Substitute teacher temporary access should let an educator reach the classroom tools they need without sharing a permanent teacher’s password. The practical approach is to use an individually identifiable account, grant only the required access, set an end time, and confirm that access is removed when the assignment ends.
This separates two important tasks: verifying who is signing in and deciding what that person can use. A temporary sign-in credential may help with the first task, but it does not automatically limit access to apps or student information. Schools need a plan for both.
Give each substitute an identifiable sign-in
A shared staff account makes it harder to know who accessed a resource and can leave access in place after a substitute’s assignment. Instead, use a school-approved account or identity that can be associated with the individual substitute. Avoid giving substitutes a teacher’s regular username and password, even when the assignment is brief.
Before the assignment, confirm the substitute’s identity and the dates, classes, and tools they need. Assign an owner, such as an administrator or IT contact, who is responsible for approving access and making sure it ends on time. A clear process for creating and removing accounts can help; see this guide to school staff account provisioning and deprovisioning.
Limit access to the assignment
Use permissions that match the substitute’s responsibilities. For example, access might be limited to the relevant class materials and communication tools rather than broad staff folders or unrelated student records. The right settings depend on how the school’s systems handle classes, roles, and permissions.
Make an inventory of the places where access may need to be set separately:
- The school identity provider and email
- The learning management system and classroom applications
- The student information system, if access is needed for the role
- Classroom devices and shared workstations
- Any app accounts managed outside the school’s central sign-in system
Do not assume that adding someone to a school account automatically gives appropriate access in every application, or that removing the central account closes separate app accounts. Check each system in the inventory.
Make MFA workable without sharing credentials
Multifactor authentication (MFA) can be difficult to set up when a substitute has little onboarding time or does not have a school-issued phone. Plan an approved sign-in method before the first class. Depending on the school’s systems and policies, options may include an authenticator, a security key, or a managed-device workflow.
Give substitutes a safe route to get help if they cannot complete sign-in. A designated help-desk process can verify identity and resolve access problems without asking a permanent teacher to share a password or approve a sign-in they cannot verify. Keep any recovery process consistent with the school’s identity policies.
Some platforms offer a temporary access pass to help a person sign in or register authentication methods. That pass is an authentication tool, not a permission plan: it does not by itself decide which apps or records the substitute can access. If your school uses Microsoft’s option, consult its school-level Temporary Access Pass guide and check that app permissions and account expiration are handled separately.
Set an end time and verify removal
Access should have an expiration tied to the assignment, not an open-ended end date. When creating the account or granting permissions, record when access should stop and who will verify that it has stopped. If the assignment changes or is canceled, update access rather than waiting for the original end date.
At the end of the assignment, check the identity provider and each application in the inventory. Disable or remove the substitute’s access as appropriate, including separate accounts or class memberships. Where the system supports it, review active sessions or sign-in tokens as part of the process. A confirmation step helps catch access that was granted directly in an app and was not removed with the main account.
Schools looking to make this process repeatable can use an offboarding checklist alongside their broader account workflow. Staff training can also explain how to request temporary access and what to do when a sign-in problem arises. Zevonix’s school staff cybersecurity training guidance covers the role of clear, consistent security practices.
When a substitute uses a permanent teacher’s device
Sharing a device does not need to mean sharing a signed-in session. When possible, provide a school-managed device or a separate managed user or browser profile for the substitute. Have the teacher sign out before handing over the device, and make sure the substitute signs out and closes school applications when finished. Avoid saving passwords in a shared browser or leaving student records open for the next user.
If the device or app keeps a session active, include that in the school’s sign-out procedure. Device configuration matters too: schools can review their approach to managing school IT assets to help keep shared technology accounted for and appropriately configured.
Keep student privacy in view
Give substitutes only the student information needed for their assigned work, and follow the school’s privacy and access policies. FERPA applicability can depend on the type of educational agency or institution and its circumstances. Private or religious schools should not assume that the same answer applies to every school; review the U.S. Department of Education’s explanation of which educational agencies or institutions FERPA applies to, along with applicable school requirements.
Frequently asked questions
Should substitutes use their own school account?
Use an individually identifiable school-approved account or identity for the substitute, rather than a permanent teacher’s account. The school can then assign limited permissions and set an end time.
How can a school limit a substitute’s access to student records?
Grant access only to the records and tools needed for the assignment. Review permissions in each relevant system, since access may be managed separately in different applications.
How can substitutes use MFA if they are on campus for only one day?
Plan an approved sign-in method and a verified help-desk fallback before the assignment. Do not make sharing a teacher’s password or permanently skipping MFA the workaround.
Can a substitute teacher use a temporary access pass?
Possibly, if the school’s identity platform supports it and its policies allow it. A temporary pass can support authentication, but the school still needs to set appropriate app permissions and an expiration for access.
When should the school disable substitute access?
Set the end time when access is approved, based on the assignment, and verify removal when the assignment ends or changes. Include separately managed app access in that check.
Make temporary access a defined process
A reliable substitute access plan connects identity, permissions, MFA, shared-device practices, and offboarding. Start by documenting which systems a substitute needs, who approves access, when it expires, and who confirms removal. Zevonix supports K-12 schools with managed IT and cybersecurity services. To discuss your school’s access workflow, call (904) 658-0777.