Every attacker chasing a school network has the same goal once they're in: find an account with more power than it needs. A compromised standard user account is a nuisance. A compromised admin account is a takeover, it can touch every system, every dataset, and every piece of security infrastructure built to stop exactly this. It can probably reset passwords.

That's why access control isn't really about locking doors. It's about making sure that if one does get opened, there isn't a master key sitting behind it.

The principle of least privilege

Every user,  and every account, should have the minimum access needed to do their job, nothing more. In practice, this means:

• Unique logins for everyone. No shared accounts, no shared passwords.
• Role-based access (RBAC). Define what a role needs, assign users to the role, rather than hand-building permissions person by person.
• Segregation of duties. No single person should be able to action something sensitive:  a payment, a data export, an account change, entirely alone.  You may even need an in-person check for some changes.
• Regular access reviews. Permissions drift as people change roles. Review them, don't assume they're still right.

Admin accounts need a different set of rules

If you administer any part of your school's systems, you should have two accounts: a standard one for email and everyday work, and a separate admin account used only when you need elevated access. Never the other way round.

Beyond that:

• MFA is mandatory on every admin account: no exceptions, no "we'll get to it."
• Admin accounts shouldn't have email or general web access at all where possible,  if there's nothing to phish, there's nothing to compromise.
• Dormant or unused admin accounts should be found and disabled, not left live "just in case."
• If your IT is outsourced, make sure your school still holds local copies of admin credentials, and change them whenever your provider changes.

Leavers are the most common gap

The single most common access control failure isn't a sophisticated attack,  it's a login that should have been switched off weeks ago. When anyone with admin rights leaves, their access needs to go immediately: network, email, cloud services, shared drives, and physical access cards, all at once, not "when IT gets round to it."

What's changed under the DfE Digital Standards

As covered on Day 14, the DfE's June 2026 update expanded MFA expectations to cover all IT administrative accounts, not just senior leadership. If your admin accounts aren't already behind MFA, that's no longer a nice-to-have — it's the baseline the DfE now expects.

💡Your Daily Cyber Tip

Ask whoever holds admin rights in your school one question today: "When did you last use your standard account instead of your admin one, just to check email?" If the honest answer is "I don't really separate them," that's this week's fix.

More from DPE

• Watch our free Access Control micro-learning video for a quick walkthrough of least privilege in practice
• Use the DfE Digital Standards Tracker to check where your school's current access and MFA setup stands against the June 2026 update
• Not sure where your weak points are? Our "Where's Harry the Hacker?" look-and-find resource spots common access-control slip-ups (shared logins, unlocked screens, admin credentials left in the open) in a format staff actually engage with