Sign in | RaneemHCP wireframes

Notes

This screen answersUS-10 US-54 US-41 US-55 US-56

Acceptance criteria

US-10 2FA Login (Microsoft) + Auto-Unlock HIGHEST

As a portal user, I want to log in using Microsoft Authenticator or email OTP, so my account is protected beyond a password.

Given a user has Multi-Factor Authenticator enrolled via Microsoft Entra, when they log in with correct credentials, then they are prompted for Authenticator approval or email OTP before access is granted.
Given a user fails MFA 5 times, when the 5th attempt fails, then the account is temporarily locked per security policy. Auto-unlock after 15 min.
After auto-unlock and another 3 failed attempts within 24 hours, account is temporarily locked for admin to unlock. (full admin-unlock go to US-54).
Given MFA is enabled, when an existing user without enrollment logs in, then they are forced through enrollment before proceeding.

US-54 Account Lockout + Admin Unlock HIGHEST

As an administrator, I want the ability to manually unlock accounts, so that locked users can be recovered under control.

Lockout policy: threshold (failed attempts before soft-lock): 5, Lock duration (auto-unlock): 15 mins, Counter Reset: after every successful login.
Admin can manually unlock a locked account.
Given an account soft-locks 3 times within 24 hours, when the 3rd lock occurs, then it becomes a hard lock requiring admin unlock (no auto-unlock).
Given a hard lock or a suspicious pattern (multiple accounts locking, or one account from many sources), when detected, then an admin is notified via in-app alert and email.
Given a hard lock, when the admin reviews it, then the failed-attempt history (from the audit log) is visible to support the decision.

US-41 Session Management HIGHEST

As a portal user, I want my session to time out after inactivity and fully end on logout, so that my account can't be accessed from an unattended or stale session.

Inactive session times out after a configurable period → re-auth required.
Concurrent-session rule defined (allow/deny/limit).
Logout fully invalidates the session token.

US-55 Deactivate (not delete) User HIGHEST

As an administrator, I want to deactivate rather than delete users, so that account history is retained for audit while access is revoked.

Users deactivated, not hard-deleted; history retained for audit.
Deactivated users cannot authenticate.

US-56 Password Policy HIGHEST

As an administrator, I want enforced password complexity, expiry, and reuse rules, so that user accounts meet security standards.

Enforce complexity rules (length:min 8 characters, character mix: special char, number, capital & small letter) on set/reset.
Optional expiry window configurable.
Reject reuse of the last 3 passwords.