Modern Identity & Access Control

Stop Sharing Passwords. Start Using Badges.

A project next to Managed Office, not a chapter of the monthly retainer.

Shared passwords are still common in busy professional offices, and they create real risk. Modern proximity-badge systems solve the problem cleanly: staff tap a badge and are logged in as themselves in one to two seconds.

What We Deliver

• RF IDeas WAVE ID hardware paired with Identity Automation
• Fast, unique-user login on shared workstations (typically 1–2 seconds)
• Simple onboarding for new staff and instantaneous offboarding when someone leaves
• Clear audit trails that support HIPAA unique-user identification requirements
• Integration with your existing systems so the experience feels native
• Alignment with Microsoft Entra ID or hybrid identity so badge login and cloud identity tell the same story

Microsoft identity underneath

Badges work best when they sit on a clean identity foundation. Where your office already uses Microsoft 365, we connect proximity login to Entra ID (or hybrid identity) so unique users, audit trails, and day-to-day Microsoft apps stay consistent. The goal is speed at the workstation and accountability in the record, without a second parallel login culture.

Healthy hybrid identity

Many professional offices still have two separate worlds: staff sign into office computers with one set of credentials (often from an on-premises Active Directory), and into email or Microsoft 365 with another. When those systems are not tied together, every hire, departure, and password reset is double work—and access can linger in one place after it was removed in the other.

A healthy hybrid identity environment connects local Active Directory with Microsoft Entra ID so there is one coherent identity for each person. PC login, Microsoft 365, and related access then follow the same account lifecycle.

Benefits typically include:

• Much simpler onboarding and offboarding — Create or disable a person once; access to workstations and Microsoft 365 stays aligned instead of requiring parallel steps in two systems.
• Stronger security — Consistent accounts make it practical to apply modern controls (such as multifactor authentication and Conditional Access) more evenly, and to reduce orphaned or leftover access after staff changes.
• Cleaner foundation for Badged Access and passwordless patterns — Proximity badges and similar tools work best when badge login and cloud identity describe the same person. Hybrid identity removes the “two login cultures” problem that undermines both speed and accountability.
• Clearer audit trails — Who signed in, where, and to which apps is easier to explain when workstation and Microsoft 365 identity are not disconnected stories—useful for day-to-day operations and for HIPAA-oriented documentation.
• Less daily friction — Fewer conflicting passwords, fewer “which login do I use?” moments, and fewer tickets that only exist because the two directories drifted apart.
• A path that matches how the practice already works — Many offices are not ready to abandon on-premises Active Directory overnight. Hybrid identity improves the bridge to Microsoft 365 without forcing an all-or-nothing cutover.

Implementation is scoped to your environment: the current directory, how Microsoft 365 is already set up, and whether Badged Access or other identity work is happening in the same project. Hybrid identity is assessed and proposed after a short discovery.

See also Pricing Principles for how separate (non-integrated) logins affect Managed Office complexity, and Sample Pricing for how Badged Access is illustrated as a project.

Microsoft 365 Administration is a separate monthly option when you want RFVIT to keep Microsoft 365 in good order for the whole office (sign-ins, mailboxes, licenses, and shared settings). That is not the same as this page’s project work. Rates are on Pricing Principles and in the sample on Sample Pricing.

How we implement Hybrid Identity

The usual starting point is an on-premises Active Directory that is not synchronized with Microsoft 365, plus a mix of named users and shared role logins. That is the baseline we plan against. A practice that is already further along only drops steps.

A typical engagement follows a fixed sequence:

• Discovery questionnaire — who logs in where, shared role accounts, Microsoft 365 users and licenses, clinical applications, and whether file shares or scan folders depend on a shared account.
• Identity map — each person to a named account in both directories, each shared role to a group, collisions and leftover accounts written down before anything is synchronized.
• Two tracks — Hybrid Identity on its own, or Hybrid Identity packaged with Badged Access. Badge work stays its own line when you choose it.
• Pilot, then cutover — two or three people run a real morning on the named identity first. Then the rest of the office moves, shared interactive logins come off the in-scope stations, and the office keeps a one-page joiner and leaver page.

Implementation labor is a fixed fee after assessment. Microsoft licenses, if they are required, are estimated pass-throughs valid for a short window and billed at actual vendor cost. The Managed Office retainer does not change at go-live.

How we implement Badged Access

Most offices we meet are not starting from a clean identity design. The usual picture is an on-premises Active Directory that is not tied to Microsoft 365, shared role passwords on operatories and the front desk, and no badge readers. That is the baseline we plan against, so a cleaner office only drops steps.

A typical engagement follows a fixed sequence:

• Discovery questionnaire — stations, who actually logs in, shared role accounts, Microsoft 365 users, clinical applications, and whether existing door badges can be reused.
• Identity and station map — each person to a named account, each shared role to a group, each chair or desk to a reader. Clinical apps are tested under a named Windows user before the whole office cuts over.
• Two tracks — badges on the directory you have today, or badges packaged with hybrid identity so PC login and Microsoft 365 describe the same person. Hybrid work is scoped as its own line when you choose it.
• Hardware and software — RF IDeas WAVE ID readers on the in-scope stations, plus the Identity Automation authentication platform (BAA-eligible for healthcare). Spare readers and spare badges are part of the first order.
• Pilot, then go-live — two or three people run a real morning on badges first. Then the rest of the staff enroll, shared interactive passwords come off those stations, and the office keeps a one-page job aid for new hires.

Lost badges, extra stations after acceptance, and refresher training are ordered later as Badged Access Ongoing. The Managed Office retainer does not change when badges go live. Implementation labor is a fixed fee after assessment. Readers and the authentication platform are manufacturer products, so those dollars are an estimate valid for a short window, then billed at actual vendor cost. If the vendor invoice would run more than 10% over the estimate, we pause and get written approval before ordering. The public Sample Pricing page is hypothetical only.

Why It Matters

Badge-based access reduces daily friction, strengthens security, and makes staffing changes far cleaner. It is one of the highest-impact improvements available to dental and medical offices that still rely on shared credentials.

HIPAA requires unique user identification and the ability to show who accessed electronic protected health information. Shared passwords fail that standard. OCR enforcement in recent years has reached solo and small practices, not only large systems, with settlements often in the five-figure to low six-figure range plus multi-year corrective plans. Missing risk analysis and weak access controls are among the findings that turn a complaint or breach into a costly review.

Proximity badges give you speed and the audit trail: 1–2 second login as the named user, instant offboarding when someone leaves, and documentation that supports a defensible risk posture. We implement RF IDeas WAVE ID with Identity Automation so the control fits clinical workflow instead of fighting it.

Best for: Offices with shared workstations, frequent staffing changes, or growing concerns around access control and audit readiness (especially dental and medical practices subject to HIPAA).