NCEdCloud Enforce MFA — How LEA Administrators Enable MFA for Staff and Students
What Does NCEdCloud Enforce MFA Mean?
The NCEdCloud enforce MFA means that the RapidIdentity platform is configured to require users to complete a second authentication step, either a TOTP code or a WebAuthn hardware key, after entering their username and password. Without enforcement, MFA enrollment is optional. With enforcement, users who have not enrolled in MFA are blocked from completing login until they do.
NCDPI’s RapidIdentity platform gives LEA Administrators control over MFA enforcement at the LEA and school level. This applies to all 115 NC school districts. The most important thing to know is that MFA enforcement is configured per user group. Administrators can require MFA for all staff without requiring it for students, or vice versa.
Why Districts Enforce MFA?
NCEdCloud enforce MFA in NC school districts is driven by:
- State and federal security compliance requirements for systems containing student data
- Cyber insurance policy requirements that mandate MFA for staff accounts
- NCDPI security guidance recommending MFA for all accounts with access to sensitive applications
- Incident response after phishing attacks that compromised password-only accounts
Staff accounts that access PowerSchool, gradebooks, and student records are the highest-priority accounts for MFA enforcement.
How to Enable MFA Enforcement in NCEdCloud
- Log in to ncedcloud.mcnc.org with LEA Administrator credentials.
- Navigate to the RapidIdentity admin console.
- Open the Authentication or Security Policies section.
- Locate the MFA enforcement settings. These are typically configured by user group or role.
- Enable MFA requirement for the target group (for example, all staff, or all users with an admin role).
- Set the enrollment deadline — a date by which users must enroll before they are blocked at login.
- Configure the grace period if available — how many logins a user can complete without MFA before being hard-blocked.
- Save the configuration.
After enforcement is active, users who are not enrolled will see an MFA enrollment prompt the next time they log in.
MFA Enforcement by User Group
| User Group | Typical Enforcement Status | Recommended Approach |
| LEA Administrators | Required | Enforce immediately; no grace period |
| LEA Help Desk | Required | Enforce immediately |
| All staff (teachers, classified) | Strongly recommended | Enforce with a 2-week enrollment window |
| Students (secondary) | Optional — LEA policy | Enforce if the district policy supports it |
| Students (elementary) | Generally not enforced | QR badge or password-only is typical |
Communicating MFA Enforcement to Staff
Before the enforcement deadline, send staff a notice that includes:
- The date enforcement takes effect
- Which MFA methods are accepted (Google Authenticator, Microsoft Authenticator, 2FA Chrome Extension, WebAuthn)
- Step-by-step instructions for enrollment (or a link to the enrollment guide)
- Help desk contact for staff who have trouble enrolling
Enforcement without communication leads to help desk call volume spikes on enforcement day. A two-week notice window is the minimum; four weeks is better.
Frequently Asked Questions
Can I enforce MFA for staff but not students in NCEdCloud?
Yes. MFA enforcement in RapidIdentity is configured by user group. You can apply enforcement to staff roles — LEA Administrator, LEA Help Desk, teachers, and all staff — without requiring it for student accounts.
What happens to a user who is required to enroll in MFA but has not done so?
When MFA enforcement is active, and a user has not enrolled, the system presents an MFA enrollment screen at login rather than completing the authentication. The user cannot access the dashboard until they complete enrollment. If they cannot self-enroll, the LEA Administrator can temporarily exempt the account while the user gets support.
Can an LEA Administrator exempt specific users from MFA enforcement?
Yes. RapidIdentity typically allows per-account exemptions from group-level enforcement settings. This is useful for accounts used by systems or integrations that cannot complete MFA, or for staff with accessibility constraints. Exemptions should be documented and reviewed periodically.
Does MFA enforcement in NCEdCloud affect application-level MFA?
NCEdCloud MFA enforcement applies to the NCEdCloud login step. Some connected applications have their own MFA settings. Passing MFA at NCEdCloud does not automatically satisfy application-level MFA requirements in those apps. Contact the individual application’s administrator if you need to align MFA policies.
Our district had a cyber incident and needs to enable MFA urgently. Who do we contact?
Contact your NCDPI regional support representative and your Identity Automation support contact. Both can assist with expedited MFA enforcement configuration. Do not attempt to configure enforcement without first reviewing your current user group settings to avoid accidentally blocking large numbers of users who have not yet enrolled.
Related Reading
NCEdCloud MFA Setup Guide (/ncedcloud-mfa/)
NCEdCloud WebAuthn Enrollment Guide (/ncedcloud-webauthn/)
NCEdCloud TOTP FAQ (/ncedcloud-totp-faq/)
NCEdCloud LEA Administrator Role Overview (/ncedcloud-lea-administrator/)
NCEdCloud Login Troubleshooting (/ncedcloud-not-working/)
