If you do only one thing from this whole toolkit, do this one. Two-factor authentication is the single change that does the most to protect your nursery, it takes about five minutes, and it costs nothing. Microsoft’s own figures put it at blocking over 99% of the attacks that try to break into accounts. Nothing else on this list comes close for the effort involved.
This guide explains what it is, why it matters so much for a nursery specifically, and how to turn it on.
Your password is one factor: something you know. Two-factor authentication, often shortened to 2FA or MFA, adds a second: something you have, almost always your phone. After you type your password, the system asks for a second proof, usually a tap on a notification or a six-digit code. Only then does it let you in.
The point is simple. A password can be stolen, guessed, phished or leaked in a breach, and you might never know. But a stolen password on its own is now useless, because the attacker does not have your phone in their hand. They get past the first door and hit a second one they cannot open.
Your Microsoft 365 account is not just email. It is the front door to almost everything: the messages with parents, the shared files, the registers, the financial bits, the photos. One compromised login can expose all of it, including children’s and parents’ personal data, which is exactly the kind of breach that turns into a GDPR problem and an Ofsted or CIW conversation.
Nurseries are also targeted precisely because attackers assume the defences are weak. A setting running on shared logins and reused passwords, with no second factor, is the soft target they are hoping for. Turning on 2FA moves you out of that category in an afternoon.
You will need administrator access to your Microsoft 365 account, which is whoever set up your email and tenant in the first place. In a small nursery that is often the owner; in others it is your IT supplier. If you are not sure who has it, that itself is worth finding out.
Each member of staff will need their phone to hand for their own setup, because the second factor lives on their device, not yours. The free Microsoft Authenticator app is the smoothest option, though a text message code works too.
The cleanest approach for a nursery with more than a couple of staff is to switch it on across the whole account rather than person by person. In modern Microsoft 365 this is done through what Microsoft calls security defaults, or through Conditional Access on the larger plans, and it requires you to be signed in as an administrator.
Because Microsoft moves its menus around more often than anyone would like, the exact path is worth confirming against Microsoft’s current instructions rather than following a screenshot that may already be out of date. The principle is constant even when the menu names change: an administrator enables the requirement centrally, and each member of staff is then prompted to enrol their own phone the next time they sign in.
If you have an IT supplier, this is a five-minute job for them and a reasonable thing to ask them to do for you. It is also a good early test of whether they are on the front foot about your security.
Once it is switched on, every person goes through a one-off enrolment the next time they log in. They install Microsoft Authenticator, scan a code shown on screen, and confirm a test prompt. From then on, logging in means password as usual, then a tap on the phone to approve. After the first setup it adds a couple of seconds to a login, no more.
It is worth walking your team through this together rather than leaving everyone to puzzle it out alone, because the enrolment is the only fiddly moment. Once past it, nobody thinks about it again.
A few things trip nurseries up, all easily avoided.
Leaving the owner or manager until last, or exempting them “because they are busy”, is exactly backwards. The most powerful accounts are the ones attackers most want, so they need the protection most.
Relying only on text-message codes is better than nothing but weaker than the app, because text messages can in some cases be intercepted or redirected. Use the Authenticator app as the default and keep text as a fallback.
Forgetting about shared or generic accounts, like a single “office” or “admin” login that several people use, leaves a hole. Those are the hardest to protect with 2FA and the best argument for giving everyone their own named account instead, which we cover in the Strong Windows passwords guide.
A nursery that has this right can say the following honestly: every member of staff has their own login, every one of those logins needs a second factor, the manager and owner accounts included, and there are no shared logins quietly sitting outside the net. If a password leaks in a breach tomorrow, it is an inconvenience and a password reset, not a crisis.
Two-factor authentication is the highest-value five minutes in this entire toolkit. It blocks the overwhelming majority of account attacks, it costs nothing, and it turns a stolen password from a disaster into a non-event. Turn it on for Microsoft 365 first, make sure the owner and manager accounts are included rather than excused, and use the app rather than text messages where you can. If you put off everything else, do not put off this.
Octopus 365 has supported nurseries since 2011, and James has worked with early years settings since 2009. If you’d like a hand turning on 2FA across your team, or a second opinion on whether your accounts are properly protected, get in touch any time. No hard sell, just a conversation.