Healthcare Seamless SSO

Healthcare Seamless SSO extends Microsoft Entra seamless SSO (formerly Microsoft Azure Active Directory Seamless SSO) to shared clinical workstations. Using Imprivata Enterprise Access Management desktop tap-and-go capabilities, Imprivata users can single sign-on into enterprise web-based Microsoft Office 365 and Microsoft Azure Marketplace applications.

Imprivata Integrated RunAs is used to launch Microsoft Edge and Google Chrome browsers under the context of the Imprivata user accessing Office 365.

The following describes an example clinical workflow.

 

 

A nurse taps their proximity card to authenticate to a shared workstation that is secured by Imprivata Enterprise Access Management.

  • The Imprivata Integrated RunAs custom shortcut to Office 365 Outlook is on the desktop.

  • The nurse opens the shortcuts to SSO into Outlook.

When the nurse is finished, they tap their proximity card to secure the workstation. All the applications that were in use by the nurse remain running, but are now secured behind the lock screen.

A physician taps their proximity card to authenticate to the shared workstation.

  • All of the nurse’s applications that were launched using Imprivata Integrated RunAs are automatically closed.

  • The physician opens the custom shortcut to access Office 365 Outlook.

When the physician is finished, they tap their proximity card to secure the workstation. All the applications that were in use by the physician remain running, but are now secured behind the lock screen.

In the environment:

  • Microsoft Entra seamless SSO is configured and running normally, independent of Imprivata Enterprise Access Management.

    For additional information on deploying Microsoft Entra seamless SSO, see the Microsoft Entra ID documentation.

  • The Imprivata shared kiosk workstation agent is deployed to the shared clinical workstations.

  • The Imprivata Integrated RunAs custom shortcut for Office 356 is available on the desktop.

NOTE: If you require assistance configuring Microsoft Entra ID for Seamless SSO, contact your Microsoft account representative.

The following table summarizes how Imprivata Enterprise Access Management and the Microsoft technologies in the environment are configured:

Technology Configuration
Office 365

  • Microsoft Entra ID and/or ADFS is functioning as the Identity Provider.
Microsoft Entra ID

  • Microsoft Entra ID is implemented in a hybrid model: "Hybrid Azure AD join".

    • Managed Domains must be configured to use Seamless SSO.

    • Federated Domains must be configured to use ADFS.

  • Microsoft Entra ID must be enabled for Seamless SSO.
Delivery environment

  • Validated on Windows 10 local and remote desktops.

  • The domain in which the Imprivata users are members must have a trust relationship with the endpoints domain.
Imprivata Enterprise Access Management

  • An Imprivata OneSign Single Sign–On license is required.

  • Imprivata appliance running a maintained release of software

  • Imprivata agent running a maintained release of software
Imprivata Integrated RunAs custom shortcut

  • Google Chrome with Windows 10 Account Extension

    Target path example:

    "C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" /profile "C:\Program Files (x86)\Google\Chrome\Application\Chrome.exe" "https://outlook.office.com"