SMS access, security and the Level 2 transition

Current access changes

SMS guidance says new Level 2 users cannot be appointed from 9 September 2026. Existing Level 2 access ends after 8 March 2027; appropriate users need upgrading to Level 1 to retain access. The official MFA manual covers authentication arrangements.

Treat this as an operational change project. Inventory the people and tasks affected, check suitability for the proposed role and allow time to resolve access problems before a reporting deadline or intake peak.

Suggested access-control review

Keep a named user register showing role, business need, reviewer and last access review. Link staff departures and role changes to removal or amendment of access. A job title alone does not prove that a person still needs a particular level of permission.

Prepare authorised cover and recovery arrangements without sharing credentials. Test that the team knows the official support route and can distinguish a genuine login page from an unsolicited request for authentication information.

• List all current SMS users and the activities they perform.
• Identify remaining Level 2 users and plan the necessary role review.
• Check MFA setup and the institution’s secure recovery arrangements.
• Remove stale access promptly through the authorised process.
• Verify that reporting and CAS work have trained authorised cover.
• Retain evidence of access reviews and transition decisions.

Use only the official service

Start from GOV.UK when signing in. Our local tools do not connect to SMS, assign CAS or submit reports. Do not enter passwords, authentication codes or confidential student records into an unofficial form.

Review the transition again after implementation. Check that the intended users can complete their tasks and that permissions did not expand without a documented need.