Users, Roles & Scopes

Access to a Medipal instance is controlled by roles, and roles are collections of scopes. Administrators manage both under Admin Panel → Access, which has four tabs: Users, Current Sessions, Roles and API Keys.

Users

The Users tab lists every account with name, email, phone, external identifier, roles, whether multi-factor authentication is enabled, whether a password change is pending, and the creation date.

Action	Effect
Create User Profile	Creates a staff account with name, email and initial role. The user sets a password on first sign-in.
Edit	Changes profile details.
Change Role	Assigns or removes roles.
Reset Password	Issues a new temporary password.
Force Password Change	Requires the user to choose a new password at their next sign-in.
Delete	Removes the account.

Patient accounts are created from the Patients page, not here; see Patients & Devices.

Account status

An account is either active or disabled. A disabled account keeps its roles and history but cannot sign in through any method, and its active sessions are ended. Re-enabling restores access unchanged.

Multi-factor authentication

Users can enable time-based one-time passwords from User Profile → Security. The Users tab shows who has MFA enabled. Sign-in details are in Signing In.

Current sessions

The Current Sessions tab shows who is signed in right now: user, sign-in method (credentials or Microsoft), device and browser, address, start and expiry. Revoke Session signs that session out immediately. Use it when a device is lost or a user leaves.

Roles

A role is a named set of scopes. Medipal ships with system roles and lets you add custom ones.

Role	Intended for	Typical rights
Admin	Instance administrators	Everything.
Provider	Clinicians and care staff	Questionnaires, patients, enrollments, results and analytics; not vault, webhooks, workflow authoring, clinical-source administration or consent authoring.
Integration	System accounts behind API keys	Everything except managing authentication itself.
Responder	Patients	Only their own questionnaires, through the mobile app or a link.

System roles cannot be renamed or deleted. To grant a different mix of rights, Create Role, give it a name and description, and assign scopes.

The role page

Opening a role shows three tabs:

• Info: name and description.
• Assigned Users: who holds the role, when it was granted and by whom; assign or unassign users here.
• Scopes: the scope matrix for the role.

Scopes

Every action in Medipal is guarded by a scope written as resource : action. Resources include questionnaires, submissions, folders, patients, enrollments, devices, users, roles, permissions, plugins, workflows, webhooks, vault, analytics, clinical sources, consent documents, the AI assistant and configuration. Actions are:

Action	Meaning
read	View the resource.
write	Create and edit.
delete	Remove.
manage	Administrative operations on the resource (for example permissions, keys, sources).
execute	Run something (an action, a query, the assistant).

The scope matrix

The Scopes tab of a role shows a grid: one row per resource, one column per action. Tick individual cells, or use the row and column toggles to select a whole resource or a whole action. You can only grant scopes you hold yourself; the rest appear disabled.

Scopes are additive: a user with several roles has the union of their scopes. Changes take effect at the user's next request.

Folder and questionnaire permissions

Scopes say what kind of thing a user may do. Which folders and questionnaires they may do it on is decided by folder permissions (owner, editor, viewer), which are inherited down the folder tree. See Folders & Configuration.

Signing in with your organisation directory

Instances can be connected to Microsoft Entra ID so that staff sign in with their organisation account. Two levels are available:

1. Sign-in only. Users are matched to existing Medipal accounts by email. Roles are managed in Medipal.
2. Directory-driven accounts. Membership of chosen directory groups creates accounts automatically and grants the roles mapped to those groups. When someone leaves the group, the account is disabled. Roles granted by hand in Medipal are never removed by the directory.

The mapping from groups to roles is configured per instance by your Medipal contact; you provide the group identifiers and the roles they should receive. The rollout can start in a dry-run mode that reports what would change without changing anything.

Troubleshooting

Symptom	Likely cause	What to do
A user cannot see a menu entry	Their roles lack the read scope for that resource	Check the role's scope matrix.
A button is greyed out with "no permission"	Missing write, delete or manage scope	Grant the scope on one of the user's roles.
A user can see a questionnaire but not edit it	Folder permission is viewer	Change the folder or questionnaire permission; see Folders & Configuration.
Cannot tick a scope in the matrix	You do not hold that scope yourself	Ask an administrator with that scope.
Directory user signs in but has no rights	Sign-in-only level, no Medipal account or role yet	Create the account with the same email and assign a role, or enable directory-driven accounts.
Account shows "disabled" after a directory change	The user left every mapped group	Add them back to a mapped group, or re-enable the account manually.