Manage authentication in bulk for Blackbaud ID (BBID)

Platform managers configure authentication and security for all users. To do this in bulk, go to Core, select Security and then Blackbaud ID authentication. A list with three tabs appears. Each tab shows users with their corresponding authentication status for Blackbaud ID and Blackbaud Education Management.

Like other SKY lists, you can select which columns of data to show, reorder columns, select a column header to sort, export the data, search the list, and filter the list. For example, you can filter to show registered users with student role, search for specific grad year, and sort by SSO email address.

Select a user name to go to their profile.

Tip: By default, users who have been manually disabled or disabled automatically due to inactivity are hidden from the list. To see them, clear the Hide disabled filter and then enable the Column for Disabled. List managers can also view them in the users list. Status changes also appear in each user’s login history and on the access tab of the user's profile in Core.

Authentication status

Registered indicates the user has a Blackbaud ID username and has signed into your school's instance of Education Management with it at least one time.

You can Disconnect users who should no longer log in or who need to switch to a new username (email address). When you disconnect users, they become Unregistered, but you connect them with a new email address.

Unregistered indicates the user does not log in at all.

When you choose users from this list and then select Connect, each users' contact email address becomes their Blackbaud ID username, which they'll use to login. They'll setup passwords during their login experience.

Consider selecting to also send email "invitations" with instructions for users to follow as they connect with Blackbaud ID. The email invitations include automatically generated content. The email addresses used as recipients are the same contact email addresses used as the Blackbaud ID usernames. Each invitation is valid for 30 days. If a user's invitation expires, consider reinviting them.

Awaiting response indicates the user has a Blackbaud ID username, but hasn't yet used to to sign into your school's instance of Education management. The user will be required to sign in with Blackbaud ID the next time they log in.

You may want to remind these users to log in soon; consider sending an other email with instructions for users to connect with Blackbaud ID. Do this, select to "reinvite" the users. Each invitation is valid for 30 days. If a user's invitation expires, consider reinviting them.

If you reinvite a user whose contact email address has recently changed, the email address initially invited to connect to Blackbaud ID is used for the username and as the email recipient.

To change the email address used for Blackbaud ID, Disconnect the user first (which makes the user "unregistered"), and then Connect the user with a new email address.

By default, users who have been manually disabled or disabled automatically due to inactivity are hidden from the list. To view them, clear the Hide disabled filter and then enable the Column for Disabled. Select the column header to sort the list. List managers can also view them in the users list.

Take action in bulk

Select multiple users to take action in bulk. A count and possible actions appears at the bottom of the list. The actions available varies based on authentication status.

By default, 100 records appear on each page of the list. Select Items per page to increase this to 250 or 500. To select all items on the page, Select all. To cancel, select Clear all.

Select the action and confirm the change.

Use Connect to associate an Unregistered user's account in your school's instance of Education management to a Blackbaud ID. The user's contact email address will become their username for Blackbaud ID.

Some users may have permission to later change their email address/username (such as parents or alums) . Other user won't be able to change their username/contact email. This is based on your school settings for single sign on (SSO), active directory, etc. When a user's contact email is on an email domain your school has claimed and configured, this information appears in the SSO column.

When you connect user accounts, you'll also select whether to send the user an email invitation. A link in the email invitation enables users to login and register their Blackbaud ID account.

Each invitation is valid for 30 days. If a user's invitation expires, consider reconnecting them.

Remember that the email address used forBlackbaud ID must be unique. It can’t be used by other users. Typically, the primary email address from a user's contact card will become the user's Blackbaud ID username. However, you can use a different email address for authentication when desired.

Tip: Platform managers can invite up to 2,500 users at one time. To invite more, send invites in batches of 2,500 or fewer.

Note: As an alternative, to connect a single user, go to the access tab of the user's profile. (Select their name or use thePeople finder .) From the individual’s access options, you can send the user an email with an invitation to create their Blackbaud ID account using their email address as the username. If a user account was previously automatically disable, they might contact your school and ask a platform manager to re-enable them. From the access tab of the user's profile, change Disabled account to No.

If a connected user (of any authentication status) needs to change their username to a different email address, Disconnect them. Then update their contact email (primary email address).

You'll likely Disconnect in bulk when senior students graduate and become alums.

  1. Ensure your school has correct and current email addresses to contact students after they graduate. These email addresses will be used to login as alums.

  2. Filter the list of Registered users so that it shows the current grad year, roles of alum or student, and individuals whose contact email address matches your school domain for SSO. Disconnect the users.

  3. Review the contact email addresses of the disconnected grads to ensure that they use personal email addresses instead of school email address. You may need to update the contact email addresses for the grads that you disconnected to use personal email addresses.

  4. Filter the list of Unregistered users so it shows the recent graduates. Select the individuals who need to use a new email address for their login and then select Connect.

  5. The next time a graduate attempts to login using their old username, the user is prompted to create a new Blackbaud ID with their new email address. The user authenticates and links it to their school account for ongoing access as an graduate or alum.

Alternatively, to reconnect an individual, go to the access tab of the user's profile.

When you Connect a user and choose to send an email invitation, the link in the email message is only valid for 30 days. To encourage users to login and register after 30, Reconnect the users who are still Awaiting response.

You can also Reconnect users who were previously Disabled. To view disabled accounts, remember to clear the Filter for Hide disabled.

Alternatively, to reconnect an individual, go to the access tab of the user's profile.

To Enable accounts in bulk, select them from the list of Unregistered users. A message appears to summarize the accounts included in the bulk action. Confirm the change. If an account can't be enabled in bulk, the reason appears in the Warning column.

Alternatively, to enable an individual, go to the access tab of the user's profile.

Enabling user accounts doesn't affect their Blackbaud ID. It only affects their access to your school's instance of Education management.

Consider disabling the accounts of users who withdrew as students or who are no longer employed as faculty. Disable an account to prevent them from logging in.

When an account is disabled, the reason appears in the Warning column for Unregistered users. Alternatively, list managers can use the Disabled column filter on the user list to review which accounts have been disabled, locked, or inactivated.

An admin can manually disable accounts. Accounts can also be automatically locked (such as due to too many failed login attempts) or inactive (due to no activity for 395+ days) and thus disabled for security reasons. These users continue to receive PushPages (Newsletters), emails, and notifications that they’ve opted into, even though they no longer login. See also lock and unlock individual accounts.

Disabling user accounts doesn't affect their Blackbaud ID. It only affects their access to your school's instance of Education management. A disabled account may still be able to use the same Blackbaud ID to access other Blackbaud solutions. For example, a disabled account may retain access to another school's instance of Education management (such as parents with students enrolled at multiple schools) or to your school's instead of another Blackbaud solution (such as Raiser Edge NXT).

Warning: If you run a User management type of Data import job to assign Blackbaud ID usernames, the next login experience for those users will be affected.

Tip: Some authentication settings are not accessible while impersonating. To set up authentication for your school, log in as the platform manager who has organization admin rights instead of impersonating one.