Set Up Supervisor for Supervised Enrollment

Enrollment supervisors witness and attest to a provider's enrollment of authentication methods that require heightened verification. No special technical skills are required to act as an enrollment supervisor beyond using the enrollment utility as described in Supervised Enrollment.

An EAM administrator must configure users for this role.

Adding Supervisors

Supervisors are configured on the Enrollment supervisors page (Imprivata Admin Console > Users > Enrollment Supervisors).

To add a user to the supervisors list, click Add enrollment supervisors, then search for the user you want to add.

Select the user's name from the drop-down list. A message appears at the top of the page confirming that the user was successfully added to the supervisors list.

Authentication Methods for Witnessing

Supervisors must authenticate when witnessing and attesting to provider enrollments.

• All authentication methods are allowed.

• By default, supervisors use Password or Fingerprint as a single factor.

• Administrators can configure one-factor or two-factor authentication.

To configure authentication methods:

1. Open the Enrollment supervisors page (Users > Enrollment supervisors).
2. Click the authentication method you want to modify, or click Add another method.
3. Select the authentication method to use as the first authentication factor.
4. Optional — Select the authentication method to use as the second authentication factor.
5. Click Done.
6. Repeat steps 2-5 for all authentication methods you want to enable for enrollment supervisors.

If you want to delete an authentication method, click the authentication method and then click Remove this authentication method. You can add the authentication method back later by clicking Add another method.

Enrollment Settings

Supervised enrollment is available to all users with a Enterprise Access Management or Authentication Management license.

The following authentication methods can be configured to always require supervision:

• Imprivata ID

• Fingerprint

• OTP token

• Secure proximity card (DESFire)

• Security Key (FIDO)

• Facial biometric

Other modalities, such as standard proximity card or Imprivata PIN, can be enrolled during supervised enrollment, but they do not require witnessing.

After the provider has enrolled an authentication method in the presence of an enrollment supervisor, you can allow self-enrollment of subsequent authentication methods:

1. Go to the Enrollment supervisors page (Users > Enrollment supervisors).

2. Deselect the methods you don’t want to require supervision for.