Single Sign On for the Admin Console

Create the Imprivata Directory and Initial Admin

To configure Imprivata Directory:

1. Open the Imprivata Access Management setup.

2. Agree to the Cloud Features Agreement and enter information about your organization.

3. Skip to the Imprivata Identity Provider Connect screen.

4. Enter a domain for the Imprivata Directory.

   NOTE:

   The domain name must be unique and cannot be reused across multiple tenants.

5. Enter a username and password for the initial administrator, and note the complete Imprivata username, which includes the Imprivata Directory domain

   You require the complete username to log in to the Imprivata Access Management console.

6. Skip to the You're ready to go screen, and click the link to log in to the Imprivata Access Management console.

Add Administrators to Imprivata Directory

Use the initial admin to add more administrative users.

To add admins:

1. Log in to the Imprivata Access Management portal (access.imprivata.com).

2. Click the gear icon > Users > Imprivata Identity users.

All users are listed on the Imprivata Identity users page. From this page, you can:

• Add a single user.

• Bulk import multiple users.

You can configure Microsoft Entra ID as an IdP to authenticate users to the Imprivata Access Management portal. You require access to the following to complete the configuration:

• The Imprivata Cloud Tenant Setup.

• The Microsoft Entra Admin center.

Save the Imprivata Service Provider Metadata

Use the Imprivata Access Management setup to create the Imprivata SP metadata file. You require this file when configuring the Entra ID enterprise application.

To create the metadata file:

1. Open the Imprivata Access Management setup.

2. Agree to the Cloud Features Agreement.

3. On the Tell us about your organization page, add your organization's user-facing name, (optional) logo, and business email address and click Continue.

   NOTE:

   For non-production and production environments:

   • The user-facing organization name can be different. This should be a user-friendly name.

     Imprivata recommends appending "test" or "non-prod" to the name for your non-production environment so you can easily identify it.

   • The logos can be different. Imprivata recommends that you create a distinctive logo for your non-production and production environments, so that you can easily identify which environment you are using.

   • The business email address must use the same domain in the non-production and production environments, but the email address itself can be different.

4. On the next page, click Continue to confirm your organization's details.

5. Skip to the Identity Provider Connect screen.

6. Type a name in the Name this identity provider box. Imprivata recommends that this name be the same as the Microsoft Entra SAML Toolkit you will configure in a later step in Microsoft Entra ID.

7. Copy the Imprivata SP metadata URL, paste it into a new browser tab, and save the page as an XML file.

Do not close the setup. You finish configuring the connection here after you configure the enterprise application.

Configure the Entra ID App

An Entra ID enterprise application is required to allow SAML-based SSO to the Imprivata Access Management console.

To configure the enterprise application:

8. In the Microsoft Entra admin center:

   1. Create an Enterprise application for your non-production tenant:

      1. Select Microsoft Entra ID > Manage > Enterprise applications, click New Application,  and search for Microsoft Entra SAML Toolkit. Select Microsoft Entra SAML Toolkit.

      2. Enter a display name for your new application, then click Create.

   2. Go to Overview> Getting Started >Assign users and groups and click Add user/groups.

      1. Add the groups that identify users with administrative access to the Imprivata Access Management portal.

         These users will have access to the Imprivata Access Management portal so they can update your organization's details, logo, and other settings related to the Imprivata Cloud.

         NOTE:

         This group can be the same as the Admin group you define for Patient Access administrators, or a separate group, if required.

      2. Add the groups that will have Admin, Manager, and View Only access to the Patient Access Admin Console.

         These users will have access to the Patient Access Admin Console.

   3. Go to Overview> Getting Started >Set up single sign-on.

   4. Select SAML as the single sign-on method.

   5. Click Upload metadata file and upload the Imprivata SP metadata XML file you created earlier.

   6. For Basic SAML Configuration, provide the Sign on URLhttps://access.imprivata.com.

      1. Click Save and close the Basic SAML Configuration applet.

Copy and Save Entra App Values

Using the Microsoft Entra Admin center, copy and save the following Entra app values. You use the following values to finish the configuration in the Imprivata Access Management setup:

• The URL endpoint of federation metadata.

• The SAML name/value pair that identifies users with administrative access.

To locate the required values:

1. In the Entra app, go to SAML certificates, and copy the App Federation Metadata URL.

2. In the Microsoft Entra admin center, copy the claim name for groups from Entra ID:

   1. Click Attributes & Claims > Edit.

   2. Click Add a group claim if there isn’t one already. Click Save.

      • Select All groups for the Which groups associated with the user should be returned in the claim?

      BEST PRACTICE:

      Use Group ID as the source attribute.

      Copy the claim name for groups from Entra ID and save for use in a later step.

      Example

      http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.

3. Go to Manage > Groups > Search, and search for a group that should have administrator access to the Imprivata Access Management portal.

   Copy the Object ID for that group and save for use in the next step.

Use the Entra App Values to Finish the Configuration

Using the Imprivata Access Management setup, finish configuring Entra ID as an IdP using the Entra app values saved previously.

To finish the configuration:

1. Open the Imprivata Access Management setup, and go to the Identity Provider Connect screen.

2. Enter the SAML IdP metadata URL of the Entra app, and click Continue.

3. Paste the administrator group's claim name into SAML attribute name.

4. Paste the administrator group's Object ID into SAML attribute value, and click Continue.

5. Click Go to Access URL: access.imprivata.com to test the authentication workflow to access the Imprivata Access Management portal.

   NOTE:

   Specifying a metadata URL allows for easier maintenance. The system automatically polls the URL at regular intervals.

   This ensures that your IdP configuration stays up to date with the latest metadata, such as certificate changes.

   If you upload a metadata file instead, the system does not update it automatically. From the Imprivata Access Management portal, you must edit the configuration to replace the file manually or switch to a URL.

The following are generic steps to configure any external third-party IdP to authenticate users to the Imprivata Access Management portal. For example, these steps apply to Ping Identity and Okta.

To configure your IdP:

1. Open the Imprivata Cloud Tenant Setup wizard.

2. If you have not already, agree to the Cloud Features Agreement and enter information about your organization.

3. Go to the Identity Provider Connect screen.

4. Copy the Imprivata SP metadata URL and provide it to your IdP. When configuring the IdP's application:

   • Specify https://access.imprivata.com for the single sign-on URL.

   • Recommended: configure email address as the NameID format for user identity.

   • Recommended: configure Group ID (rather than group name) as the source attribute for group claims.

5. Enter the SAML IdP metadata URL, and click Continue.

6. Enter the SAML name/value pair that identifies users with administrative access, and click Continue.

7. Click Go to Access URL: access.imprivata.com to test the authentication workflow to access Imprivata Access Management.