IT & Microsoft cloud for education

For a school already using Microsoft 365 Education, a good proportion of this is a configuration exercise rather than a purchasing one, since the licensing frequently includes capabilities that have not been switched on. The gap is usually not tooling but ownership: knowing who is responsible for checking that MFA is actually enforced rather than merely available, that patching covers the whole estate rather than the newest devices, and that a restore has been attempted this year.

The standard that catches schools out most often is account control, because school estates accumulate accounts relentlessly: leavers, temporary staff, supply teachers, shared classroom logins, and old student accounts. A termly review, ideally driven from the MIS rather than done by hand, keeps that under control and is far less work than an annual clear-out.

The technical work is specific: filtering that applies to school-owned devices wherever they are used rather than only on the school network, monitoring that surfaces concerns to the designated safeguarding lead rather than into an unread log, and the ability to show what is filtered, what is monitored, and who reviewed alerts. That evidence is what governors need in order to give the assurance the guidance asks of them.

The boundary is worth stating clearly. IT provides and maintains the capability and the evidence; the DSL owns the safeguarding response. Where that boundary is vague, alerts tend to sit in a queue nobody has been made responsible for, which is the failure mode that matters most here.

The purchasing route matters as much as the tier, and it is where the largest savings sit. Under Microsoft's Enrollment for Education Solutions you license faculty and staff, counted as Education Qualified Users, and student coverage comes with it, so an institution buying student licences separately is often paying for something it already has. EES normally requires 1,000 qualified users, which puts it beyond most individual schools, but the Chest agreement run by Jisc reduces that minimum to 100 and brings it within reach of far more schools, sixth form colleges and trusts.

The recurring finding is not overpriced licensing but wrong-tier and wrongly-routed licensing: staff on plans well beyond what their role uses, licences still assigned to leavers, student licences bought alongside a staff agreement that already covered them, and paid third-party tools duplicating something already included in the Microsoft 365 Education subscription.

Device strategy is the second lever. Extending the useful life of existing hardware, buying appropriately rather than aspirationally, and using centrally managed deployment so a device can be re-imaged and reassigned quickly all reduce the replacement rate. Autopilot-style provisioning matters here because it removes the technician time that otherwise makes device turnover expensive.

Third is avoiding the emergency. Unplanned spend, an unsupported system that has to be replaced at short notice, recovering from an incident that better backups would have made routine, is consistently more expensive than the planned version of the same work, and it lands in whichever budget year it happens to occur.

In practice that means migrations, network changes, server replacements and anything requiring significant downtime are planned into the summer, with Christmas and Easter used for smaller pieces. Preparation, discovery, design, procurement, testing, happens during term so that holiday time is spent executing rather than working out what to do. Holidays are short and there is no second attempt until the next one.

During term the priority inverts to keeping teaching running: fast response when a classroom is affected, because a room of thirty pupils cannot wait, and changes kept minimal and reversible. It is also worth being realistic that the first week of September is the busiest support period of the year, so a change landing in late August needs to be finished and tested well before staff return, not on the day they do.

Filtering has to follow the device rather than the network, which means enforcement on the device itself so protection applies at home exactly as it does in a classroom. Updates and software deployment have to reach a device that may not connect for days, which changes how compliance is measured: a device that has not checked in is not the same as a compliant one, and the reporting needs to distinguish the two rather than counting silence as success.

Then there are the realities of the scheme rather than the technology. Devices get damaged, lost and returned in unpredictable states, so a fast re-provisioning process matters more than in a staff estate: Autopilot-style rebuild means a returned or repaired device is reset and reissued without a technician spending an afternoon on it. Losing a device should be an inconvenience rather than a data incident, which encryption and the ability to wipe remotely both cover. And there is a fairness dimension worth naming, since not every household has reliable internet, so anything that only works online will not work equally for every pupil.