Pediatrix PIM Activation Test Portal

	Type	Role	Expires
Loading…

	Type	Role	Max	MFA	Just.	Ticket	Apprv.	Ext
Loading…

Default duration

Your preferred default when activating roles.

hours

Quick Actions

Choose which settings are available in the header.

Appearance Inactive policies toggle

Appearance

Choose your preferred color theme.

Show user & tenant card

Display the user profile, account, and tenant banner below the header.

Show active roles in eligible list

If disabled, already-active roles are hidden from the eligible table.

Show inactive policies

Display inactive policies (e.g. MFA) as greyed-out labels.

Eligible roles on top

Show eligible roles above active roles.

Remember collapsed sections

Sections remember their collapsed/expanded state across refreshes. Turn off to always expand all sections on load.

Remember filter bar state

Remembers whether the eligible roles filter bar is expanded or collapsed across refreshes.

Per-tenant profiles

Show only profiles saved for the current tenant. Profiles saved while this is off are visible in all tenants.

Role type

Show the Type badge column (Entra, Azure, Groups).

Role name & scope

Primary role title and assigned scope (required).

Max duration

Show the Maximum duration policy column (Max).

MFA / Auth Context

Show the MFA and Authentication Context column (MFA).

Justification

Show the Business justification required column (Just.).

Ticket number

Show the Ticket number required column (Ticket).

Approval required

Show the Approval required from approver column (Apprv.).

Custom extension

Show the Pre-approval custom extension column (Ext).

Enable only what you need — consent is requested per surface.

Quick Start

Activate a role in 3 steps

1

Sign in

Authenticate via the Microsoft button.

2

Select roles

Check one or more eligible roles in the table. Entra, Azure, and Group roles can be mixed in one selection.

3

Activate

Click Activate, set duration (capped by policy), add justification if required, and confirm.

Multiple tenants?

Use the tenant selector in the header — repeat the 3 steps above for each tenant independently.

Done this before?

Open Profiles and load a saved selection — it skips step 2 entirely and pre-fills duration and justification.

Architecture

Direct API access, no backend

A fully static single-page application. Your browser authenticates via MSAL and calls Microsoft Graph and ARM directly — no backend, no proxy. Switching tenants starts a fresh auth flow; each tenant's token and session are fully isolated.

Browser authenticates via MSAL → Entra ID

Entra ID issues an access token (held in memory only)

Portal calls Microsoft Graph / ARM APIs directly

No backend — no proxy — nothing touches a server

Token & Data Storage

What lives where

What	Where stored	Lifetime
Access tokens	In-memory (MSAL)	~1 hr, auto-refreshed
Refresh tokens	sessionStorage	Tab lifetime
Activation profiles	IndexedDB (local)	Until deleted
Settings & flags	localStorage	Persistent

Active Roles

Eligible Roles