Build a Secure Authentication Strategy

Authentication is the first security boundary in your PAS server. Every internal user, administrator, vendor representative, and application workflow depends on authentication to verify identity before granting access.

A secure authentication strategy reduces the risk of:

  • Unauthorized access

  • Credential theft

  • Password reuse attacks

  • Account compromise

  • Privilege escalation

  • Lateral movement between systems

This guide contains recommendations and implementation models to help System Administrators design a secure authentication strategy.

The goal of this guide is to improve security through:

  • Strong authentication requirements

  • Multi-factor authentication (MFA)

  • Time-based One-Time Passwords (TOTP)

  • Facial biometric authentication

  • Identity Provider (IdP) integrations

  • Risk-based authentication controls

  • Administrative account protection

NOTE:

Some methods may require you to have dedicated hardware, such as:
  • Mobile device
  • Photo and video camera
  • Fingerprint scan
  • Proximity card and reader

This document is intended for System Administrators responsible for configuring and maintaining secure authentication controls.

Authentication requirements vary between organizations. Some deployments rely exclusively on PAS authentication, while others integrate PAS with external Identity Providers (IdP) such as Microsoft Entra ID, Active Directory Federation Services (ADFS), Okta, or other SAML-compliant providers.

PAS supports multiple authentication controls, including:

  • Password authentication

  • Email verification

  • Mobile Authentication (TOTP)

  • Multi-Factor Authentication (MFA)

  • Physical device authentication

  • Authorized network restrictions

  • SAML-based Single Sign-On (SSO)

  • Facial Authentication (Requires additional licensing)

  • Imprivata Identity Threat Detection and Response Risk-Based Authentication (RBA) (Requires additional licensing)

Not every deployment requires all authentication methods. However, stronger authentication requirements generally increase protection against account compromise.

IMPORTANT:

Authentication controls should be implemented in layers. Do not rely on passwords alone to secure privileged access.

Understanding Authentication Layers

The following authentication layers provide increasing levels of security:

Passwords provide the minimum authentication requirement for accessing VPAM.

This layer should always include:

  • Strong password requirements

  • Account lockout policies

  • Inactive account management

  • Password expiration policies aligned with organizational standards

Multi-Factor Authentication requires users to provide a second authentication factor beyond a password.

Examples include:

  • Mobile Authentication (TOTP)

  • Physical authentication devices

  • Facial Authentication

Organizations that maintain centralized identity platforms should integrate VPAM with an Identity Provider using SAML authentication.

This enables:

  • Centralized authentication management

  • Consistent MFA policies

  • User lifecycle management

  • Single Sign-On (SSO)

Risk-Based Authentication introduces adaptive security controls.

Instead of requiring additional authentication for every login, risk-based systems evaluate login context and require additional authentication only when suspicious behavior is detected.

NOTE:
Risk-Based Authentication requires additional licensing.

Where to Begin

To review authentication settings in VPAM:

  1. Navigate to System Administration.

  2. Open Passwords & Accounts.

  3. Review:

    • Password Settings

    • Authentication Requirements

    • Authorized Networks

    • API Key Settings

  4. Document your current authentication configuration.

  5. Identify authentication gaps before making changes.

BEST PRACTICE:

Review authentication settings before creating users, roles, or applications. Authentication requirements affect every user that accesses the server.

Recommended Authentication Strategies

Use one or more of the following implementation models.

All strategies require you to have a System Administrator role and must be validated before placing them.

You configure Authentication Strategies at a server level, which impacts all your Internal Users immediately after saving changes. Ensure you plan your modifications and inform your users before changing your server's settings

This model uses VPAM passwords without MFA.

This approach:

  • Simplifies user onboarding

  • Requires minimal configuration

However:

  • Provides the lowest security level

  • Increases exposure to credential compromise

IMPORTANT:

Imprivata does not recommend password-only authentication for privileged access environments.

Mobile Authentication uses a time-based one-time password generated by an authenticator application. Authentication codes refresh automatically and provide a second authentication factor beyond the user's password.

This approach:

  • Is easy to deploy

  • Does not require external integrations

  • Provides strong MFA protection

This model works well for:

  • Small deployments

  • Standalone VPAM environments

  • Organizations without SAML providers

BEST PRACTICE:

Require Mobile Authentication for all administrative users.

Organizations with an Identity Provider should configure SAML authentication and enforce MFA through the IdP.

This approach enables:

  • Centralized identity management

  • Centralized MFA enforcement

  • Simplified user lifecycle management

  • Reduced password management inside VPAM

Examples include:

  • Microsoft Entra ID

  • ADFS

  • Okta

BEST PRACTICE:

Maintain at least one local VPAM System Administrator account as a break-glass account before enabling SAML authentication.

Facial Authentication provides a biometric authentication factor that can be used as part of a passwordless or multi-factor authentication strategy. Vendor Representatives can enroll in Face Authentication when the feature is enabled by administrators.

This approach:

  • Reduces dependence on passwords

  • Increases identity assurance

  • Improves user experience

Facial Authentication is most effective when combined with:

  • Mobile Authentication

  • SAML authentication

  • Risk-Based Authentication

BEST PRACTICE:

Reserve biometric authentication for privileged users, high-risk systems, and sensitive environments.
NOTE:
Facial Authentication requires additional licensing.

Organizations with Identity Threat Detection and Response (ITDR) licensing can implement Risk-Based Authentication (RBA).

Risk-Based Authentication evaluates authentication activity and determines whether:

  • Access is allowed

  • Additional authentication is required

  • Access should be denied

When elevated risk is detected, VPAM can challenge users with:

  • Mobile Authentication

  • Facial Authentication

instead of allowing access immediately.

This approach enables:

  • Adaptive authentication

  • Reduced MFA fatigue

  • Improved protection against suspicious login attempts

BEST PRACTICE:

Use Risk-Based Authentication in conjunction with MFA rather than as a replacement for MFA.
NOTE:
Risk-Based Authentication requires additional licensing.

Building a Secure Administrative Authentication Model

System Administrators have the highest level of access in VPAM .

Protect administrative accounts with:

  • MFA requirements

  • Mobile Authentication

  • Facial Authentication

  • SAML authentication

  • Authorized Network restrictions

  • Separate administrator accounts

Avoid using daily-use accounts as administrative accounts.

BEST PRACTICE:

Administrative accounts should always have stronger authentication requirements than standard users.

Local Authentication Accounts

A local authentication account is a local System Administrator account reserved for emergency situations.

Examples include:

  • Identity Provider outages

  • SAML configuration errors

  • MFA provider failures

  • Directory service outages

Configure local authenticated accounts with:

  • Unique credentials

  • Strong passwords

  • Restricted access procedures

  • Secure credential storage

IMPORTANT:
Test locally authenticated account access regularly to ensure emergency recovery procedures remain functional.

Validation and Testing

After implementing authentication controls:

  1. Test standard user login.

  2. Test administrator login.

  3. Test MFA enrollment.

  4. Test Mobile Authentication.

  5. Test SAML authentication.

  6. Test account lockout behavior.

  7. Test password recovery workflows.

  8. Test break-glass account access.

  9. Validate audit logs.

  10. Document authentication procedures.

TIP:

Perform authentication changes during scheduled maintenance windows whenever possible.

Recommendations

Ensure that you also follow the following recommendations when implementing authentication controls.

DO

  • Require MFA whenever possible.

  • Use Mobile Authentication for privileged users.

  • Integrate VPAM with an Identity Provider.

  • Enforce MFA through your Identity Provider.

  • Protect administrative accounts with stronger authentication requirements.

  • Maintain at least one locally authenticated account.

  • Restrict access using Authorized Networks where appropriate.

  • Review authentication policies regularly.

  • Validate user enrollment processes.

  • Audit authentication activity.

DON'T

  • Don't rely exclusively on passwords.

  • Don't share administrator accounts.

  • Don't disable MFA for convenience.

  • Don't use personal email accounts for administrative users.

  • Don't assign System Administrator privileges broadly.

  • Don't leave inactive accounts enabled indefinitely.

  • Don't deploy SAML authentication without a tested recovery account.

  • Don't implement facial authentication without documented enrollment procedures.

  • Don't treat Risk-Based Authentication as a replacement for MFA.