Identity and SSO
Staff identity in EDFlow: Microsoft Entra ID setup, MFA policy per role, the session policy table, SCIM provisioning and deprovisioning, and how patient and family access differs.
Staff accounts
- Invite-only. No self-registration. Invites expire after 72 hours; addresses outside the site's staff domains need a second manager's approval.
- Roles per site. A membership links a person to a site with one or more roles. Privileged roles (manager, privacy, integration) need a second person's approval, and a privacy officer can't hold a manager or clinical role.
Microsoft Entra ID
Optional, per site:
- Register an app in your Entra tenant with the redirect URI your EDFlow contact provides (OIDC authorization code with PKCE).
- Provide the tenant id; the site restricts sign-in to allowed tenants and domains.
- An Entra account is linked to a membership only by accepting an invite or while signed in with password and MFA. Guest accounts are refused.
- The idle-lock unlock and step-up checks force a fresh Microsoft sign-in for the same user.
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
sso.allowedDomains | [] | array | Entra ID sign-in domains. (Reduces privacy) |
sso.allowedTenants | [] | array | Entra ID tenant ids (guests always refused). (Reduces privacy) |
MFA
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
security.mfaRequiredForAll | true | boolean | MFA for every password sign-in (locked on in production, D-13). (Reduces privacy) |
security.mfaRequiredForAdmins | true | boolean | MFA for manager, privacy and integration roles (locked on everywhere). (Locked, Reduces privacy) |
security.staffIdleLockMinutes | 15 | 5–60 minutes | Staff idle lock. (Reduces privacy) |
security.staffSessionHours | 12 | 8–16 hours | Staff absolute session lifetime. (Reduces privacy) |
security.staffEmailDomains | [] | array | Invite domains that need no approval (D-64). (Reduces privacy) |
security.guestNetworkPrefixes | [] | array | Guest-network prefixes named in breaker alerts, never hard-blocked. (Reduces privacy) |
MFA (TOTP) is required for every staff account in production, and for administrators everywhere. Ten recovery codes are shown once and stored only as hashes. Ten wrong codes in 24 hours lock MFA until a manager resets it.
Session policy
| Principal | Policy |
|---|---|
| Patient | Bound to one visit and one device. No idle timeout during the visit; read-only after departure; ends after the grace window. At most 5 concurrent devices and 8 per day; more are refused, never displacing another |
| Family | Bound to one link and one device; at most 3 devices; ends with the link |
| Staff (web) | Idle lock after 15 minutes (5 to 60); 12-hour lifetime (8 to 16); lockout after 5 failed passwords in 15 minutes from unknown devices |
| Staff (companion app) | Hospital-managed phones only; biometric or passcode unlock after 5 minutes in the background; 12 hours; remote sign-out |
| Stations (print, big board) | A device credential registered by a manager; one purpose; revoked instantly |
| Platform operator | MFA mandatory; 8 hours; idle lock 10 minutes; site data only through audited support access |
Provisioning and deprovisioning
- CSV import with row-by-row validation.
- SCIM 2.0 for Entra ID or another IdP: a user disabled in the directory is deactivated within 5 minutes and their sessions end.
- Deactivation revokes every session and every unused credential the user issued, at once.
- A quarterly access review with attestation.
Related
- Sign-in and security for staff
- Users and access
Last updated on