Identity and SSO
Staff identity in EDFlow: Microsoft Entra ID setup, MFA policy per role, the session policy table, SCIM provisioning and deprovisioning, and how patient and family access differs.
Staff accounts
- Invite-only. No self-registration. Invites expire after 72 hours; addresses outside the site's staff domains need a second manager's approval.
- Roles per site. A membership links a person to a site with one or more roles. Privileged roles (manager, privacy, integration) need a second person's approval, and a privacy officer can't hold a manager or clinical role.
Microsoft Entra ID
Optional, per site:
- Register an app in your Entra tenant with the redirect URI your EDFlow contact provides (OIDC authorization code with PKCE).
- Provide the tenant id; the site restricts sign-in to allowed tenants and domains.
- An Entra account is linked to a membership only by accepting an invite or while signed in with password and MFA. Guest accounts are refused.
- The idle-lock unlock and step-up checks force a fresh Microsoft sign-in for the same user.
| Paramètre | Par défaut | Valeurs permises | Effet |
|---|---|---|---|
sso.allowedDomains | [] | array | Entra ID sign-in domains. (Réduit la confidentialité) |
sso.allowedTenants | [] | array | Entra ID tenant ids (guests always refused). (Réduit la confidentialité) |
MFA
| Paramètre | Par défaut | Valeurs permises | Effet |
|---|---|---|---|
security.mfaRequiredForAll | true | boolean | MFA for every password sign-in (locked on in production, D-13). (Réduit la confidentialité) |
security.mfaRequiredForAdmins | true | boolean | MFA for manager, privacy and integration roles (locked on everywhere). (Verrouillé, Réduit la confidentialité) |
security.staffIdleLockMinutes | 15 | 5–60 minutes | Staff idle lock. (Réduit la confidentialité) |
security.staffSessionHours | 12 | 8–16 hours | Staff absolute session lifetime. (Réduit la confidentialité) |
security.staffEmailDomains | [] | array | Invite domains that need no approval (D-64). (Réduit la confidentialité) |
security.guestNetworkPrefixes | [] | array | Guest-network prefixes named in breaker alerts, never hard-blocked. (Réduit la confidentialité) |
MFA (TOTP) is required for every staff account in production, and for administrators everywhere. Ten recovery codes are shown once and stored only as hashes. Ten wrong codes in 24 hours lock MFA until a manager resets it.
Session policy
| Principal | Policy |
|---|---|
| Patient | Bound to one visit and one device. No idle timeout during the visit; read-only after departure; ends after the grace window. At most 5 concurrent devices and 8 per day; more are refused, never displacing another |
| Family | Bound to one link and one device; at most 3 devices; ends with the link |
| Staff (web) | Idle lock after 15 minutes (5 to 60); 12-hour lifetime (8 to 16); lockout after 5 failed passwords in 15 minutes from unknown devices |
| Staff (companion app) | Hospital-managed phones only; biometric or passcode unlock after 5 minutes in the background; 12 hours; remote sign-out |
| Stations (print, big board) | A device credential registered by a manager; one purpose; revoked instantly |
| Platform operator | MFA mandatory; 8 hours; idle lock 10 minutes; site data only through audited support access |
Provisioning and deprovisioning
- CSV import with row-by-row validation.
- SCIM 2.0 for Entra ID or another IdP: a user disabled in the directory is deactivated within 5 minutes and their sessions end.
- Deactivation revokes every session and every unused credential the user issued, at once.
- A quarterly access review with attestation.
Related
- Sign-in and security for staff
- Users and access
Dernière mise à jour le
Cette page vous a-t-elle été utile?
Accessibility
EDFlow accessibility conformance for hospital reviewers: WCAG 2.2 AA on every surface, how it is tested (axe in CI, keyboard, screen readers, Dynamic Type and font scale), the conformance report, and known issues.
Network requirements
Hosts and ports to allow for EDFlow: web, the realtime WebSocket, push notifications, integration-engine egress to the API, the waiting-room display kiosk, and guest Wi-Fi guidance for patients.