Skip to main content
HackFirstAidEducation
All vendors

Productivity / Identity

Microsoft 365 Education (A3 / A5)

Email, Teams, OneDrive, Entra ID. Common in larger districts.

Escalation path

  1. Open a Severity A case via the Microsoft 365 Admin Center.
  2. For BEC or account takeover, use the Microsoft Defender → Submissions portal.
  3. Pull Unified Audit Log entries before the 90/180-day retention rolls off.

Contract clauses to pull up

  • A3/A5 EDU includes the K-12 student privacy DPA. Confirm whether your tenant has Defender for Office 365 enabled — many districts do not.

Pair with these playbooks

Teacher email / BEC

Compromised teacher mailbox — gradebook variant (transcripts) and the payroll-redirect variant (paycheck reroute).

Student Google Workspace / Microsoft 365 takeover

Compromised student account — and the triage 'is this a real compromise or a student prank?' decision tree.

Insider threat — staff or contractor

Particularly access to grades, finance, or student data. Departing-employee overlay (mid-year vs end-of-year).