SCHOOL MANAGEMENT · INFORMATION SECURITY
How Schools Should Manage User Accounts and Password Access
Practical school account practices covering individual identities, credential handling, role changes, recovery and administrator responsibility.
Conceptual product view · no customer records or performance figures
THE SHORT ANSWER
Manage school software accounts through named individuals, role-appropriate access, a protected credential process and prompt changes when staff responsibilities change. Never circulate a shared password as a shortcut. Confirm the product’s authentication, recovery and session controls, and train staff to report suspected compromise quickly.
01 / INDIVIDUAL IDENTITY
Give each authorised user an account that represents one person.
Individual accounts help the school understand who is responsible for a record change and allow access to follow a person’s role. Shared credentials weaken attribution and make it difficult to remove one person without interrupting everyone else.
If the product or institution currently relies on shared access, raise it as a control issue and plan a safe transition. Do not create unofficial accounts that bypass the provider’s approved account process.
02 / REQUEST & APPROVAL
Require a defined role and authorised approval before access is issued.
A request should identify the user, job responsibility, needed workflows and expected start date. The approving manager confirms the business need; the system owner assigns the corresponding product role.
Avoid granting broad administrator access because it is faster. Temporary access should have an end date and an owner responsible for removing it.
03 / CREDENTIAL HANDLING
Keep passwords and recovery methods private and under user control.
Use the product’s supported credential setup and recovery process. Do not send passwords in group chats, write them on visible notes or reuse a shared credential across staff. Follow provider guidance for password strength and any available additional authentication controls.
The school should not ask staff to disclose their current password to troubleshoot an account. Route access problems through an authorised reset procedure and verify identity appropriately.
04 / REVIEW & RESET
Respond promptly to suspected compromise or a role change.
Provide a contact for reporting a lost device, suspicious login or accidental credential disclosure. The responsible owner should follow the provider’s current response steps, review the affected access and determine whether other actions are needed.
When an employee changes duties, review permissions rather than carrying the old role forward. Confirm how resets and role changes affect active sessions before relying on them as an immediate control.
05 / RECOVERY & CONTINUITY
Make account recovery secure without creating a shared workaround.
Define how a user proves identity when locked out and who can request a reset. Keep alternate contact methods current under institutional policy and restrict administrator recovery actions to authorised roles.
If the system is temporarily unavailable, follow the institution’s approved continuity procedure. Do not create a shadow login or transfer another person’s credentials to keep work moving.
06 / PERIODIC HYGIENE
Review active users and stale access on a regular schedule.
Compare the account list with current staffing and duties. Identify inactive accounts, duplicate identities, unowned administrator roles and temporary access that has expired. Record who performed the review and close exceptions.
Include accounts in staff induction and exit procedures. Good account hygiene combines product controls with timely school communication and a clear owner.
A FIELD GUIDE FOR YOUR TEAM
A school account-management standard
Use this to define how accounts are requested, approved, protected, recovered and closed.
| Lens | Question to ask | What to record |
|---|---|---|
| INDIVIDUAL IDENTITY | Give each authorised user an account that represents one person. | A named-user register aligned with approved accounts. |
| REQUEST & APPROVAL | Require a defined role and authorised approval before access is issued. | A documented request, approval, role and expiry where temporary. |
| CREDENTIAL HANDLING | Keep passwords and recovery methods private and under user control. | A private credential setup and approved recovery route. |
| REVIEW & RESET | Respond promptly to suspected compromise or a role change. | An incident contact and role-change review process. |
| RECOVERY & CONTINUITY | Make account recovery secure without creating a shared workaround. | A verified recovery path and documented continuity procedure. |
| PERIODIC HYGIENE | Review active users and stale access on a regular schedule. | A recurring account review with tracked closure of exceptions. |
CODEPEX IN CONTEXT
Useful guidance begins with clear scope.
School ERP account, authentication, session and recovery controls must be confirmed in current product documentation. This article gives institutional practice guidance and does not imply a particular authentication feature or security certification.
Product-specific statements are based on the current owner-controlled capability declaration. Ask CodePex to confirm any institution-specific configuration or unlisted requirement.