- Knowledge Base Categories:
- School Accounting System
FAQ: What is Multi-factor Authentication (MFA), why is it important and what are the options for implementation in SAS-Online?
What is MFA?
Multi-Factor Authentication (MFA) is an added layer of security used when accessing the School Accounting System-Online (SAS-Online).
After logging into SAS-Online with your normal credentials, a second approval step through an authentication app is required.
This helps protect district data even if a password is compromised.
Why is MFA important?
Passwords alone are no longer enough to protect against modern cyber threats such as phishing, password theft, and unauthorized access attempts.
MFA adds a second layer of protection by requiring:
-
- Something you know → your password
- Something you have → your authentication device
This significantly reduces the risk of unauthorized access to district financial and employee data.
School districts and education software have increasingly become targets for phishing, ransomware, and credential theft attacks. In many cases, attackers gain access through compromised email accounts or stolen passwords. MFA helps protect district systems by requiring a second approval step that attackers typically cannot access, even if a password is compromised.
What does the authentication app do?
The authentication app is only used to approve your login request or generate a verification code.
The app:
-
- Does NOT contain district data.
- Does NOT contain SAS-Online data.
- Does NOT provide access to your computer.
- Does NOT track activity on your phone.
It is simply an approval system used to verify your identity during login.
The instructions show how to use an app called UserLock, but you can use most authenticator apps that generate verification codes.
Note: Not all authenticator apps support push notifications, but most can generate a code for manual entry.
Do I have to use my personal phone?
Most users choose to install the authentication app on their personal smartphone because it is the easiest and most secure option.
Many users already use similar apps for banking, email, healthcare, and other secure systems.
How large is the authenticator application? How much additional space will this take on my phone?
Most authentication apps are very small – typically somewhere between 20 MB and 100 MB installed on a phone. The UserLock application referenced in our instructions is under 40 MB. For reference, a single photo taken on a smartphone is often between 3-10 MB.
Can I install the authentication app on my computer instead?
Yes, an authenticator application can be installed on the same computer being used to access SAS-Online.
However, using a separate device such as a smartphone is more secure because it keeps the login process and approval process independent from one another.
If both the login and MFA approval occur on the same computer and that computer becomes compromised, some of the security benefits of MFA are reduced.
For users who prefer a desktop option, your district technology staff may be able to assist with selecting and installing an authenticator application. The application simply needs to support standard authentication code generation.
Why not use a setup where an MFA code is delivered via email?
Using email to deliver MFA codes is generally considered less secure because the email account itself is often protected by only a password.
If an attacker gains access to a user’s email account through phishing, malware, or password reuse, they could potentially reset passwords and receive MFA codes.
At that point, both the password and the “second factor” are effectively in the same place.
Authentication apps are more secure because the approval or code generation occurs on a separate device that is independent from the email account being accessed. This separation is one of the primary security benefits of true MFA and is a major reason why authentication apps are now considered a best practice across banking, healthcare, government and education systems.
What if I receive an approval request that I did not initiate?
Do NOT approve the request.
Unexpected approval requests may indicate that someone is attempting to access your account. Contact your district administrator or Software Unlimited support immediately.
How long does setup take?
Initial enrollment typically takes about 5 minutes.