Face Recognition as an Authentication Method

By default, the Imprivata Cloud Connect service is disabled. You must enable the service before configuring the connection to the Imprivata Cloud Platform.

To start the service:

1. In the Imprivata Appliance Console, go to System > Operations.

2. Locate Imprivata Cloud Connect, and click Stop/restart options.

3. Select Restart Imprivata Cloud Connect on all appliances, and click Go.

Using the Imprivata Admin Console, copy your enterprise integration ID. You require this value to use the Imprivata Access Management setup to create an integration token.

To copy your integration ID:

1. In the Imprivata Admin Console, click the gear icon > Imprivata Access Management integrations.

   NOTE:

   A status message of Unable to verify integration. Unable to connect to Imprivata Access Management is expected.

2. Copy the enterprise integration ID to your clipboard.

3. Do not log out. You finish configuring the connection here after using the Imprivata Access Management setup to create the integration token.

Using the Imprivata Access Management setup, enter your enterprise integration ID to create an integration token. This token is required to finish configuring the connection in the Imprivata Admin Console.

To create the integration token:

1. Open the Imprivata Access Management setup.

2. If you have not already, agree to the Cloud Features Agreement and enter information about your organization.

3. Go to the Connect to Enterprise Access Management screen, and paste the integration ID into Enterprise integration ID.

4. Click Create integration token and copy it.

5. Return to the Imprivata Admin Console to finish configuring the connection.

Using the Imprivata Admin Console, finish configuring the connection to the Imprivata Cloud Platform using the integration token you created.

To finish the configuration:

1. In the Imprivata Admin Console, click the gear icon > Imprivata Access Management integrations.

2. Paste the integration token, and click Integrate.

3. Select Administrator console single sign-on using SAML.

   This setting is required to enable SSO access to your administrator consoles in the Imprivata Access Management portal.

Using the Imprivata Access Management setup, copy the Imprivata SP metadata URL. You use this URL to save the metadata as an XML file, which you upload to your Entra app.

To save the metadata URL as an XML file:

1. Open the Imprivata Access Management setup.

2. If you have not already, agree to the Cloud Features Agreement and enter information about your organization.

3. Go to the Identity Provider Connect screen.

4. Copy the Imprivata SP metadata URL, paste it into a new browser tab, and save the page as an XML file.

5. Do not close the wizard. You finish configuring the connection here after you configure your Entra app.

Using the Microsoft Entra Admin center, configure the Entra ID app to support authentication into the Imprivata Access Management portal.

To configure the Entra app:

1. In the Entra app, click Microsoft Entra ID > Manage > Enterprise Applications > New application.

2. Click Create your own applications.

3. Enter a display name for the application, select Integrate any other application you don't find in the gallery, and then click Create.

4. Go to Overview > Assign users and groups, and add the users/groups who require administrative access to the Imprivata Access Management portal.

5. Click Set up single sign-on, and select SAML as the single sign-on method.

6. Click Upload metadata file and upload the Imprivata SP metadata file you created previously.

7. Under Basic SAML Configuration, click Edit, specify https://access.imprivata.com for the single sign-on URL, and then click Save and Close.

Using the Microsoft Entra Admin center, copy and save the following Entra app values. You use the following values to finish the configuration in the Imprivata Access Management setup:

• The URL endpoint of federation metadata.

• The SAML name/value pair that identifies users with administrative access.

To locate the required values:

1. In the Entra app, go to SAML certificates, and copy the App Federation Metadata URL.

2. Under Atttributes & Claims, click Edit.

3. If one does not already exist, click Add a group claim.

   BEST PRACTICE:

   Use Group ID as the source attribute.

4. Copy the claim name for groups.

   Example: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

5. Locate the group of users that should have adminstrator access and copy the Object ID.

6. Return to the Imprivata Access Management setup to finish the configuration.

Using the Imprivata Access Management setup, finish configuring Entra ID as an IdP using the Entra app values saved previously.

To finish the configuration:

1. Open the Imprivata Access Management setup, and go to the Identity Provider Connect screen.

2. Enter the SAML IdP metadata URL of the Entra app, and click Continue.

3. Paste the administrator group's claim name into SAML attribute name.

4. Paste the administrator group's Object ID into SAML attribute value, and click Continue.

5. Click Go to Access URL: access.imprivata.com to test the authentication workflow to access the Imprivata Access Management portal.

From the Microsoft Azure Portal, add the trusted Imprivata IP addresses.

To add the IP addresses:

1. Go to Microsoft Entra ID, and select > Manage > Security > Manage > Named locations.

2. Click IP ranges location.

3. Enter a name for the new location, and then select Mark as trusted location.

4. Add the following IP addresses:

   • 44.207.16.175/32

   • 44.196.189.191/32

   • 34.195.47.118/32

5. Click Add, and then Create.

If per-user multifactor authentication is enabled for users, adding the trusted Imprivata IP addressees to the list of MFA trusted IPs is required.

To add the IP addresses:

1. From the Microsoft Azure Portal, go to Microsoft Entra ID > Manage > Users, and click Per-user MFA.

2. Select the Service Settings tab.

3. Add the following IP addresses to Skip multifactor authentication for requests from following range of IP address subnets:

   • 44.207.16.175/32

   • 44.196.189.191/32

   • 34.195.47.118/32

4. Click Save.

By default, Microsoft Entra Connect Sync pass-through authentication or Password Hash Sync (PHS) is supported.

If your Entra ID environment is federated with a third-party IdP, however, PHS is required.

To verify if PHS is enabled:

1. From the Microsoft Azure Portal, go to Microsoft Entra ID > Manage > Microsoft Entra Connect.

2. Click Connect Sync.

3. Under Microsoft Entra Connect sync, verify that Password Hash Sync is enabled.

4. If it is not enabled, configure Password Hash Synchronization from the server where the Microsoft Entra Connect Sync Agent is installed.

Configure Imprivata Enterprise Access Management as a directory. Doing so, provides full user sync capabilities.

Syncing your users requires one of the following:

• Entra ID Global Administrator rights

• Privileged Role Administrator rights

To sync Entra ID users:

1. Log into the Imprivata Access Management portal (access.imprivata.com).

2. Click the gear icon.

3. On the Entra ID users tab, click Add an Entra ID directory now.

   The Add Entra ID as a directory window opens.

4. Paste your Entra ID Tenant ID, and click Continue to Microsoft Authentication.

5. Click specify groups now. Enter groups names to find and add them.

6. Click Update now to sync users.

If your Entra ID environment is federated with a third-party IdP, this step is required.

The Imprivata Cloud Platform must be able to validate user passwords when entered. In a federated environment, Imprivata needs to avoid these calls from being redirected to the federated identity provider (IdP). You must change the home realm discovery policy for authentication from the Imprivata Cloud to your Entra ID tenant only. This only applies to authentication calls made by the Imprivata Access Management Sync.

To create and apply the Home Realm Discovery policy:

1. Log in to Microsoft Graph Explorer.

   To make it more secure, log in as the Global Administrator.

2. Consent to the Microsoft Graph explorer application in your tenant.

   For more information, see the Microsoft Graph API documentation.

3. Create a home realm discovery policy by making the following HTTP request:

   POST - https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies

   Request body

   In the request body, supply a JSON representation of the homeRealmDiscoveryPolicy object:

   Copy

   {
           "displayName": "yourPolicyName",
           "definition": [
           "{\"HomeRealmDiscoveryPolicy\": 
           {\"AllowCloudPasswordValidation\":true, } }"
           ],
           "isOrganizationDefault": false
   }

   Response

   If successful, this method returns a 201 Created response code and a new homeRealmDiscoveryPolicy object in the response body.

   Example Response

   Copy

   {
           "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#policies/homeRealmDiscoveryPolicies",
           "value": [
           {
               "id": "239cbead-1111-654a-9f50-1467d691aaa",
               "deletedDateTime": null,
               "definition": [
               "{\"HomeRealmDiscoveryPolicy\" : { \"AllowCloudPasswordValidation\":true, } }"
               ],
               "displayName": "Exclude Federated Authentication ",
               "isOrganizationDefault": false
           }
       ]
   }

4. Assign the home realm discovery policy to the Imprivata Access Management Sync application by making the following HTTP request:

   POST - https://graph.microsoft.com/v1.0/servicePrincipals/<the Imprivata Access Management Sync application object id>/homeRealmDiscoveryPolicies/$ref

   Request body

   In the request body, supply the identifier of the homeRealmDiscoveryPolicy object that should be assigned.

   Copy

   {
       "@odata.id":"https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies/<yourHomeRealmDiscovery_PolicyID>"
   }

   Response

   If successful, this method returns a 204 No Content response code.

5. Verify that the home realm discovery policy was successfully applied to the service principal by making the following HTTP request:

   GET - https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies/<homeRealmDiscoveryPolicy object id>/appliesTo

   Response

   Copy

   {
           "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#directoryObjects",
           "value": [
           {
           "@odata.type": "#microsoft.graph.servicePrincipal",
           "id": "c1f8e0d4-25b0-46b2-aaa8-827822631a33",
   
   ...

You must exclude the Imprivata Access Management Sync application from all conditional access policies that would require MFA for Imprivata users.

To update a conditional access policy:

1. From the Microsoft Azure Portal, go to Microsoft Entra ID, select Manage > Security > Protect > Conditional Access > Policies.

2. Click the policy that applies to your Imprivata users.

3. Under Target resources, click All resources (formerly All Cloud apps).

4. Click Exclude, and then toggle Select resources.

5. Under Select specific resources, click None or any of the listed applications.

6. Search for Imprivata Access Management, select it, and click Select.

7. Save the policy.

8. Repeat for all conditional access policies that would require MFA for Imprivata users.

1. In the Enterprise Access Management Admin Console, go to the User policies page > Authentication tab > Desktop Access authentication section.

2. In the Primary factors column, select Face recognition.

3. In the Second factors column, select another factor for use with face recognition:

   • no second factor (Not recommended)

     • In EAM 25.3, the Imprivata Admin Console still displays the option for no second factor. It is not a recommended configuration.

     • In EAM 25.4 and later, the no second factor option has been removed.

   • Security Key

   • Imprivata PIN

   • Proximity Card

   • Security Key or Imprivata PIN or Proximity Card

     Click to enlarge

     

   BEST PRACTICE:

   For enhanced protection against sophisticated attacks, pair Face Authentication with a strong second factor like proximity card.

4. In the Primary factors column, select another primary factor and its corresponding second factor.

   Specifying additional authentication methods allows users in the policy to authenticate to the device when face recognition is not available. For example, when face recognition is not available, the users must authenticate via password + Imprivata ID.

5. Click Save.

Depending on the authentication methods defined in the user policy and computer policy, ensure that you have configured the appropriate grace periods for the second authentication factor.

For example, when using proximity cards as the second authentication factor, you can set a grace period for the second authentication factor after successful authentication, up to 24 hours 59 minutes.

The settings are available in the Authentication method options section of the Authentication tab in the Imprivata Admin Console.

Mobile Access Management organizations with Check Out using EAM as the Identity provider (IdP) create a host (computer) in EAM for every Launchpad registered. That computer in EAM gets a computer policy which must have a proximity card enabled to be able to perform a checkout with a proximity card tap.

• Confirm that there is no override in the computer policy that the Launchpads are assigned to. If the Launchpads are assigned to the Default Computer Policy, no changes should be needed.

• MAM's iOS devices are displayed in the Imprivata Admin Console as Prove ID Web devices; confirm that the mobile devices are in the Default Computer Policy. If they are assigned to the Default Computer Policy, no changes should be needed.

• Confirm that the user policies your mobile users are assigned to allow proximity cards as a primary factor.

If all of the above conditions are true, no changes are needed.

• However, if an override is already enabled within the computer policy the Launchpads are in, ensure that Proximity Card is allowed in the override.

• If this is not possible or allowed for your organization, Imprivata recommends moving the Launchpads and devices into a separate computer policy.

If you've performed the validations above, and computer policy changes are needed for your environment, follow these steps.

1. In the Imprivata Admin Console, go to Computers > Computer policies and select the computer policy your Launchpad is using.

2. In Override and Restrict tab > Desktop Access Authentication Restrictions section, make sure that the option for Proximity Card is selected (enabled).

   Click to enlarge