Planning your return to office strategy? See how Chrome OS can help.

Use Chrome OS devices with Imprivata OneSign

Set up Imprivata OneSign on Chrome OS devices

For managed ChromeOS devices.

Healthcare organizations can integrate Imprivata OneSign with Chrome Enterprise to let users sign in to managed Chrome OS devices by tapping their badge, instead of having to enter their username and password.


To use Chrome OS devices with Imprivata OneSign, you need:

  • Chrome or Chrome OS Flex device. See table below for version requirements. We recommend that you use devices with an I-class processor and at least 8 GB of RAM.
  • Chrome Enterprise Upgrade for each device you want to manage.
  • Imprivata OneSign:
    • G3 appliance—See table below for version requirements
    • Authentication Management (AM) licenses
    • Virtual Desktop Access (VDA) licenses
  • Virtual app and desktop solution:
    • Citrix Virtual Apps and Desktops version 7.15 or later, or
    • VMware Horizon 7.12 or later

Note: Additional requirements apply if you’re using Virtual App and Desktop Launcher (V-Launcher) to launch virtualized apps or desktops on managed Chrome OS devices. For example, you might want to turn on Fast User Switching (FUS) inside of virtualized electronic health records (EHRs) on Chrome OS devices. See the V-Launcher deployment guide.

What's supported?

With our latest release, we’ve added the following new features in version 3:

  • Fast User Switching at the workstation level—Shared kiosk workstation support helps to improve performance by reducing sign-in times.
  • Fast User Switching at the application level, Epic only mode—EHRs that support in-app user switching help to improve performance.
  • VMware integration—Users can automatically or manually launch virtual VMware apps and desktops. The VMware integration fully supports Fast User Switching at the workstation level.


Chrome OS Imprivata integration v1 v2 v3
Requirements Minimum Chrome OS version 81 86 97
Minimum Chrome OS Flex version 81 89 104
Imprivata appliance version

7.1 HF1

7.2 SP1 HF4

7.3 HF1 or later

7.2 SP1 HF4

7.3 HF1 or later

Workstation types Type 1: Single user
Type 2: Shared kiosk
Modalities Proximity card (authentication and enrollment)
Password (authentication, update, reset)
Security questions (enrollment)
PIN (authentication, update, enrollment)
Workflows Sign in (single and multi-factor authentication)
Lock and unlock (tap in and out)
Switch user sessions (tap over)
Roam between devices
VDI (Citrix) Autolaunch desktops and apps
Manually launch apps from launcher
Virtual channel support
Fast User Switching at the application level, Epic only mode
VDI (VMWare) Autolaunch desktops and apps
Manually launch apps from launcher
Virtual channel support
Fast User Switching at the application level, Epic only mode
(In progress)
Web apps Single sign-on into web applications via SAML
Peripherals rf IDEAS proximity card readers
Personal Computer/Smart Card (PC/SC) proximity card readers
Other Imprivata appliance failover
screen UI customizations


Verified rf IDEAS badge readers

Single frequency 125 kHz.

Models starting with:

  • RDR-60 = IMP-60 = IMP-NV60
  • RDR-62
  • RDR-63
  • RDR-64
  • RDR-67
  • RDR-69
  • RDR-6C
  • RDR-6E
  • RDR-6G
  • RDR-6H
  • RDR-6N
  • RDR-6T
  • RDR-6Z

Single frequency 13.56 MHz.

Models starting with:

  • RDR-70
  • RDR-75 = IMP-75 = IMP-NV75
  • RDR-7F
  • RDR-7L

Dual frequency 125kHz and 13.56MHz.

Models starting with:

  • RDR-805 = IMP-80
  • RDR-800 = IMP-82
  • RDR-305 = IMP-80-BLE
  • RDR-300 = IMP-82-BLE


  • KSI-1700
  • KSI-1900
PC/SC readers

PC/SC readers require additional configuration steps. For details, see Configure additional features.

  • IMP-MFR-75
  • HID OMNIKEY 5022
  • HID OMNIKEY 5023
  • HID OMNIKEY 5422

Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

Was this helpful?
How can we improve it?
Clear search
Close search
Google apps
Main menu
Search Help Center