RMM for schools and multi-academy trusts in the UK: what to look for

Schools break most of the assumptions RMM tools are built on: one user per machine, patching any weeknight, and a budget that grows with headcount. Good RMM for schools handles shared and trolley devices, patches on the school calendar rather than the vendor's, supports the DfE's device, backup and cyber security standards, and is priced by fleet so a trust is not paying for every technician it employs. Here is what each of those means in practice, whether you run IT inside a trust or serve schools as an MSP.

Shared devices are the normal case, not the exception

A corporate laptop has an owner. A Year 8 laptop trolley has thirty owners a week and none of them care what happens to it. That changes what you need from monitoring.

• Group by location and purpose, not by user. You want policies for "Science block trolley", "ICT suite 2" and "staff laptops", because the user field on a shared device tells you almost nothing. Skip this and every alert reads like a mystery.
• Expect devices to go dark. Trolley machines sit unplugged for days. An RMM that treats every offline device as an incident will bury the real ones. Look for offline thresholds you can set per group.
• Reset and clean-up on a schedule. Temporary profiles, cached downloads and stray apps build up fast on shared machines. Scripted clean-ups that run when the device is next online, not at a fixed minute, matter more than a pretty dashboard.

Portable devices bring a specific duty. Under the Wavenet summary of the DfE Laptop, Desktop and Tablet Standards, mobile and portable devices should have mobile device management so they can be locked or wiped and their apps and software secured. Some RMM tools cover this; many rely on Intune or a separate MDM. Find out which, before a lost iPad makes the question urgent.

Patching around term time

The conventional advice is to patch everything as soon as it is released. In a school that advice is wrong at the worst possible moments: mock exams, assessment windows and the first morning of term, when a fleet of machines that slept through the holiday all try to install a month of updates at once.

What you want instead:

1. Calendar-aware maintenance windows. The ability to block patching during exam weeks and push heavier updates into half-terms and holidays.
2. Rings. Patch IT and staff devices first, a pilot group of classroom machines next, then the rest. A bad update should embarrass one department, not the whole school.
3. A holiday catch-up plan. Wake-on-LAN or a scheduled wake before the holiday ends, so machines update while nobody needs them.
4. Third-party patching. Browsers, PDF readers and plug-ins are where classroom risk often sits. Windows-only patching leaves that gap open.

Safeguarding and the DfE standards: what an RMM can and cannot do

The DfE sets twelve digital and technology standards, six of them core: broadband, wireless, switching, digital leadership and governance, filtering and monitoring, and cyber security. According to Systech IT Solutions, schools are expected to be working towards those six by 2030, with filtering and monitoring already met.

Be precise about where an RMM fits. As Tel Group sets out, the filtering and monitoring standards require assigned roles and responsibilities, an annual review, filtering that blocks harmful content without unreasonably affecting teaching, and monitoring that meets safeguarding needs. An RMM is not your web filter and not your safeguarding monitoring product. What it can do is prove those tools are present and working: that the filtering agent is installed and running on every device, that nobody has quietly removed it, and that exceptions are reported.

The goalposts moved this year. dataprotection.education notes that the DfE updated its Filtering and Monitoring Core Standard on 10 June 2026 to address generative AI tools, and that its data protection guidance now requires a DPIA before introducing or significantly changing a filtering or monitoring system. Changing RMM can count as a significant change if the RMM is what deploys or checks those agents, so involve your DPO early.

Backups and cyber security

The DfE points schools to a 3-2-1 approach, as Remedian summarises: three copies of important data, on two separate devices, one offsite. An RMM rarely holds the backups, but it should tell you every morning which jobs failed. A backup nobody checks is a hope wearing a schedule's clothes. Add vulnerability reporting and Microsoft 365 checks, including MFA coverage for staff accounts, and you have evidence for the cyber security standard rather than a feeling.

Pricing models: which one suits a school or trust

School budgets are fixed a year ahead, so predictability beats a clever headline rate. The published numbers vary widely.

Those NinjaOne figures come from Flamingo and the SuperOps and Level figures from SpotSaaS. Per-technician pricing sounds attractive to a small team, but SyncroSecure works out that below roughly 86 endpoints per technician, per-device pricing is cheaper against NinjaOne's lowest published rate. A trust IT team supporting thousands of devices clears that easily; a primary with a part-time technician and an apprentice might not.

The more useful question for a trust is how cost behaves as schools join. Per-technician pricing punishes you for hiring a site technician at each academy. Per-device pricing scales with the estate, which is what you can actually forecast. Do the sum yourself: devices across the trust, divided into total cost, gives you a cost per endpoint to compare like for like. Then check the contract length, because a three-year term signed for six schools looks different when the trust has eleven.

Where this fits with Helios

Most of this article is policy and discipline, and no tool replaces a DSL, a DPIA or a filtering product. Helios covers the parts an RMM should: monitoring, Windows and third-party patching, Microsoft 365 and Defender monitoring, vulnerability management, backup monitoring, remote access and a helpdesk with SLA clocks, plus daily UK Cyber Essentials readiness checks. Its built-in AI technician, Helio, investigates alerts and triages tickets within plain-English rules your technicians set. Pricing is by fleet size with every feature on every plan and no charge per technician, from £15 a month; the pricing page shows how the per-device rate applies to a trust of your size.

Common questions about RMM for schools

Does an RMM count as filtering and monitoring for KCSIE?

No. An RMM manages and monitors devices, while DfE filtering and monitoring means a dedicated web filter and safeguarding monitoring that flags concerning activity to the right staff. An RMM supports compliance by confirming those tools are installed, running and not tampered with on every device, which is useful evidence for the annual review.

Should each academy in a trust have its own RMM?

Usually not. A single RMM across a multi-academy trust gives consistent patching policies, one view of security posture and simpler reporting to trustees. Each academy can still be a separate site or group with its own maintenance windows, so a school with different exam dates is not forced onto another school's calendar.

Can an MSP serving schools use the same RMM as for business clients?

Yes, provided the RMM lets the MSP set school-specific policies: term-time patch blocks, shared-device groups and offline thresholds suited to trolleys. The MSP should also confirm it can evidence filtering agent coverage and backup status for each school, because school leaders increasingly need that evidence for DfE standards reviews.

Researched and written with Helio SEO, our AI writer for business blogs.