Identity for Education

The job identity does in education

Education has one of the most mixed identity populations anywhere: transient student bodies, faculty and staff, researchers, alumni, donors and parents, across a long tail of applications. Budgets are tight, devices are mixed, and federation for research and library access is a core requirement. K-12 districts and universities face different versions of the problem. Districts hold minors' records, mostly in vendor-run SaaS. Universities run financial aid, research, HR and donor systems behind one SSO account per person.

Education accounts for 2 of the 123 incidents in the Identity Breach Database (1.6%), both disclosed in 2025. Both abused a human account through failed authentication, with MFA status unknown. In both, one credential reached far more data than any one person needed.

The identity threat picture, from the incident record

One support-portal credential into every district's student records. PowerSchool told customers on 7 January 2025 that an attacker had used PowerSource, its customer support portal, to reach and export data from customers' student information system (SIS) instances. CrowdStrike found the actor used a single compromised credential, held access from 19 to 28 December 2024, and had used the same credential on PowerSchool's network that August and September. PowerSchool says the data varied by customer and could include names, contact details, dates of birth, limited medical alert information and Social Security numbers. It cannot confirm precise numbers. Despite a ransom payment, a threat actor tried to extort districts with the data on 7 May 2025. For a district, the vendor's support channel was a route into its records that it did not control.

One SSO account, many systems. On 31 October 2025 offensive mass emails went to the University of Pennsylvania community from university systems. Penn said attackers reached a select group of development and alumni systems through "a sophisticated identity impersonation" (social engineering), and later confirmed files were taken. Reporting said the attackers held one employee's PennKey SSO account, which reached the VPN, Salesforce, Qlik, SAP and SharePoint. The attackers claimed data on about 1.2 million students, alumni and donors; Penn has said it cannot confirm that figure.

The database has no sourced education incident yet for credential stuffing or MFA fatigue, though student and alumni portals are exposed to both.

The regulatory floor

• FERPA (20 U.S.C. 1232g; 34 CFR Part 99). Under 34 CFR 99.31(a)(1)(ii), an institution "must use reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests." Without technical access controls, it must prove its administrative policy works. A vendor counts as a school official only if it performs a service staff would otherwise do, is "under the direct control" of the institution for use and maintenance of records, and follows the 99.33(a) redisclosure limits. FERPA does not name MFA; role-scoped and controlled vendor access is how institutions meet it.
• GLBA Safeguards Rule for Title IV schools. Federal Student Aid says every participating institution agreed in its Program Participation Agreement to comply with the Safeguards Rule, that most changes took effect on 9 June 2023, and that ED enforces them through annual compliance audits. Findings require a corrective action plan; repeated noncompliance can affect Title IV participation. The rule requires MFA "for any individual accessing any information system" (16 CFR 314.4(c)(5)), unless the Qualified Individual approves an equivalent control in writing.
• COPPA. The amended COPPA Rule's compliance date was 22 April 2026. It adds biometric identifiers to personal information and requires a written information security program from edtech serving children under 13.
• CMMC for defense research. Universities and labs that handle Controlled Unclassified Information under DoD contracts fall under CMMC. Level 2 maps to NIST SP 800-171, whose requirement 3.5.3 requires MFA for privileged accounts and for network access to non-privileged ones.
• K-12 guidance. CISA's January 2023 report, Protecting Our Future, recommends investing in the most impactful security measures first, addressing resource constraints, and sharing information.
• EU. NIS2 Article 2(5)(b) lets Member States apply the Directive to "education institutions, in particular where they carry out critical research activities." Annex II "research organisations" excludes them. GDPR covers students and staff.

Who needs identity, and what goes wrong

The identity controls that matter most

1. Treat vendor support access as institutional access. PowerSchool's portal reached every customer SIS through one credential. Contract for named support accounts, phishing-resistant MFA, IP restriction and session logs you can review: "direct control" under FERPA in practice.
2. Phishing-resistant MFA for staff first. Roll out FIDO2 keys or passkeys to finance, registrar, advancement and IT before students. See the MFA rollout playbook.
3. Limit what one SSO account can reach. At Penn, one account reached five systems. Require step-up authentication for bulk exports from SIS and donor CRM, and alert on unusual export volume.
4. Harden the help desk. Resets should need more than facts a caller can look up. See account recovery and vishing.
5. Automate the student lifecycle. Graduation, withdrawal and staff departures should drive joiner-mover-leaver events from the SIS and HR.

Deadlines to track

• 10 November 2026: CMMC Phase 2, Level 2 third-party certification in applicable DoD contracts. 10 November 2027 extends it to all applicable contracts.
• 17 April 2027: NIS2 entity list review, relevant where a Member State has extended NIS2 to education.

Vendors and fit

• Workforce and student identity: Microsoft Entra ID for Microsoft 365 campuses, Okta for neutral, app-heavy estates, JumpCloud for budget-conscious districts. Keycloak suits teams with in-house identity engineers. See best IAM for SMB and best IAM platforms.
• MFA: Duo Security for broad coverage, and Yubico hardware keys for staff with bulk data access. See best phishing-resistant MFA and the MFA matrix.
• Access to apps and research systems: Cloudflare Zero Trust instead of broad VPN access. See best zero trust tools.
• Governance: SailPoint or Saviynt for access certification at large universities; see best IGA tools.

Background: identity for education.

Common pitfalls

• MFA exceptions that linger for years.
• Vendor support portals with standing, password-only access to student records.
• One SSO account that opens VPN, CRM and file shares with no step-up.
• Alumni and departed staff accounts that never leave the directory.

Where it is heading

Passkeys will ease student friction, CMMC will push research universities toward separate, audited enclaves, and after PowerSchool, vendor access controls belong in every district contract renewal.

Frequently asked questions

Does FERPA require MFA?

No. FERPA requires "reasonable methods" limiting school officials to records they have a legitimate educational interest in. Title IV institutions face an explicit MFA requirement through the GLBA Safeguards Rule, enforced in FSA's annual audits.

How was PowerSchool breached?

According to PowerSchool and CrowdStrike, an attacker used a single compromised credential to enter PowerSource, its customer support portal, and exported customer SIS data between 19 and 28 December 2024.

Are schools and universities covered by NIS2?

Not by default. Article 2(5)(b) lets each Member State extend NIS2 to them, especially for critical research.

Does CMMC apply to universities?

Yes, where a university or lab holds DoD contracts involving Federal Contract Information or CUI. From 10 November 2026, applicable contracts can require third-party Level 2 certification.