lose control of their login credentials, configuring 2FA would be best practice as they re-establish their access.  

We are running an “Early Access” program to give selected districts the ability to use this new functionality.  We would like to understand their user experiences before rolling it out to ALL customers.  Please reach out to [email protected] if you would like to participate.

The big change is the introduction of a “Force 2FA” setting.  When enabled for employees, they are required to configure 2FA during their next login.  They will not be able to access SchoolInsight without setting up 2FA.  

Force 2FA can be configured for ALL employees, or just a subset of them, on the Login Authentication Options page.

District Main > Options > Login Authentication Options

We created a nice Mass Edit Employee 2FA Settings page, to turn on 2FA for many employees at once.  Choose employees, select “Force 2FA,” and save.  Notice that the list of employees can be filtered by role (District Admins, School Admins, and Instructors), so it’s easy to choose which employees to modify.

District Main > Options > Login Authentication > Mass Edit Employee 2FA Settings

District/School Main > Employees > Mass Edit Employee 2FA Settings

We plan to add more “Mass Edit” pages across the site, and think it’s a good use of the new technology.  It should help customers manage data in larger blocks, rather than editing each row individually.

When a user with “Force 2FA” logs in, they’ll get a screen to configure 2FA.  We would encourage districts to run a short training session as part of enabling this feature.  To help, we created a short video that walks users through the 2FA setup process. 

Setup 2FA in SchoolInsight

A second option, “Smart 2FA for Google Login” was added to better integrate with Google, which already supports 2FA.  Prior to release, we were unaware of the Google 2FA settings of users who “Login with Google”.  We would 2FA challenge those users, regardless of whether they’ve already 2FA’ed in Google.  This is suboptimal, and would create double 2FA for users (once in Google and then again in SchoolInsight), which creates friction with little added security.  This option allows users to skip SchoolInsight 2FA if it’s already configured in Google.  

This is configured on Login Authentication Options.  During setup, the Admin must authenticate with Google and grant us a token to access this information.

District/School Main > Options > Login Authentication Options

We also added better UI to manage authentication for employees.  A SuperUser can help employees by sending a “reset password” email, logging out their devices, turning on 2FA, etc.  This can all be done from the Employees and Employee-Single View pages (it used to be available on Admins and Instructors only).

District/School Main > Employees > Logins tab

District/School Main > Employee-Single View > Logins tab

We also added a nice page, Employee Login Setup, to view the status of all employees’ login setup.  This can help you understand which employees are using the mobile apps, have turned on 2FA, how often they login, etc.

District/School Main > Employees > Employee Logins

If you were unaware, our 2FA functionality originally debuted in August, and supports using an external Authenticator app.  Originally it was opt-in only for employees, and they could turn it on for themselves.  For more information, see the original news article:

SchoolInsight supports native 2FA 

We also created a video overview of this release, available here:

SchoolInsight 2FA Overview

We hope you like the new functionality, and that it helps keep your data more secure.

The Common Goal Team