Currently, user photos are only available via a web link https://myurl/photo/studentidentifier.jpg. This means that all student photos need to be available over the internet which in the UK is a Data Breach. There needs to be a way that only the student in question or an authorised staff member can see the photo. It is not possible to use 3rd party software like Azure to do this as the cross-site scripting protection gets in the way.