A lot of districts run two worlds. Students live in Google Workspace and sign in on Chromebooks. Staff and the back office run on Microsoft 365. Underneath, Active Directory often feeds both: Google Cloud Directory Sync pushes accounts to Google, and Entra Connect pushes the same accounts to Microsoft.
If that describes your district, you may assume student MFA through Microsoft is off the table because students do not use Microsoft. It is not. Google lets a third-party identity provider handle sign-in, and Entra can be that provider.
Entra as the front door for Google
Google Workspace supports SSO with a third-party identity provider over SAML. Microsoft publishes a gallery app for exactly this, the Google Cloud / G Suite Connector by Microsoft, and both companies document the setup. Google's own guide covers managed Chromebooks, so students can sign in on ChromeOS through the Entra sign-in page.
Once Entra handles the sign-in, Entra's Conditional Access applies to it. A student types their email at Google, gets sent to the Microsoft sign-in page, completes whatever second factor policy requires, and lands back in Google. If your second factor is an external MFA method built for students, it applies to Google sign-ins the same way it does to Microsoft ones.
You do not have to move students off Google to protect their accounts. You change who checks the password, and the classroom stays the same.
Things to plan for
- Matching usernames. The student's Google email and their Entra account need to line up. If AD already feeds both directories, this is usually true. Check before you test.
- The email attribute. Microsoft's guide maps the SAML user identifier to the user's mail attribute, because Google expects an email address. Students without a populated mail attribute will see an error.
- Start with one OU. Google lets you assign an SSO profile to specific organizational units or groups. Point one building's student OU at Entra first and leave everyone else on Google sign-in.
- Chromebook settings. SAML SSO for Chrome devices has its own settings in the Google Admin console, separate from web sign-in. Follow Google's ChromeOS guide and test on a real managed device.
- Shared carts. A second factor that belongs to the student instead of the device works no matter which Chromebook they grab from the cart.
Why this is worth the effort
Student accounts in Google hold the same things they would in Microsoft: email, files, class communication. An attacker who takes one over can message teachers from an address everyone trusts. Districts that have assumed student MFA was impossible because they are a Google district have more options than they think.
The setup is a few hours of identity work, then a careful pilot. The day-to-day experience for a student barely changes.
For the full picture, from choosing a factor to rollout, see our student MFA guide for K-12 IT.
Student MFA for Google districts
DistrictID works for Google Workspace districts that use Entra as Google's identity provider. Shared Chromebook carts included.
See How DistrictID Works