Account settings

Admin › Account › Account Settings holds the settings that apply to your whole district: how people reach schoolOS, how they sign in, and your time zone and fiscal year. It has two tabs: Settings, described here, and Branding, your logo and colors (Account branding).

It's in Admin for every account. Super Admins see it, and so does anyone whose role has View account settings (it comes with Admin console at View). Changing anything needs Change account settings. Without it, the page still shows your settings, but saving is refused.

Your subscriptions aren't on this page. To add, renew or change a product, or to check its dates or seats, contact schoolOS.

The Settings tab is one column of sections, in this order. Each opens and closes from its heading, and while it's closed it shows what it's set to, so you can read the whole page at a glance. Domains, the first, starts open and the rest start closed; a link to a section opens it. The page remembers which sections you left open.

Domains#

Your district's verified email domains, for example district.k12.wa.us. They're how schoolOS knows that someone signing in belongs to your account.

They're also what "outside your account" means. When an admin adds an email address somewhere schoolOS sends messages, like a schoolAgent route or an integration's alert list, an address on one of these domains (or a subdomain of one) is accepted as is. Any other address needs a confirmation first. See Addresses outside your district.

Time zone#

Your district's time zone, in the Time zone and fiscal year section. Business hours, SLAs, the school year for repairs and what schoolAgent treats as "today" all follow it. History (a ticket's events, a device's or a person's timeline, the audit log) shows times in each person's own computer time zone instead, and uses this one only when their browser doesn't say.

Pick your zone from the list. Each zone shows its time right now, and its abbreviation and offset from UTC for today, like PDT · UTC−7, so daylight saving is always accounted for. Search by a city ("Dallas"), a zone name, an abbreviation ("CST") or an offset ("UTC-6").

It saves as soon as you pick one, and the change is recorded in the audit log. schoolOS can also set it for you; whichever change is saved last wins. Arizona and Hawaii don't change their clocks, so pick Arizona (no daylight saving) or Hawaii Time there rather than Mountain or Pacific.

Fiscal Year#

The month your fiscal year starts. Device replacement years in reports and on the Assets list follow it, and so does This school year on the IT and Facilities dashboards.

• Starts in is July unless you change it. That's the usual US school-district fiscal year.
• A fiscal year is named by the year it ends in. With a July start, July 2026 to June 2027 is FY27. With a January start, the fiscal year is the calendar year.
• The row shows which fiscal year today falls in, and the months it covers, so you can check your choice.

It saves as soon as you pick a month. There is no Save button. The change is recorded in the audit log.

Change it if your district's budget year doesn't start in July. Otherwise leave it. This row is the only place it's set: schoolOS doesn't change it for you.

For example, a district whose budget year runs September to August sets Starts in to September. A Chromebook bought in October 2026 then falls in FY27, and This school year on the dashboards runs from September 1.

Vanity URL#

Your district's own web address for schoolOS, like olympia.theschoolos.com. People can use it on every page. app.theschoolos.com keeps working too.

To set one:

1. In Name, type just the name you want, like olympia. Use 3 to 40 lowercase letters, numbers and hyphens. It can't start or end with a hyphen.
2. schoolOS checks the name as you type. A green check means it's free. A red cross means another district has it.
3. Select Save.

If you paste a full address that ends in theschoolos.com, schoolOS keeps just the name. Any other address with a dot in it is refused: your own domain can't be used here. Some names are reserved for schoolOS and can't be used.

Once it's set, Cancel puts back the saved name if you've started editing, and Remove clears it.

What a vanity URL unlocks:

• ClassLink sign-in. The ClassLink button only appears on your vanity URL. See below.
• A public support form. A department can take requests from people who don't sign in, at a page on your vanity URL. See Departments.
• Only your sign-in buttons, in your colors. On your vanity URL, the sign-in page shows your logo, name and primary color from Account branding, with Powered by schoolOS, and only the providers you've left on. app.theschoolos.com doesn't know which district you are until someone types their email, so it shows Google and Microsoft under the email field.
• Guest accounts. People you don't know can continue as a Guest after Google or Microsoft confirms their email, only on your vanity URL (Guest accounts).

Set one if you use ClassLink, want a public support form, or want staff to see only the button that works for them. Pick the short name families and staff already call your district, like olympia, so they can type it from memory.

Your own domain and Check my forward#

Your vanity URL is always on theschoolos.com: schoolOS can't host your district's own domain yet. To give people an address like support.yourdistrict.org, ask whoever runs your domain or website to set up a forward to your vanity URL (or to a page of it). A DNS record (CNAME) pointing at schoolOS doesn't work on its own: browsers show a security warning. Use your own web address has the steps for common providers.

Once you have a vanity URL, Check my forward appears under it. Type your own address and select Check: schoolOS follows it and says whether it reaches your vanity URL and which page it lands on (sign-in, a public support form or the help center), or what's wrong, like a masked forward or a certificate problem. It only reads, and needs Change account settings. See Check your forward for every result.

For example, Olympia's web team forwards support.olympia.org to the Facilities public support form. The admin types support.olympia.org, selects Check, and sees Your forward works, naming the public support form.

Sign-in providers#

The single sign-on buttons your district can use:

• Google. Staff and students sign in with their Google Workspace account. On unless you turn it off. A personal Google account made with a school address can't sign in with it: Google only vouches for the address when the account belongs to your Google Workspace (or is a Gmail account).
• Microsoft. Staff and students sign in with their Microsoft 365 (Entra ID) account. On unless you turn it off. Once you bind it to your district's Microsoft organization, work and school accounts from any other organization can't sign in. See Microsoft organizations.
• ClassLink. Staff and students sign in with their ClassLink LaunchPad account. Off unless you turn it on, and it needs a vanity URL first, because its button only appears on your own address. Until schoolOS has ClassLink set up, its switch can't be turned on and says ClassLink sign-in isn't available yet, and no ClassLink button appears on any sign-in page. If you sync your roster from ClassLink, ClassLink sign-in also waits until schoolOS confirms the ClassLink district you picked (see Import people).

Sign-in starts with the person's email (Sign in to schoolOS). An email at one of your domains goes only to the providers you leave on here: with one on, straight to it; with several, just those buttons. Your people never get a schoolOS password, and can't set or reset one.

Turning a provider off hides its button on your vanity URL's sign-in page, and refuses sign-ins through it on every sign-in page. Turn one off only if your district doesn't use it. That keeps people from trying a button that can never work for them.

Which to leave on:

| Your district | Leave on | Turn off | | --- | --- | --- | | Google Workspace for everyone, Chromebooks for students | Google | Microsoft | | Microsoft 365 for everyone | Microsoft | Google | | Microsoft 365 for staff, Google for students | Google and Microsoft | Nothing | | Staff and students start their day in ClassLink LaunchPad | ClassLink, plus the provider behind it, so people can still sign in if ClassLink is down | The provider you don't use |

Each switch saves as soon as you flip it. Two rules keep your district from locking itself out:

• You can't turn off the provider you signed in with. Its switch is locked, and the card says This is how you're signed in. To turn it off, turn on another provider, sign out, sign in with that one, then come back.
• You can't turn off the last provider that's on. Turn on another one first.

schoolOS support can always sign in to help you, whatever you turn off.

Microsoft organizations#

Anyone can create a Microsoft organization and give one of its accounts any address, including one at your district. Microsoft vouches for that address only on the organization's behalf, so schoolOS needs to know which Microsoft organizations are yours. Under the Microsoft switch, Microsoft organizations lists them:

• Work and school accounts sign in only from these organizations. Someone with a Microsoft account from any other organization is refused, even if its address matches one of your people. They see that the sign-in was denied, and the refusal is in the login log as Microsoft account from an organization not bound to the district.
• Personal Microsoft accounts (Outlook.com, Hotmail and other personal accounts) always sign in, matched by the address Microsoft verified, as before.

The list fills itself from your Microsoft integrations: the organization you connected Microsoft Entra ID or Microsoft Intune to appears with the integration's name beside it. To stop using one of those, disconnect the integration. Organizations you add here say Added here, and you can remove them with the trash button.

While the list is empty, Microsoft sign-in works as it always has: a work or school account from any organization can sign in. The card says Microsoft sign-in isn't bound to your organization yet, and the section's summary says so too. schoolOS records the organization every Microsoft sign-in comes from, so:

• If you've signed in with your district Microsoft account, the card names that organization's ID. Select Bind this organization.
• Otherwise, sign in once with your district Microsoft account, or paste the ID into Add an organization and select Add. Find it in the Microsoft Entra admin center, on the Overview page, next to your organization's name. It looks like 8f14e45f-ceea-467a-9575-0c2c2e2f4b1d.

Each change saves right away, with Undo on the confirmation. Bind every organization your people sign in from: a district whose staff and students are in two Microsoft organizations adds both. If you signed in with a work or school Microsoft account, you can't bind other organizations without it, so you can't lock yourself out.

Someone in more than one district is checked against the district they're signing in to. A district that hasn't bound an organization lets them in as before; one that has bound others isn't offered to them (More than one district).

School IPs#

The public IP addresses of your schools. schoolOS uses them in asset audits: an audit can confirm a device automatically when it last connected from one of these addresses.

1. In Addresses, enter one or more addresses, separated by commas. Each can be a single address (203.0.113.10), a CIDR range (203.0.113.0/24) or a range (203.0.113.1-203.0.113.255).
2. Optionally, add a Label (optional), like "Main Campus". It's applied to everything you add at once.
3. Select Add.

The table lists each saved entry's Address, its Type (single, cidr or range) and its Label. Search it, or select a column's heading to sort by it. To remove an entry, open the … menu at the end of its row, select Remove and confirm.

Only IPv4 addresses are accepted. If any entry in the box isn't valid, nothing is added and the message lists the entries to fix.

Which form to use:

| Form | Choose it when | | --- | --- | | Single (203.0.113.10) | A school's traffic leaves through one public address. The usual case for a small school. | | CIDR (203.0.113.0/24) | Your network team gives you a block in slash notation. Common when the district owns a block of addresses. | | Range (203.0.113.1-203.0.113.40) | You've been given a first and last address that doesn't line up with a CIDR block. |

For example, a district with 12 schools whose internet all leaves through the district office adds that one address with the label "District office". An audit can then confirm any device whose last public address was the district's, whichever school it's at. Ask your network team for your public addresses: audits compare the public address a device last connected from, so the 10.x or 192.168.x addresses devices show on the local network never match.

Add your schools' addresses if you run asset audits and want devices on campus confirmed without scanning each one. Without any, audits confirm devices only by scan or by other rules.