What an authenticator app is, and where it sits in your data protection policy

How it works

A password is one factor: something you know. Multi-factor authentication adds a second: something you have. An authenticator app on a phone is the usual form of it in a school — Microsoft Authenticator, Google Authenticator, or whichever the school already uses alongside its email tenant.

Setting it up involves scanning a QR code once. From then on the app and the server independently generate the same six-digit code from a shared secret and the current time, which is why the code changes every thirty seconds and why the app works with no signal and no data.

The practical effect: a password leaked in somebody else's breach, guessed, or typed into a convincing fake login page no longer gets an attacker into the account by itself. They would need the phone in their hand at that moment.

Why not just text the code

SMS is better than nothing and worse than an app. A text can be read from a locked screen, forwarded by a phone the school no longer controls, or redirected by a SIM swap — a fraud where somebody persuades a mobile operator to move a number onto their own SIM. None of those touch a code generated on the device itself.

There is a more mundane reason too. SMS codes stop working in a school hall with no reception, on a staff member's foreign number, or when the only mobile on file left with the person who used to hold the role. App-generated codes do not depend on the network at all.

The part schools get caught by: recovery

The failure we see is not an attacker. It is a lost or replaced phone, and nobody able to get into the school's own account.

Every provider issues backup codes — single-use strings that work in place of the app — and almost nobody stores them. They should be treated as the credential they are: written down once, held where the school already holds its sensitive records, and reissued when they are used or when the person holding them changes role.

The harder version of the same problem is the shared office or MIS account that one person set up on one phone. When that person is out, the school cannot get in; when that person leaves, the school may not be able to get in at all. The fix is a second enrolled device or administrator, decided deliberately rather than discovered in August.

What to put in the policy

The Data Protection Policy is where this stops being an IT preference and becomes a school rule. The clauses worth having:

• Which systems require multi-factor authentication. At minimum, staff email and anything holding pupil data — the MIS, the cloud drive where reports and SEN documentation live, the payments system.
• That app-generated codes are the default, with SMS named as the exception and who may use it.
• Who holds the backup codes, where they are kept, and the step that reissues them when somebody changes role or leaves.
• A second enrolled administrator on every shared or administrative account, so the school is never one phone away from losing access to its own records.
• What a member of staff does when a prompt appears that they did not trigger — because that is somebody testing a stolen password, and it needs reporting, not dismissing.
• The offboarding step: access removed, and enrolled devices removed with it.

Why the policy is the point

GDPR Article 32 requires "appropriate technical and organisational measures" and does not list them. That is the gap a school is left to fill, and in practice it is filled by whatever the Data Protection Policy says and the school can show it did.

If an account is compromised and the Data Protection Commission asks what controls were in place, there is a real difference between two answers. "Multi-factor authentication was required on staff email and the MIS under our Data Protection Policy, here is the version the Board approved, here is the date, and here is who had acknowledged it" is a position. "IT turned it on for most people" is not.

None of this makes a school safe from a breach, and an article that said otherwise would be worth ignoring. It narrows one common route in, and it gives the school something to point at about the route it narrowed.