Password settings

School settings → Password is where you set the school-wide rules that govern member passwords — the password policy, the default password given to new accounts, minimum length and complexity, password expiry, and who is allowed to reset or change a password. Two-factor authentication toggles live on this same page but are covered in their own doc — see Require MFA for staff and students.

Step 1 — Open School settings → Password

Select School settings in the sidebar, then Password. You must be an admin with the Change school settings permission for the current school (full admins have it). The chips at the top jump to Passwords, Two-factor authentication, Other websites and Year groups. Most settings save together with Save password settings (Step 7); the year-group card has its own save button, and the two lists of people (mentors who can reset passwords, and 2FA exemptions) apply as soon as you change them.

Step 1a — Choose the password policy

Password policy at the top of the Password tab sets the rules every new password must meet:

• Standard (current rules) — the default for every school. Passwords follow the rules in Step 3 below, exactly as they always have.
• DfE cyber security standard — new passwords need at least 12 characters for staff and at least 8 for students. The minimum lengths in Step 3 can raise these but never lower them. There's no need for a mix of capital letters, lower case and numbers, so a passphrase such as "plum orchard lantern" works (Require complex learner passwords is ignored while this is on). Staff passwords are checked against known data breaches: one that has appeared in a breach is refused. Only a short, anonymous fragment of the password's fingerprint is sent for the check, never the password; if the check can't be reached, the password is accepted.

"Staff" means everyone who isn't a student: mentors, admins, governors, observers. The policy applies to every place a password is set — the person's own My profile and SmartLogin's password change, an admin's Set password (one user or in bulk), Password import (CSV and wizard), the password column of the user import, and the default passwords below. Existing passwords keep working: the new rules apply when a password is next changed, and nobody is made to change theirs. A password import skips any row the policy refuses and names those users; the wizard won't apply a run if any password it made is refused. The change is recorded in the admin audit trail.

Step 2 — Set the school's default passwords

• Default learner password and Default mentor password — the password given to accounts when they're reset to default (see Reset passwords). Each field shows whether a default is already set.
• Both fields load blank — leave one blank to keep the current default; type a new value only when you want to change it. The stored value is never shown back to you.
• Also update existing members who still have the old default password — tick this if, when you change a default, you also want every member still using the old default password moved over to the new one. Leave it unticked to only apply the new default going forward (e.g. to members reset afterwards); everyone already on the old default keeps it until they're next reset. Members moved this way have the new password sent to your connected directories too (Google Workspace, Microsoft Entra, and Active Directory when Sync passwords to AD is on), the same as any other password change — see Sync passwords to Active Directory.

Keep your default password syncing to Entra/AD: for some schools set up a while ago, the stored default can still reset users in the app, and still reaches Google Workspace, but can no longer be passed to Microsoft Entra or on-premise Active Directory — those two need a readable copy of the password and this older format can't provide one. A reset still works, the notifications bell asks you to re-save the default, and schools that sync passwords only to Google are unaffected. Re-entering the default learner and/or mentor password here and saving restores full syncing (and clears the notice). It doesn't change any current passwords on its own. See Reset passwords → Keeping the default in sync.

Passwords for new Microsoft 365 accounts

If your school syncs to Microsoft Entra, each new Microsoft 365 account is created with the person's own Realsmart password if they have one, otherwise with the default learner or mentor password set here. If a default is set but can't be read, the account isn't created, and the reason shows on Entra sync issues. If no default is set for their type at all, the account is created with a random password nobody knows: signing in through SmartLogin still works, but to sign in to Microsoft directly they need a password reset, so set a default here.

Changes to the password of an account that already exists only reach Microsoft when Sync passwords to Entra is on — see Microsoft Entra settings.

Microsoft only accepts a password that is at least 8 characters and uses at least three of: lower-case letters, capital letters, numbers and symbols. It also turns down passwords that are easy to guess, for example ones containing the person's name. If a person's password doesn't meet these rules, Microsoft refuses the account; give them a stronger password and the next Entra sync creates it. Make sure your defaults meet these rules too.

Step 3 — Set minimum length and complexity

• Min length (learners) and Min length (mentors) — the minimum number of characters required. Leave a field blank to fall back to the system default of 8 characters.
• Require complex learner passwords — when on, a learner's password must contain an uppercase letter, a lowercase letter, and a number. Mentor and other staff passwords always require this same complexity — it isn't a separate toggle.
• These rules apply whenever a member sets or changes their own password — on My profile, on the Profile page on Realsmart sign-in, and on the "choose a new password" screen they get when a change is required at sign-in — and when an admin sets one for them from the user's edit page. When people choose their own password, a short list of very common passwords (for example "password123") is also always refused, whatever these settings say: they see That password is too common or easily guessed. Please choose a different one. An admin-set password isn't checked against that list.
• With the DfE cyber security standard policy on (Step 1a), the minimum lengths here only count when they're higher than 12 (staff) or 8 (students), and the complexity tick is ignored.

Step 4 — Set password expiry

Password expiry days (learners) and Password expiry days (mentors) set the number of days a password is valid for that group before it must be changed. Leave either blank if you don't want that group's passwords to expire.

Step 5 — Control who can reset or change passwords

• Mentors can reset passwords — turns on the Reset passwords page and the related bulk actions for every mentor (teacher) at this school, including anyone added later, so they can reset passwords for their own pupils without needing an admin. See Reset passwords. To let only some mentors do this, leave it off and use the list below.
• Disable student passwords — turns off every student's ability to change their own password, school-wide. This is the same setting described in Reset passwords → Control who can change their password; you can still turn it off for an individual student, or in bulk, from the Users page — but this school setting overrides those when it's on.

Let only some mentors reset passwords

Under Mentors can reset passwords is Mentors allowed to reset passwords — a list of the mentors who may reset passwords while that setting is off. Use it when only a few staff (for example your IT technician or heads of year) should be able to reset pupils' passwords: a new mentor can't until you add them.

1. Leave Mentors can reset passwords unticked (untick it and select Save password settings if it's on now).
2. In the search box under Mentors allowed to reset passwords, type part of a mentor's name, username or MIS id, then select them (or use ↑/↓ and Enter). Only mentors are listed.
3. To take someone off, select the × on their name.

Adding or removing someone applies straight away — it doesn't wait for Save password settings. Every change is recorded in the admin audit trail.

• While Mentors can reset passwords is on, every mentor can reset passwords and this list has no effect. You can still build the list first and turn the setting off afterwards.
• Adding a mentor also switches off their own Disable password change switch (see Edit a user → Password change), since that switch being on would otherwise still stop them. If someone later switches it on again, their name shows Blocked on their profile here and they can't reset passwords until it's switched off again.
• Admins aren't on this list — they can always reset passwords unless their own admin access has been restricted.

Step 5a — Disable passwords for specific year groups

Below the toggles in Step 5, Disable passwords for specific year groups lets you turn off self-service password changes for one or more year groups instead of the whole school — for example, disabling it for younger pupils while older year groups keep the ability to change their own password.

• Tick the year groups you want to disable, then select Save year-group password settings. The change applies to every current student in those year groups immediately. Year groups are listed as Year 1, Year 2 and so on, with Nursery and Reception by name; students whose MIS record has no year group are listed together as No year group.
• It's ignored while "Disable student passwords" (all students) is on — that setting already covers every student, so the year-group list has nothing left to add until it's turned off.
• A student added to, or moved into, a disabled year group later (by a MIS/Wonde/AD sync, or by editing their record) is picked up automatically — there's no need to re-save this setting.
• This sets the same per-user Disable password change switch shown on a student's edit page and in the Users bulk actions — see Reset passwords → Control who can change their password. A student's edit page names "this year group" as the reason when it's the year-group rule keeping their switch locked. Disabling a student manually (per-user or in bulk) always takes precedence and isn't undone by later changing this list.

Two-factor authentication

The Two-factor authentication (2FA) part of this page holds Enable 2FA for all staff (admins always require it), Enable 2FA for all students, Days to set up 2FA after it's required, Trusted IP addresses, the Exempt users list (people who are never asked for 2FA) and a read-only Admins not yet using 2FA list. They're covered fully in Require MFA for staff and students, and the list of everyone who still has to set 2FA up, with their deadlines, is on School settings → 2FA set-up (see See who still needs to set up 2FA), so this doc doesn't repeat them. Admins and owners always use 2FA, whatever these settings say. Note that the Exempt users list, like the mentors list in Step 5, applies as soon as you add or remove someone: they're the only controls on this tab that don't wait for Save password settings.

Warn before opening other websites

Under Other websites, Warn before opening other websites after sign-in is off for every school unless you turn it on.

Sometimes a sign-in link sends people on to another website once they've signed in. With this setting off, those links open straight away. Turn it on and select Save password settings, and if that website isn't part of Realsmart or your school (and isn't a service set up to sign in with Realsmart), people first see a short page that names the site and reminds them they won't need their Realsmart password there. They choose Open and the site's name to carry on, or Stay on Realsmart. This helps stop a fake website asking for their password straight after a real sign-in. The change is recorded in the admin audit trail.

If someone opens that page after it has expired it says That link has run out. Nothing's wrong with your account. Carry on from Realsmart instead. and offers Go to Realsmart.

Sign-in sessions

Under Sign-in sessions, Limit how long sign-in sessions last is off for every school unless you turn it on. While it's off, people stay signed in on a device until they sign out. Turn it on to sign people out automatically, then set:

• Staff session length (hours) — staff are signed out this long after they signed in. From 1 to 24 hours; leave it blank for 12.
• Staff idle sign-out (minutes) — staff are signed out after this long with nothing done. From 5 to 480 minutes; leave it blank for 60.
• Students signed out at — students are signed out at this time on the day they sign in, or when their login hours end if that's sooner. It's a time such as 18:00 (the default). Students are never signed out for being idle.

"Staff" here means everyone who isn't a student, including admins, governors and observers. Select Save password settings to apply it. People who are already signed in with a session older than the new limits are signed out the next time they use Realsmart, and a change reaches SmartLogin within about a minute. It's useful on shared devices. If you type a time the page can't read it says The students' session end must be a time, such as 18:00.

Looking for QR code login?

QR code login is switched on from its own tab — School settings → QR login — not this Password tab. See QR code login for enabling it and generating codes for pupils.

Step 7 — Save

Select Save password settings. Because this can update existing members' passwords, you'll be asked to confirm before it applies.

What password does a new or reset user get, and will they have to change it?

What the table means:

• The school default for their role. Learners get the Default learner password. Mentors and admins get the Default mentor password. A governor, observer or Ofsted account created by hand starts on the Default learner password, but resetting it gives it the Default mentor password.
• A learner who can't change their own password — because of Disable student passwords, a disabled year group, or their own Disable password change switch being on — is never asked to change it.
• Reset to default skips some learners. A learner whose password change is turned off for them, or for their year group, keeps their current password. While Disable student passwords is on, learners are still reset, but they aren't asked to change the password.
• Accounts the MIS sync creates, and new accounts from the user import with the password column left blank, start on the school default for their role. Existing users imported without a password keep the password they have.
• QR code sign-in never asks for a password change.
• Password expiry (Step 4) can also ask someone to change their password later, once it's older than the number of days you set.

See Reset passwords, Password import and Import users and cohorts.

Troubleshooting

• "That password is too common or easily guessed. Please choose a different one." The person chose a password on Realsmart's list of very common passwords. They need to pick another.
• "Your new password must be different from your current one." A person tried to change their password to the one they already have.
• A password is refused as being in a data leak. Under the DfE cyber security standard, staff passwords that have appeared in a known breach are refused (the message says has appeared in a data leak). Choose a different password or passphrase.
• A password is refused as too short. Under the standard policy the minimum is the Min length you set (8 if blank); under the DfE standard it's at least 12 for staff and 8 for students, and your Min length boxes can only raise that.
• "The students' session end must be a time, such as 18:00." Fix the Students signed out at box. See Sign-in sessions.
• People are signed out sooner than expected. Check Sign-in sessions: the staff session length, idle time and the students' end time apply once Limit how long sign-in sessions last is on.
• People see a page naming another website after signing in. Warn before opening other websites after sign-in is on. See Warn before opening other websites.
• The notifications bell asks me to re-save the default password. See Keep your default password syncing to Entra/AD and Notifications (the bell).

Related

• Require MFA for staff and students
• Reset passwords
• QR code login
• Bulk actions on users