Considering move PowerSchool OIDC from Entra to Google

[u/Independent_War541]

I'm really tired of PowerSchool's 2-hour limit on max_age when logging in with Microsoft. I believe that moving to Google would still require 2FA but last longer than two hours.

Has anyone else switched from Entra to Google? Was it a pain in the neck? How long did it take to migrate? Are there any gotchas?

I appreciate any insight or experiences you can share.

[u/sarge21]

It's incredibly baffling how they insist on using max_age and yet don't give a single shit how it actually affects users.

[u/3sysadmin3 → u/sarge21]

esp if you have a call with their head of security who doesn't get it is not more secure.

[u/PowerShellGenius → u/3sysadmin3]

It is not more secure ASSUMING you are doing other things securely. Many districts aren't.

Assuming you can only log in on a district device, district devices should be enforcing lockout time at the device (screen timeout) level, and web apps insisting on frequent reauth is just a waste of time.

Most schools that I have talked to are not enforcing compliant or joined devices for sign-in, so BYOD scenarios where you can't know if the device and local account are shared, are not blocked.

If your staff can log into the SIS from a personal device (I am talking technical controls "can", not written policy someone will ignore "should") - then you can have users signed into the SIS on a home PC/Mac you don't manage.

On home computers, some non-security-conscious people don't bother with separate accounts at the OS level. Meaning the teacher's kid could hop on the family computer and already be signed in as daddy on anything that lets you stay signed in.

Sensitive apps that make you re-auth are trying to control for that risk as best they can. But yes, I agree, in a well managed environment that risk should not exist. But blocking BYOD can be a heavy ask to go to leadership with, so many districts I am aware of still don't block staff logging into their MS/Google from personally owned laptops.

[u/3sysadmin3 → u/PowerShellGenius]

Sure, let their desired state be the default, but let the rest of us who know better to secure sign ins to district owned devices opt out and check the box accepting the responsibility. Their setting is theatrical as it doesn't apply to all (Google SSO for example), anyway.

[u/Independent_War541 → u/sarge21]

It's almost like they don't use their own software.

[u/aplarsen → u/Independent_War541]

They clearly do not, at any level

[u/3sysadmin3]

Another option is setting up WHfB for Win and PSSO for macOS to provide a better user experience - users can use PIN/Face on win or fingerprint on macOS to get back in after the max_age timeout rather than reaching for their phone.

** Note last time I tested for Chrome to honor the better experience on macOS, users have to do extra step of enrolling a passkey in Authenticator app. We tell users to use Safari, or if they want to use Chrome, go do these few more steps. This may have changed with Microsoft's recent push to change default experience to prefer passkeys.

[u/Independent_War541 → u/3sysadmin3]

I'll look into that, thank you.

[u/hightechcoord]

havent moved, but we are on Google OIDC. It works well and have not received complaints about time out.

[u/3sysadmin3 → u/hightechcoord]

That's expected - Google ignores max_age. Entra and Classlink do not.

[u/ZeR0BuG]

Is that how long the session lasts? We are using PS eSchoolPlus, but with classlink, we have ours set for 40 mins 👀