{"id":44099,"date":"2021-11-23T17:00:47","date_gmt":"2021-11-23T17:00:47","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=101829"},"modified":"2021-11-23T17:00:47","modified_gmt":"2021-11-23T17:00:47","slug":"mvp-health-care-secures-member-portal-access-with-microsoft-azure-active-directory-b2c","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/mvp-health-care-secures-member-portal-access-with-microsoft-azure-active-directory-b2c\/","title":{"rendered":"MVP Health Care secures member portal access with Microsoft Azure Active Directory B2C"},"content":{"rendered":"

Hello! I\u2019m Sue Bohn, Microsoft Vice President of Program Management for Identity and Network Access. In today\u2019s Voice of the Customer<\/a> blog post, Chief Technology Officer and Chief Information Security Officer David Swits of MVP Health Care shares how Microsoft Azure Active Directory B2C<\/a> helped the organization modernize and simplify portal authentication.<\/p>\n

MVP Health Care modernizes and simplifies the way members gain access to health plan information<\/h2>\n

As both Chief Technology Officer and the Chief Information Security Officer at MVP Health Care<\/a>, I believe you must design your technology solutions with security as the foundation and then overlay the functionality. When building online portals to be accessible to four groups\u2014individual members, employers, healthcare providers, and brokers\u2014MVP Health Care prioritized security as much as ease of use and the user experience (UX). After all, stolen healthcare data is highly prized by cybercriminals, and we have a duty to protect members\u2019 information.<\/p>\n

MVP Health Care is a regional, not-for-profit health plan with 700,000 members and 1,700 employees in New York and Vermont. When I joined in 2018, the company was eight to nine years behind on technology. Our objective was to embark on digital transformation so the company could more easily and efficiently serve our constituents. As a Microsoft-first organization, that meant turning to Microsoft technology as we reinvented our infrastructure and replaced our traditional authentication methods with Azure Active Directory<\/a> (Azure AD) External Identities for B2C user journeys.<\/p>\n

The technology running previous portals was antiquated and cumbersome<\/h2>\n

Comparing healthcare plans can be confusing. We knew we had data that could make it easier. To do that, our portals needed to cut through complexity and deliver the right content for each constituent group.<\/p>\n

The old portals\u2014fueled by the IBM WebSphere Application Server\u2014were cumbersome to use and support. MVP Health Care developers sometimes had to go through the back-end to fix an account. No back-end identity process existed to authenticate people who needed to access a portal, so anyone could create an identity for anyone.<\/p>\n

Partner Edgile becomes an extension of MVP Health Care\u2019s team<\/h2>\n

We considered augmenting what we already had with biometrics features, but those plugins didn\u2019t mesh well with our infrastructure. In 2018, we brought on Edgile<\/a> as a partner and shared our Zero Trust security approach<\/a>\u2014assuming breach and giving people the least privileged access possible. With extensive knowledge of Azure AD B2C, Edgile designed the identity infrastructure around the new portal and trained our team on best practices.<\/p>\n

Edgile built B2C custom policies with user flows, such as seamless single sign-on<\/a> and self-service password reset<\/a>. Single sign-on lets people access all their apps after signing in once, while self-service password reset enables people to unlock or reset their passwords without the help desk. To preserve the user accounts from MVP\u2019s previous identity provider, Edgile designed a migration path for users to move to Azure AD B2C the first time they signed in.<\/p>\n

Microsoft provided feature previews to Edgile and worked with an MVP Health Care developer to port the UX designs into the HTML, JavaScript, and cascading style sheets (CSS) to refine the experience. A collection of Azure functions and a .NET Core RESTful web application from Edgile helped maintain data synchronization and the execution of complex operations.<\/p>\n

\n

\u201cEdgile teamed up really well with MVP Health Care expertise in identity management including external identity management. We started first with a strategy that was followed by a successful quickstart\/proof of concept that led to the broader implementation.\u201d<\/em>\u2014Tarun Vazirani, Edgile Account Partner<\/p>\n<\/blockquote>\n

Custom policies help create user journeys<\/h2>\n

MVP Health Care leveraged the custom policies, which are configuration files that define the behavior of MVP\u2019s Azure AD B2C tenant user experience. While user flows are predefined in the Azure AD B2C portal for the most common identity tasks, a custom policy can be edited by an identity developer to be fully configurable and policy-driven. It orchestrates trust between entities in standard protocols, including OpenID Connect, OAuth, and SAML, and a few non-standard ones like REST API\u2013based system-to-system claims exchanges. The framework creates user-friendly, white-labeled experiences to:<\/p>\n