Help center › Set up
People from PowerSchool
Districts that run PowerSchool SIS can bring their people in from it, with what the student information system knows about them. On Admin › Import, the card People from PowerSchool reads your schools, your staff and your students, and keeps each person in Beacon current with their school, grade level, student number, homeroom and the current term's classes: the course, period, room and teacher of each, and for a teacher the classes they teach. Technicians see a student's grade, homeroom and schedule on every ticket the student files. It reads through a plugin you install in your own PowerSchool, refreshed each night once you switch the nightly sync on. Beacon only ever reads; nothing is written back to PowerSchool. If your Import page has no such card, People from PowerSchool is not switched on for your organization yet; people can still come in from a spreadsheet exported from PowerSchool (see Importing).
It works alongside People from Google Workspace or Microsoft Entra: your directory decides who can sign in, PowerSchool adds the school record. A district can also use PowerSchool alone.
Before you start
- A plan with rostering sync. People from PowerSchool is part of rostering sync, on the District and Enterprise plans and the 90-day District pilot (Billing and plans).
- A PowerSchool district administrator. Installing a plugin takes access to System › System Settings › Plugin Management Configuration.
- PowerSchool on the internet over https. A district on PowerSchool's own hosting (yourdistrict.powerschool.com) is. A server your district hosts must answer at a public address with a certificate from a public certificate authority, as it does for parents and students at home.
Install Beacon's plugin
- On the card, click Download the plugin. It is a small ZIP holding one file,
plugin.xml, the same for every district. It turns on API access for Beacon and asks for read-only access to the fields listed below, and nothing else. On PowerSchool older than 25.2, use the link For PowerSchool before 25.2 beside the button instead. - In PowerSchool, open System › System Settings › Plugin Management Configuration, click Install, choose the file and install it.
- Tick Enable beside Beacon Help Desk. PowerSchool lists the fields the plugin asks for; accept them.
- Click Beacon Help Desk, then Data Provider Configuration. Copy the Client ID and the Client Secret. On PowerSchool 25.2 and later this page also has Access Level for v1 APIs: set it to Read.
When Beacon adds a field it reads, the card's download gives the new version. Installing it over the old one keeps the same client ID and secret; PowerSchool asks you to accept the added fields.
Connect
On the card, enter your PowerSchool address (the one your staff sign in at, such as https://yourdistrict.powerschool.com; anything after the address is ignored), the Client ID and the Client secret, and click Connect PowerSchool. Beacon asks your PowerSchool for access with them and reads how many schools it has before saving anything: if PowerSchool refuses, the reason appears under the form and nothing is kept. Once PowerSchool accepts, the secret is stored encrypted and never shown again, to anyone. The card names the address and the client ID's last four characters, so you can tell which credentials are saved. Update credentials takes a new secret or a new address the same way.
Preview first, then sync
Nobody changes until you have looked. Connecting runs a preview on its own, and Preview runs one any time: it reads PowerSchool, counts what a sync would do (staff and students in PowerSchool, how many would be added or changed, how many are not in Beacon, how many have no email address, the classes and enrollments) and changes nothing. It also lists your schools with the site each one lands at. Once a preview has finished, Sync people now runs the real pass, and Sync nightly keeps it current.
The settings
- Staff: Add and update (to start), Update only or Leave out. Add and update adds the staff PowerSchool has that Beacon does not, as requesters, and keeps everyone current. Update only gives the staff already in Beacon their school record and adds nobody.
- Students: Update only (to start), Add and update or Leave out. Update only gives every student already in Beacon (from your directory, an import or their own first sign-in) their school, grade level, student number, homeroom and classes, and adds nobody. Add and update also adds every student PowerSchool has an email address for, as requesters; the card asks before it switches to that.
- Student addresses. The address PowerSchool holds for a student always wins. Many districts keep student addresses only in Google or Microsoft: if yours are named after the student number or the student web ID (such as 123456@students.yourdistrict.org), choose which, enter the domain, and Beacon builds the address of every student PowerSchool holds none for. The preview's counts show at once whether the rule matches your students.
- Read classes (on to start): the current term's classes on each person's record. Off, a pass reads people only.
- Schools and sites. Each person lands at the site of their school: a student's enrollment school, a staff member's home school. A school spelled like a site's name or code needs no choice; for the rest, pick the site under the school and click Save sites.
- Sync nightly: every night after 02:00 in your organization's time zone; if no sync has run since the last 02:00, one starts within the hour of switching it on. It can be switched on once a preview has finished.
What is read
| In PowerSchool | In Beacon |
|---|---|
| Schools: name, school number, abbreviation, grades | The site each school's people land at, and the school on their record. |
| Staff active at a school: name, work email, teacher number, title, home school, staff type at each school | The person, matched by email address. A new person is added as a requester. Their title fills an empty one in Beacon. The teacher number, staff type and school are on their record, and an ID card that carries the teacher number finds them. |
| Students active or pre-registered: name, email, student number, student web ID, school, grade level, home room | The person, matched by email address. Grade level, student number, school and home room are on their record. Scanning or typing a student number in Beacon finds the student. Graduated, transferred and withdrawn students are never read. |
| The current term: courses, sections (period, room, lead teacher) and who is enrolled | A student's classes with each one's period, room and teacher, the teacher linked to their Beacon account when they are in Beacon; a teacher's classes with how many students are in each. |
The plugin asks PowerSchool for these fields only, view-only: no demographics, contacts or guardians, health, fees, grades or attendance. A few of them (room numbers, staff titles and home schools, school abbreviations) come from tables some PowerSchool servers do not open to plugins; when yours does not, the card says what was left out and the rest syncs as usual.
What technicians see
- On a ticket, under Requester: a student's grade, school and student number, their homeroom, and their classes, period by period with room and teacher, so a technician knows where to find the student and their device. For a teacher, the classes they teach.
- In Admin › Users: a student's grade under their name, filters for PowerSchool students or staff and for a grade, and the whole school record when you open the person.
- Scan: a student number or teacher number from an ID card finds the person.
School records are shown to technicians and administrators only. Requesters, students and teachers included, never see anyone's record, their own included.
Your edits survive
Beacon follows PowerSchool only where PowerSchool's own value changed since the previous pass, or where the field in Beacon was empty. A title you typed and a site you set stay while PowerSchool repeats itself.
- Names. A person PowerSchool adds gets PowerSchool's name. A person already in Beacon keeps the name they have, so a preferred name from your directory or set by an admin is never replaced by a legal name. A name PowerSchool gave changes only when it changes in PowerSchool.
- Roles and sign-in. PowerSchool never grants or changes a role, and never disables or enables anyone. Who can sign in is decided by your directory and your admins.
People PowerSchool no longer lists
When a student graduates, transfers or withdraws, or a staff member is no longer active at any school, PowerSchool stops listing them. Their account in Beacon is left as it is. Their school record is marked No longer listed in PowerSchool with the date, keeps the school and grade it last had, and drops its classes; the grade filter still finds them, and the record shows it is no longer current. If they come back, the next pass makes the record current again.
A pass that finds more than a quarter of the people it follows missing at once (and more than 50) marks nobody, and the card says how many: that is more likely a change in what PowerSchool shares with the plugin than a wave of departures. Check that the plugin is enabled with all its fields; the next pass marks them if they are still missing and fewer.
What Beacon never does
- It never writes to PowerSchool. The plugin asks for view-only access, and Beacon only reads.
- It never deletes a person in Beacon, never merges two people, and never changes anyone's role or whether they can sign in.
- It never shows the client secret again once saved, to anyone, and never writes it to the audit log.
- It never reads guardians, contacts, demographics, grades, attendance, health or fees.
When it runs, and what the card shows
Preview and Sync people now run when you press them; the nightly pass runs after 02:00 in your time zone once the switch is on. The card shows the latest pass with its counts, each shown when it is not zero: in PowerSchool (staff, students), added, updated, not in Beacon, without an email address, no longer listed, classes, skipped, errors. If PowerSchool refuses Beacon's credentials, the card shows Needs attention with the reason and the nightly pass pauses until you save them again. A temporary answer from PowerSchool only fails that pass, and the next one tries again.
Troubleshooting
| The card says | What to do |
|---|---|
| PowerSchool refused the client ID and secret. Check that Beacon's plugin is installed and enabled in PowerSchool (System › System Settings › Plugin Management Configuration), copy the client ID and secret from its Data Provider Configuration page again, and save them. | Make sure Beacon Help Desk is ticked Enable, copy both values again (a stray space or a missing character is the usual cause), and save them with Update credentials. |
| PowerSchool accepted the credentials but gives Beacon's plugin no access to its API. In PowerSchool, open Beacon's plugin › Data Provider Configuration and set Access Level for v1 APIs to Read (PowerSchool 25.2 and later), or install the current plugin from the card in Beacon. | Set Access Level for v1 APIs to Read on the plugin's Data Provider Configuration page, or install the plugin from the card again, then run Preview. |
| PowerSchool did not let Beacon's plugin read something. Install the current plugin from the card in Beacon (it replaces the old one), make sure it is enabled, and accept the data access it asks for. | The plugin installed is older than the one the sync needs, or some of its fields were not accepted. Download the plugin from the card, install it over the old one, accept the fields, then run Preview. |
| That address did not answer as a PowerSchool server does. | Enter the address your staff sign in to PowerSchool at. A sign-in page in front of PowerSchool (a district portal) answers instead of PowerSchool; use PowerSchool's own address. |
| That address is not on the public internet. That PowerSchool address points at a private or internal network address, which Beacon does not reach. | Beacon reaches PowerSchool over the internet. Enter the public address your PowerSchool answers at from outside the district's network. |
| PowerSchool's certificate could not be verified, so Beacon sent nothing. | Your PowerSchool server needs a certificate from a public certificate authority, as browsers at home expect. |
| PowerSchool listed N of the M records it counts in a list; the sync stopped so nobody is left out. | PowerSchool's list changed while Beacon read it. Nothing to do; the next pass reads it again. |
| PowerSchool limited the request rate, was unavailable, had an internal error, or did not answer in time; the sync will run again at the next pass. | Nothing. The next nightly pass tries again; Preview later works too. |
| Beacon could not read the saved PowerSchool secret (the server's encryption key changed). Save the credentials again on the card. | Copy the client secret from the plugin's Data Provider Configuration page and save it with Update credentials. |
| Your district has tried to connect PowerSchool 10 times in 15 minutes. | Each try asks your PowerSchool for access, so Beacon allows 10 in 15 minutes per district. Check the address and copy both values again, then try once more after the wait. |
| Run a preview first: it shows what the sync would do without changing anyone. | Click Preview, wait for it to finish, then sync. New credentials need their own preview. |
| People from PowerSchool is part of rostering sync, which is not included in your plan. | Rostering sync is part of the District and Enterprise plans and the 90-day District pilot (Billing and plans). A connection made before a change of plan stays, with its people; Preview, Sync people now and the nightly pass wait until the plan includes it again. |
Disconnecting
Disconnect on the card deletes the saved client secret, and the nightly pass stops. The people already synced, and their school records, stay as they are. To revoke the access itself, untick Enable beside Beacon Help Desk in PowerSchool's Plugin Management Configuration, or delete the plugin there. Connecting again later picks up the same people.