From 0604f6a088c9169aa89e6db5f4bb405097c4865a Mon Sep 17 00:00:00 2001
From: kpslp <112363511+kpslp@users.noreply.github.com>
Date: Wed, 4 Jun 2025 14:06:07 +0800
Subject: [PATCH 01/19] Update techpass-status.md
---
docs/support/techpass-status.md | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md
index 37c7224..dba58af 100644
--- a/docs/support/techpass-status.md
+++ b/docs/support/techpass-status.md
@@ -10,7 +10,10 @@ No scheduled maintenance!
## Ongoing incidents
-No ongoing incident
+| **Date** | 4 June 2025 |
+|---|---|
+| **Incident summary** | We are currently facing issues with Intune.
**Impact**
- New users onboarding to SEED may be affected.
- Some users may face issues accessing SGTS or GCC.
**Action**
- We have identified the root cause and are working closely with Microsoft to resolve the issue.
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).
*Posted on: 4 June 2025, 2:00 PM SGT* |
+
## Previous incidents
From 15d0c6b591efa7cb7b34c97ecd6d5377a78dbb07 Mon Sep 17 00:00:00 2001
From: kpslp <112363511+kpslp@users.noreply.github.com>
Date: Wed, 4 Jun 2025 14:15:47 +0800
Subject: [PATCH 02/19] Update techpass-status.md
---
docs/support/techpass-status.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md
index dba58af..3bbd68a 100644
--- a/docs/support/techpass-status.md
+++ b/docs/support/techpass-status.md
@@ -12,7 +12,7 @@ No scheduled maintenance!
| **Date** | 4 June 2025 |
|---|---|
-| **Incident summary** | We are currently facing issues with Intune.
**Impact**
- New users onboarding to SEED may be affected.
- Some users may face issues accessing SGTS or GCC.
**Action**
- We have identified the root cause and are working closely with Microsoft to resolve the issue.
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).
*Posted on: 4 June 2025, 2:00 PM SGT* |
+| **Incident summary** | We are currently facing issues with Intune.
**Impact**
- New users onboarding to SEED may be affected.
**Action**
- We have identified the root cause and are working closely with Microsoft to resolve the issue.
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).
*Posted on: 4 June 2025, 2:10 PM SGT* |
From b0d841957c80f301dc82d13c6fe9616570d39ed1 Mon Sep 17 00:00:00 2001
From: eu-tee <118496033+eu-tee@users.noreply.github.com>
Date: Wed, 4 Jun 2025 14:32:28 +0800
Subject: [PATCH 03/19] Update techpass-status.md
---
docs/support/techpass-status.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md
index 3bbd68a..fe701ad 100644
--- a/docs/support/techpass-status.md
+++ b/docs/support/techpass-status.md
@@ -12,7 +12,7 @@ No scheduled maintenance!
| **Date** | 4 June 2025 |
|---|---|
-| **Incident summary** | We are currently facing issues with Intune.
**Impact**
- New users onboarding to SEED may be affected.
**Action**
- We have identified the root cause and are working closely with Microsoft to resolve the issue.
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).
*Posted on: 4 June 2025, 2:10 PM SGT* |
+| **Incident summary** | We are currently facing issues with Intune. We have identified the root cause and are working closely with Microsoft to resolve the issue.
**Impact**
- New users onboarding to SEED may be affected.
**Action**
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).
*Posted on: 4 June 2025, 2:10 PM SGT* |
From 48f1c93af5e04f9568791b8396cdba9724b7fa73 Mon Sep 17 00:00:00 2001
From: eu-tee <118496033+eu-tee@users.noreply.github.com>
Date: Wed, 4 Jun 2025 14:33:25 +0800
Subject: [PATCH 04/19] Update techpass-status.md
---
docs/support/techpass-status.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md
index fe701ad..1ca8993 100644
--- a/docs/support/techpass-status.md
+++ b/docs/support/techpass-status.md
@@ -12,7 +12,7 @@ No scheduled maintenance!
| **Date** | 4 June 2025 |
|---|---|
-| **Incident summary** | We are currently facing issues with Intune. We have identified the root cause and are working closely with Microsoft to resolve the issue.
**Impact**
- New users onboarding to SEED may be affected.
**Action**
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).
*Posted on: 4 June 2025, 2:10 PM SGT* |
+| **Incident summary** | We are currently facing issues with Intune. We have identified the root cause and are working closely with Microsoft to resolve the issue.
**Impact**
- New users onboarding to SEED may be affected.
If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).
*Posted on: 4 June 2025, 2:10 PM SGT* |
From 88696674383fe8d70d5c064468b6cead19c3de27 Mon Sep 17 00:00:00 2001
From: kpslp <112363511+kpslp@users.noreply.github.com>
Date: Wed, 4 Jun 2025 16:09:00 +0800
Subject: [PATCH 05/19] Update techpass-status.md
---
docs/support/techpass-status.md | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md
index 1ca8993..920bcdd 100644
--- a/docs/support/techpass-status.md
+++ b/docs/support/techpass-status.md
@@ -10,14 +10,17 @@ No scheduled maintenance!
## Ongoing incidents
-| **Date** | 4 June 2025 |
-|---|---|
-| **Incident summary** | We are currently facing issues with Intune. We have identified the root cause and are working closely with Microsoft to resolve the issue.
**Impact**
- New users onboarding to SEED may be affected.
If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).
*Posted on: 4 June 2025, 2:10 PM SGT* |
+No ongoing incident!
## Previous incidents
+**| Date | 4 June 2025 |
+|------|--------------|
+| **Issue summary** | The Intune issue affecting new user onboarding to SEED has been **resolved as of 4:00 PM SGT**.
**Impact**: New users onboarding to SEED via TechPass may have experienced access issues earlier today.
The issue has been fixed, and onboarding is now functioning normally.
**For more assistance**: Create an [incident support request](https://go.gov.sg/seed-techpass-support). |
+**
+
| **Date** | 22 January 2025 |
|---|---|
| **Incident summary** | At **11:58 AM (SGT)** today, TechPass users reported being unable to log in to the TechPass portal.
**Impact**
- Users were unable to access the TechPass portal during the incident.
- Access to downstream services was unaffected.
**Resolution**
- The issue has been resolved, and users can now log in successfully.
*Posted on: 22 January 2025, 12:30 SGT* |
From 02679de33bb4c2af5c01e09fca03c6a5de86345d Mon Sep 17 00:00:00 2001
From: eu-tee <118496033+eu-tee@users.noreply.github.com>
Date: Wed, 4 Jun 2025 19:10:27 +0800
Subject: [PATCH 06/19] Update techpass-status.md
---
docs/support/techpass-status.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md
index 920bcdd..c201347 100644
--- a/docs/support/techpass-status.md
+++ b/docs/support/techpass-status.md
@@ -18,7 +18,7 @@ No ongoing incident!
**| Date | 4 June 2025 |
|------|--------------|
-| **Issue summary** | The Intune issue affecting new user onboarding to SEED has been **resolved as of 4:00 PM SGT**.
**Impact**: New users onboarding to SEED via TechPass may have experienced access issues earlier today.
The issue has been fixed, and onboarding is now functioning normally.
**For more assistance**: Create an [incident support request](https://go.gov.sg/seed-techpass-support). |
+| **Issue summary** | The Intune issue affecting new user onboarding to SEED has been **resolved as of 6:57 PM SGT**.
**Impact**: New users onboarding to SEED via TechPass may have experienced access issues earlier today.
The issue has been fixed, and onboarding is now functioning normally.
**For more assistance**: Create an [incident support request](https://go.gov.sg/seed-techpass-support). |
**
| **Date** | 22 January 2025 |
From e3d335678b75b614cfa46cbfcb0304eb937ead15 Mon Sep 17 00:00:00 2001
From: kpslp <112363511+kpslp@users.noreply.github.com>
Date: Wed, 4 Jun 2025 19:20:53 +0800
Subject: [PATCH 07/19] Update techpass-status.md
---
docs/support/techpass-status.md | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md
index c201347..1570438 100644
--- a/docs/support/techpass-status.md
+++ b/docs/support/techpass-status.md
@@ -16,10 +16,9 @@ No ongoing incident!
## Previous incidents
-**| Date | 4 June 2025 |
+| **Date** | 4 June 2025 |
|------|--------------|
| **Issue summary** | The Intune issue affecting new user onboarding to SEED has been **resolved as of 6:57 PM SGT**.
**Impact**: New users onboarding to SEED via TechPass may have experienced access issues earlier today.
The issue has been fixed, and onboarding is now functioning normally.
**For more assistance**: Create an [incident support request](https://go.gov.sg/seed-techpass-support). |
-**
| **Date** | 22 January 2025 |
|---|---|
From d812051921f82f8396244471bd1baf5f730d4fe4 Mon Sep 17 00:00:00 2001
From: Huda
Date: Thu, 5 Jun 2025 04:16:01 +0800
Subject: [PATCH 08/19] change
---
docs/_sidebar.md | 6 +-
docs/account-llifecycle.md | 54 ++++++++++++++++++
docs/securing-your-account.md | 100 ++++++++++++++++++++++++++++++++++
3 files changed, 159 insertions(+), 1 deletion(-)
create mode 100644 docs/account-llifecycle.md
create mode 100644 docs/securing-your-account.md
diff --git a/docs/_sidebar.md b/docs/_sidebar.md
index fcac50c..fbc801c 100644
--- a/docs/_sidebar.md
+++ b/docs/_sidebar.md
@@ -12,7 +12,11 @@
- [Request for SEED provisioning](request-for-seed-provisioning)
- [Register Intune Device ID](register-intune-device-id)
- [Edit TechPass profile](edit-profile)
- - [User life cycle](user-lifecycle)
+- **Account and access lifecycle**
+ - [User lifecycle rules](user-lifecycle.md)
+ - [Account lifecycle after departure](account-lifecycle.md)
+ - [Securing your account](securing-your-account.md)
+
- **Reset MFA**
- [WOG account](reset-security-verification-for-wog-account)
- [TechPass account](reset-techpass-mfa-for-new-device)
diff --git a/docs/account-llifecycle.md b/docs/account-llifecycle.md
new file mode 100644
index 0000000..8094b4a
--- /dev/null
+++ b/docs/account-llifecycle.md
@@ -0,0 +1,54 @@
+# Account lifecycle after leaving your organisation
+
+When you leave your organisation, your TechPass account may be disabled or terminated. This affects your access to connected services such as SEED, GCC, and SHIP-HATS. This guide explains what you can expect and what you might need to do.
+
+## Lifecycle flow overview
+
+The diagram below shows how account removal is triggered and processed across systems:
+
+
+
+## How account removal is triggered
+
+TechPass is notified by your organisation when a user leaves. These notifications come from official systems or manual requests from project teams.
+
+| Source | Applies to | Description |
+| --- | --- | --- |
+| HR systems | Public officers | Exit events are detected by central identity systems. |
+| TIVO system (temporary, intern, vendor officers) | Vendors, interns, temporary staff | Access removal is triggered when an assignment ends. |
+| Service request | All user types | A manual request to remove a user can be submitted by project teams. |
+
+> Note: If you move to another department within the same agency, your TechPass account will not be updated automatically. There is no signal to detect internal transfers, so your access remains unless your project team updates it manually.
+
+## How this affects your access
+
+Once your account is removed from TechPass, your access to other services may be affected in the following ways:
+
+- **SEED**
+ You will be signed out and unable to log back in.
+
+- **GCC**
+ Access is usually removed by project administrators. In some cases, this may take a few days, especially if GitLab group clean-up runs on a weekly schedule.
+
+- **SHIP-HATS**
+ Access removal follows a weekly sync. If your access still works temporarily, your project team is expected to remove it during their regular reviews.
+
+## What you might need to do
+
+Most users do not need to take any action. However:
+
+- If you still have access to a service you should no longer use, notify your project team.
+- You may be logged out from services without warning once the removal process completes.
+
+## For project teams and administrators
+
+| Role | Action |
+| --- | --- |
+| Tenant admin | Remove user access after receiving the email notification from TechPass. |
+| Project team | Review and clean up user access in tools such as SHIP-HATS or GitLab groups. |
+
+## Limitations
+
+- Internal transfers within the same agency are not automatically detected.
+- Some systems process access removal on a scheduled basis, which may cause delays.
+- Manual steps are still required in many cases, especially for project-level tools.
diff --git a/docs/securing-your-account.md b/docs/securing-your-account.md
new file mode 100644
index 0000000..72de145
--- /dev/null
+++ b/docs/securing-your-account.md
@@ -0,0 +1,100 @@
+# Securing your account
+
+Multiple layers of security are applied across TechPass and its connected systems to protect user accounts and control access to government digital services. These controls span authentication, authorisation, monitoring, and automated risk detection.
+
+Account security is a shared responsibility across users, agencies, services, and the identity platform.
+
+## Shared responsibility
+
+Account security is maintained through the combined efforts of different groups:
+
+| Group | Responsibility |
+| --- | --- |
+| End user | Use multifactor authentication (MFA), avoid approving unknown sign-in requests, report suspicious behaviour |
+| Agency (HR, managers) | Manage onboarding, deactivation, and internal movement of users |
+| Services | Define access through roles, assign permissions, and conduct regular access reviews |
+| Identity platform | Detect suspicious activity, enforce conditional access policies, and prompt reauthentication when needed |
+
+## Authentication and authorisation
+
+- **Authentication** is the process of confirming identity during sign-in (for example, using a password and MFA).
+- **Authorisation** determines what access is granted to the user based on assigned roles (for example, a project admin may have more access than a viewer).
+
+Both are essential for secure system access.
+
+## Security controls in place
+
+### Single sign-on (SSO)
+
+TechPass uses single sign-on to provide access to multiple services through a single identity.
+
+- Managed via Microsoft Entra ID
+- Requires MFA at sign-in
+- Allows centralised monitoring of sign-in behaviour
+
+### Multifactor authentication (MFA)
+
+MFA is required for all users. It protects against unauthorised access even if credentials are compromised.
+
+- Review each prompt before approving
+- Reject any unexpected MFA request
+- Report suspicious activity to TechPass support
+- MFA will be prompted again if a risky sign-in is detected
+
+### Device registration
+
+Access to some services, such as SEED, is restricted to registered devices.
+
+- Devices must meet compliance checks before registration
+- Helps prevent unauthorised access from unmanaged endpoints
+
+### Role-based access
+
+Access permissions are based on user roles, aligned with the principle of least privilege.
+
+- Services such as GCC2 use roles to define what users can view or manage
+- Roles should reflect the user’s actual responsibilities
+
+### Access reviews
+
+Regular access reviews ensure users retain only the access required for their roles.
+
+- Services are responsible for conducting reviews
+- Users may be prompted to confirm continued access
+- Unused or outdated access may be revoked
+
+### Identity protection and risky sign-ins
+
+The identity platform monitors sign-ins for risky patterns, including:
+
+- Sign-ins from unfamiliar locations or devices
+- Unusual session activity or behavioural anomalies
+- Multiple failed attempts or rapid account switching
+
+When risky behaviour is detected:
+
+- Access may be temporarily blocked
+- The user may be asked to reauthenticate and complete MFA
+- Conditional access policies are automatically enforced to reduce risk
+
+> To learn more, see [Microsoft identity protection](https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection).
+
+### Future enhancements: Privileged identity management
+
+Future updates may include tighter controls for sensitive roles, such as:
+
+- Just-in-time role elevation
+- Time-based access expiry
+- Access approvals before assignment
+
+These enhancements will support higher-risk functions and roles across agencies.
+
+## Security practices in integrated services
+
+- **GCC2** applies role-based access controls and conducts regular access reviews.
+- **SEED** requires devices to be registered before granting access.
+- Credentials used for TechPass sign-in follow security policies aligned with public sector infrastructure.
+
+---
+
+This guide is part of the broader **account and access lifecycle**. To learn what happens when an account is deactivated or removed, see [Account lifecycle after leaving your organisation](account-lifecycle.md).
From 7cbdbdee58bad9aa772159981542d1da92b246f1 Mon Sep 17 00:00:00 2001
From: kpslp <112363511+kpslp@users.noreply.github.com>
Date: Thu, 5 Jun 2025 04:17:15 +0800
Subject: [PATCH 09/19] Add files via upload
---
docs/assets/images/acc-lifecyle.png | Bin 0 -> 67479 bytes
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 docs/assets/images/acc-lifecyle.png
diff --git a/docs/assets/images/acc-lifecyle.png b/docs/assets/images/acc-lifecyle.png
new file mode 100644
index 0000000000000000000000000000000000000000..4db5d7ce875a2f31bf2e276014780beba06820a1
GIT binary patch
literal 67479
zcmce;1zeQt);^5A4L}qDQ3it$Bm`*&FbIbb=?0}6>7jKSlrTz4BSUw07=(0p=^&xx
z(9M61y3dZY_c`zP{lE9)ca9sF;hE>T?-kd&*0pZ$dv_&>k5L~ZA|fJ2-4T^1B02)!
z@7MWdKm6uXQO!a4&(Vi>)NF}}j-Mj@e_zM2`!*5L1tOH_O+|F%%&?0l`3i0i|CxFJ
zb4N018N~~CS#r_W*f;#{>W<_#Ntr&|STV-W8r$clH<6cP6YCVBBr~`=6-<>GrDSfN
zUViO(sQi&;`REP5@^>xs+nd|rqwbE5;tw7B)zCt;F(Q5a!(pxN!ZABdGZFo2sKanS
z@byR?Wn+Kn$M-~UxxFOz{rJ91z8d@Ux28-uxu4$_kmIlX`1X;y51RbPw>MbDkc7vE
zuh@`Fh@Tg`Cq;%KJUVAVl1^6=a3D&HJ+T>im^7=rhdV-X4WNCOpGiR#wg8dz)I~
z;?L94^ag{N6yoCIHdklU@UN?@MNt9N+@|_&DvF9hbf{M3(u?8}$9ZilD=Sn0Qb=gJ
zD1A1In|D(M;#+2?M1&3M{YLrj