Multi-factor authentication expands offsite access
Queensland Teachers' Journal, Vol 131 No 7, 2 October 2026, page no.16
Since the Queensland Teachers’ Journal last reported on the Department of Education’s multi-factor authentication (MFA) project, implementation has begun for selected external-facing applications, providing staff with secure offsite access to important departmental systems.
MFA is a security measure that requires users to provide an additional form of verification when logging in to a system. The department has advised that MFA is required for external-facing applications to comply with the Australian Signals Directorate’s Essential Eight cyber security strategies and the Queensland Government’s Information Security Policy.
As part of the department’s Cyber Security Plan 2024–2028, the initial rollout has focused on applications containing sensitive employee, student, financial, and human resources information. The first systems enabled under the MFA program include MyHR Workplace Health and Safety (WHS) and MyHR Performance Capability and Talent (PCT), allowing employees to securely access these services from outside the departmental network.
Importantly, the QTU has been informed that there are currently no plans to require classroom teachers using department-issued laptops to complete MFA while working within the school gate. This distinction reflects concerns previously raised by the QTU regarding workload, accessibility, and the practical realities of teaching and learning environments.
The QTU welcomes the department’s continued consultation throughout the implementation process. Member feedback during pilot programs and early rollouts has helped inform decisions about how MFA can be implemented in a way that balances cyber security requirements with ease of access for employees.
One significant development is the expansion of offsite access to MyHR functions through OnePortal. Employees can now access a growing range of MyHR services remotely by logging in to OnePortal and completing MFA verification where required. This includes access to the MyHR Workplace Health and Safety module, enabling staff to lodge incident reports and record hazards when they are away from their workplace.
The QTU has advocated for many years for improved remote access to MyHR systems, particularly for WHS reporting. Members have identified situations where incidents occur outside normal operating hours or where immediate access to departmental systems was not available. The ability to securely access WHS reporting tools remotely provides greater flexibility in these emergent situations.
At the same time, the Union continues to emphasise that improved access should not result in an expectation that work be completed outside rostered duty hours. As noted during the initial MFA consultation, the right to disconnect remains an important industrial principle. While technology can enable work to be undertaken in a wider range of locations, it should not increase workload or create expectations of constant availability.
The department has advised that MFA verification is generally required once every 12 hours when accessing applications from the same device. Users accessing services from a different device may be prompted to verify their identity again. Staff who do not have a personal mobile device available for authentication can instead use an authenticator application installed on their department-issued laptop.
Any authentication process must remain accessible for staff working in different contexts, including those in rural and remote locations, travelling between sites, relieving at multiple schools, or experiencing limited internet and mobile connectivity. The success of the rollout will ultimately depend on whether MFA operates reliably across the diverse environments in which QTU members work.
As additional external-facing applications are brought into the MFA program, ongoing user feedback will help inform future rollout stages and ensure that security improvements do not create unnecessary barriers.
Members experiencing authentication, password management, access permission, device registration, or MFA setup issues should use the department’s normal ICT support processes. Support is available through departmental ICT support channels, including the IT Service Centre (1800 680 445).
While the initial rollout of MFA has been measured, the true test will come as additional applications are enabled. The QTU will continue to support measures that strengthen cyber security while ensuring implementation remains practical, accessible and does not contribute to workload growth.