Edit a user — Security tab

Everything about how this person signs in, in one place. Each switch saves the moment you change it (there is no separate Save button), and every change is recorded in the audit trail.

Three cues also appear in the header next to the user's status, so you can spot them from any tab: Default password, Must change password, and 2FA on / 2FA not set up. Select one to jump to the Security tab.

Open the Security tab

1. In the left sidebar, under Users & Groups, select Users to open its menu, then select Users again.
2. Find the person and select their name to open their record (the name is the link).
3. Select the Security tab, or select one of the cues in the header: Default password, Must change password, 2FA on or 2FA not set up.

You need permission to manage users & groups to open the page; resetting or setting a password also needs permission to reset passwords. The edit page doesn't open in MAT overview: switch to the person's school first.

Password

The panel says whether the user is on their own password or still on the default password (a red warning — anyone who knows the school default can sign in as them).

• Require a password change at next login — switch it on and they'll be asked to choose a new password the next time they sign in with their username and password. Turn it off to withdraw that request. Signing in with a QR code or with Google never asks for a password change and clears the request instead. For a student who can't change their own password (turned off at school, year-group or user level) the switch is unavailable, because the prompt could never appear — set a password for them instead.
• Reset to default — needs Reset user passwords, like Set a specific password; without it the panel says so instead. Confirm Reset this user's password to the school default? It sets the school's default password for their role and requires a change at next login. A message confirms Password reset to default. Skipped for a student whose password change is turned off for them or for their year group — you see Password reset is disabled for this user — nothing was changed. (If the whole school's student passwords are turned off, the reset still happens, but they aren't asked to change it.) To do this for a whole class, use the Reset passwords page. For what each way of setting a password does, see Password settings.
• Set a specific password — type the new password under New password and select Set password. The hint above the box shows your school's rule (for example, at least 4 characters, or longer under the DfE policy). It's stored securely, and a message confirms Password updated. It doesn't change the Require a password change at next login switch, so switch that on yourself if you want them to choose their own. It's queued straight away, and reaches the person's Google, Microsoft Entra or Active Directory account where your school sends passwords there (Sync passwords to Google, Sync passwords to Entra, Sync passwords to AD).

Resetting or setting a password also lifts a Too many sign-in attempts lock straight away.

Two-factor authentication

The badge shows the state: Off, On · set up (they've registered an authenticator app or a passkey), On · not set up yet (they'll be walked through setting one up at their next sign-in — nobody is locked out), or Exempt.

• Require 2FA — turns two-factor on or off for this user. If your school requires MFA for all staff or all students, the switch is locked on for anyone that setting covers and can't be turned off per user — the note links to Settings → Password, the only place it can be changed. Admins and owners always use 2FA, so their switch is locked on whatever the school setting says: it reads Required: admins always use 2FA, at every school. It can't be turned off here. If your school gives people days to set 2FA up (Days to set up 2FA after it's required), they can keep signing in until those days are up — see Time to set it up.
• Reset authenticator — for when they've lost their phone, authenticator app or passkey. Select it and confirm Reset this user's 2FA? It removes their authenticator app and any passkeys, so they can set up again at their next sign-in. It doesn't turn 2FA off, and it's unavailable when they haven't set up an authenticator app or a passkey yet.
• Exempt from MFA / Remove MFA exemption — for the one person who can't use MFA even though the school requires it. Only an admin can do this, and the button appears only while the school requires MFA for the person's role (or while they're exempt). Admins can't be exempted. See Reset or switch off MFA for one user.

Password change

The Password change card has one switch, Disable password change. It means different things for students and staff. For a student, switching it on stops them changing their own password on their profile page. For a member of staff, switching it on stops them resetting other users' passwords — it always stops a mentor resetting passwords, and with it off a mentor can reset only if the school allows every mentor to, or they're on the school's list of mentors allowed to reset passwords. If the school or the student's year group has student passwords turned off, the switch is unavailable and the card says which level set it: Set at school level or Set for this year group.

Login window

Restrict when this user can log in. Enter a Login start time and a Login end time in school local time (an overnight window is allowed) and select Save window. You must enter both, or you'll be told Enter both a start and an end time.

Don't allow login stops this person signing in to Realsmart at any hour of the day. It affects Realsmart sign-in only — their Google, Microsoft, Apple and Active Directory accounts are left exactly as they are, so it is not a way to suspend or delete an account. A blocked user is shown a notice at the top of this panel, and the Users list shows Login blocked in the Login times column.

Allow login at any time removes a window or a block and puts the person back to unrestricted access.

The window is checked when someone signs in, whether with a password, a QR code or Google. Outside it, a password or QR code sign-in shows You are not allowed to login at this time. Please try again during your allowed login hours. Someone who is already signed in isn't signed out when the window closes.

The same settings can be applied to many users at once from the Users page under Login options — both use the same underlying setting.

Related

• Edit a user
• Reset passwords
• Reset a user's 2FA
• Two-factor authentication for staff and pupils
• Password settings
• Too many sign-in attempts