School and university IT checklist for UAE institutions.

Why educational IT has its own demands

Schools and universities carry a profile unlike most commercial organisations. The user population shifts every academic year. Devices are handed to students who are not always careful with them. The network must support teaching, administration and pastoral care simultaneously — and a failure during an exam is not a recoverable situation.

Add PDPL obligations covering student and staff personal data, a diverse device estate ranging from managed tablets to personal laptops, and the reality that most UAE educational institutions are running lean IT teams, and the risk exposure becomes clear. This checklist works through the six areas that matter most.

1. Network infrastructure and wireless coverage

Reliable, segmented wireless is the foundation. A UAE school or university with a flat network — where student devices sit alongside administrative systems — is creating unnecessary exposure. The infrastructure checklist:

• Separate VLANs for staff administration, student learning, IoT devices (CCTV, access control) and guest access
• Managed wireless access points with centralised control — not consumer-grade hardware deployed ad hoc
• Content filtering at the network layer for student internet access
• Network documentation covering switch topology, IP ranges, firewall rules and access point locations — updated when changes are made
• Bandwidth capacity reviewed before academic year start, not during peak load

For institutions with multiple campuses, each site should have its own documented network diagram and a clear escalation path for connectivity failures. See Missan's education IT services for how this applies in a UAE multi-site context.

2. Endpoint and device management

Large device estates require a management platform, not manual configuration. Without it, patch levels drift, licensing becomes untracked, and a compromised student device can move laterally across the network before anyone notices.

• All staff devices enrolled in Microsoft Intune or equivalent MDM — policies enforced, not advisory
• Windows and macOS patching automated and verified monthly
• Student-facing shared devices locked down via group policy or MDM profile
• Hardware asset register maintained — model, serial number, assigned user or location, warranty status
• End-of-life hardware identified and budgeted for replacement; unsupported OS versions are a material risk

3. Cybersecurity controls

Educational institutions are actively targeted. Phishing campaigns aimed at staff payroll, ransomware targeting administrative systems, and credential theft via student portals are all documented attack patterns in the UAE and wider region. The minimum controls:

• Multi-factor authentication enforced on all staff Microsoft 365 accounts — no exceptions for seniority
• Endpoint Detection and Response (EDR) on all staff and admin devices, not legacy antivirus
• Email security — DMARC, DKIM and SPF published correctly; advanced threat filtering enabled in Microsoft 365 Defender
• Conditional Access policies in Microsoft Entra ID controlling what can connect to school systems and from where
• Security awareness training delivered at least once per academic year for all staff — phishing simulations are the most effective format
• Firewall with next-generation inspection, reviewed configuration, and no default credentials remaining

For a fuller picture of current threat exposure, a free IT health check covers endpoint, email, identity and Microsoft 365 security in one structured session.

4. Data protection and PDPL compliance

UAE schools and universities hold significant volumes of personal data: student records, medical information, guardian contact details, HR files and assessment data. The UAE Personal Data Protection Law (PDPL) requires a lawful basis for collection and processing, documented retention schedules, and a process for handling data subject requests and breach notifications.

• Data mapping completed — what personal data is held, where it is stored, who has access
• Retention schedules documented for student, staff and parent data; automated deletion or archival in place
• Student management systems and HR platforms assessed for data residency — UAE or GCC data storage preferred for sensitive records
• Access controls following least-privilege — teaching staff should not have access to HR payroll data
• Breach notification process documented and tested: who decides, who notifies, within what timeframe
• Third-party processors (LMS vendors, cloud platforms, assessment tools) reviewed under data processing agreements

The Missan compliance and windream service helps institutions manage document control and evidence PDPL readiness with auditable records.

5. Backup and business continuity

Exam results, student records, finance systems and HR data represent the operational spine of an educational institution. The question is not whether backups are running — it is whether they have been tested and whether recovery time is acceptable.

• Daily backups with offsite or cloud copy — a backup that sits only on-premises does not protect against fire, flood or ransomware
• Microsoft 365 data backed up separately — Exchange Online, SharePoint and Teams are not immune to accidental deletion or ransomware encryption; Microsoft's native retention is not a substitute for backup
• Restore testing at least twice per year — the backup log saying "success" is not a restore test
• Recovery Time Objective (RTO) and Recovery Point Objective (RPO) defined for critical systems: student management, finance, email
• A documented incident response plan naming who is responsible, what is isolated first, and who communicates externally

See backup, disaster recovery and cloud services for how UAE institutions approach continuity planning.

6. Microsoft 365 governance

Most UAE educational institutions run Microsoft 365 for staff and often students. Without active governance, tenants accumulate ungoverned Teams, abandoned SharePoint sites, over-privileged accounts and unused licences. The governance checklist:

• Global administrator accounts limited to two or three named individuals — not shared, not used for daily work
• Privileged Identity Management (PIM) enabled if the institution holds a plan that supports it
• Guest access policies reviewed — external sharing should be intentional, not default-open
• Licence audit completed annually: inactive accounts identified and removed, plan mix validated against actual usage
• Microsoft Secure Score reviewed quarterly as a management dashboard for identity and configuration risk
• Conditional Access policies covering device compliance, location and sign-in risk

For institutions considering Microsoft Copilot for staff productivity, the Microsoft 365, Copilot and Defender service covers prerequisites and safe deployment.

7. IT support structure

An internal IT administrator alone cannot maintain all of the above. Most UAE schools and universities that run lean internal teams supplement them with a managed IT partner for monitoring, escalation, after-hours cover and specialist security expertise.

The questions to resolve before choosing a support model:

• Is there a documented SLA for response and resolution — not just a promise of "fast support"?
• Is onsite cover available during school hours, or only remote access?
• Who handles cybersecurity monitoring outside business hours?
• What is the escalation path for a major incident during an exam period?
• Are Microsoft 365, backup and endpoint security managed proactively, or only when a fault is reported?

For guidance on evaluating IT partners, the UAE IT partner selection guide covers the criteria and red flags that apply to any sector. The Missan managed IT service is built for organisations that need structured cover, not reactive break-fix.

Using this checklist

Work through each section with your IT lead and note where documentation is missing, where controls are partial, and where testing has not been done recently. The output is a priority list, not a compliance certificate — prioritise the gaps that carry the highest consequence: ransomware readiness, PDPL breach exposure and exam-period continuity.

If a neutral third-party review would help create the evidence, Missan has been working with UAE organisations since 2004. The free IT health check covers the core areas of this checklist in a structured 60-minute session — no obligation, output goes to leadership.

Frequently asked questions