Keep your existing setup
Manage accounts and passwords in Microsoft 365 or Google Workspace. Add MFA without replacing your directory.
Phone-free MFA for students.
Protect school sign-ins where phones and hardware keys aren't practical, without replacing your existing accounts or password workflows.
Microsoft 365
Google WorkspaceNo student phone or appPrint at school or homeManage one school or manyKeep existing accounts and passwords
Easy to carry. Easy to use.
A printed card, a quick lookup and you're in. No phone to find, charge or bring to class.
john.doeExample Academy
Print a card. Skip the hardware logistics.
Hardware tokens and security keys need to be purchased, distributed and replaced.
HallKey cards can be printed at school or at home. No devices to stock or ship.
Add MFA. Keep your setup.
HallKey adds a card check to your existing sign-in. Your identity platform stays in charge.
- Accounts
- Keep your directory, users and groups.
- Passwords
- Keep your password policies and reset process.
- Synchronization
- Keep your existing sync. No passwords are synced to HallKey.
Microsoft Entra ID
Add HallKey as an external MFA method. Microsoft keeps the password step; HallKey adds the card check for selected groups.
Microsoft integration guide
IT setup details
- Connect through
- External MFA method
- Apply the card step to
- Selected student groups through Conditional Access
Conditional Access requires Entra ID P1; confirm your education plan. External MFA methods do not currently satisfy authentication-strength policies.
Check Conditional Access licensingGoogle Workspace
Add HallKey through a custom OIDC SSO profile. Google keeps password validation; your team chooses the organizational units or groups.
Google SSO guide
IT setup details
- Connect through
- Custom OIDC single sign-on profile
- Apply the card step to
- Selected organizational units or groups
Confirm your Workspace edition and supported browser flows during setup. Test ChromeOS device sign-in and shared-device or portal launches separately.
Less overhead for school IT.
For school IT teams, districts, multi-academy trusts and regional education service agencies.
Discuss your deploymentIssue cards your way
Print cards at school or send enrollment invitations by email for printing at home.
Manage one school or many
Use multi-tenant functionality to manage HallKey across the schools your team supports.
Data residency comes as standard.
Choose where your HallKey deployment is hosted:
- United States
- United Kingdom
Is your country not here? Contact us
Control the location. Limit the data.
Deployment location helps your school address data-sovereignty requirements: where information is stored, which jurisdictions apply and who can access it.
Your existing identity platform remains responsible for passwords. HallKey adds the card check without synchronizing those passwords or replacing your directory.
A free pilot. Hands-on MFA expertise.
Our MFA experts work directly with your team to connect your identity platform, set up HallKey and test real sign-ins. Your pilot is completely free, including setup and expert assistance.
What's changing for education IT.
Phone restrictions are expanding while cyber threats continue to target schools. Education IT teams face growing pressure to strengthen account security without disrupting access to learning.
New York: phone-free schools
New York's policy addresses personal internet-enabled devices throughout the school day. The state's guidance explains district policies, storage arrangements and exemptions.
Read New York guidance85% began with identity-based attacks.
In Sophos's 2026 survey, 85% of ransomware attacks on education providers began with malicious email, phishing, compromised credentials or brute force. The finding covers both schools and higher education.
Sophos research, 2026Texas: a phone-free school day
HB 1481 requires school-day restrictions on personal communication devices, with defined exceptions. Review sign-in and account recovery that depend on student phones.
Texas HB 1481 guidance, 2025UK schools: the cyber risk in numbers
In the 2025/2026 government survey, 73% of secondary schools reported identifying a cyber breach or attack in the previous 12 months. These include attempted attacks, not just successful compromises.
UK school survey, 2025/2026Common questions
Have more questions?
Talk to the teamDo students need a phone or a new password?
No personal phone or authenticator app is needed for the card challenge. Students keep their existing school password; HallKey does not introduce a separate student password.
What happens when a card is lost or forgotten?
Revoke a lost or exposed card before issuing a new grid. Agree who verifies the student and grants any temporary access. Include recovery procedures and student instructions in rollout planning.
Can the card work on shared or home computers?
The card is not tied to one computer. Test supported browser sign-ins on your shared devices, Chromebooks and home computers. Cloud sign-in needs connectivity; device unlock and offline access are separate workflows.
How does this compare with passkeys and security keys?
A printed grid is not phishing-resistant. A fake sign-in page can relay its codes, and a photograph can copy the card. Use phishing-resistant authentication where your security policy requires it. Treat printed grids as secrets and revoke exposed cards.
Will HallKey work with our existing Microsoft 365 or Google Workspace environment?
HallKey works with Microsoft Entra ID and Google Workspace without replacing your existing student accounts or passwords.
For Microsoft 365, HallKey requires Microsoft Entra ID P1 or P2. For Google Workspace for Education, HallKey works with editions that support custom OIDC single sign-on.
Licensing tiers and included functionality can change over time. If you're unsure what your school already has, reach out and we'll be happy to review your current environment and requirements with you.
During the free pilot, we also confirm the configuration and test the sign-in paths your students actually use.
Can we start with the whole school?
You can discuss a selected student group, a whole school or multiple schools with the team. Agree integration, card distribution, recovery, accessibility and support readiness for the chosen scope. A smaller pilot is an option, not the only rollout path.
Can one IT team manage multiple schools?
Yes. HallKey is a multi-tenant solution for managing multiple schools. It supports school and district IT teams, multi-academy trusts, regional educational service agencies and education IT providers. Discuss your school structure and administration requirements with the team when planning the deployment.
Get a quote for your school.
One student group, a whole school or multiple schools. Start with the scope that fits.