The University of Michigan has security measures in place to ensure that whenever and wherever you access Michigan Medicine–hosted applications, such as MiChart*, you do so securely.  That includes remote access (i.e., from outside the Michigan Medicine (MM) network). The Citrix Workspace application has a "clientless" version that does not require users to install a client application on a personal or public device.  Instead, users access a "Virtual Places" website that is secured with Duo two-factor authentication to access hosted applications remotely.

If you have a CoreImage or CoreMac device, you can use the included Citrix Workspace client application--with or without the VPN.  Logging into the services requires Duo two-factor authentication.

• Duo for iPhone
• Duo for Android
• Duo Hardware Token

The requirements to remotely access Citrix will depend on the type of device you are using.

Alternatively, you can choose to use Windows Virtual Desktop to gain access to these same applications, albeit with a full "desktop" experience as opposed to just interacting with specific hosted applications.

*Note: In addition to MiChart, other MM-hosted applications that this document applies to include MedView, Metriq, CVIS, and the 3M-CAC apps.

Which Setup Are You?

This guide presents two scenarios for accessing applications from outside the Michigan Medicine network.

1. Scenario 1 -- Working remotely and using a personal device or a public device such as one provided as a conference kiosk or in hotel lobby.
2. Scenario 2 -- Working remotely using a corporate CoreImage or CoreMac device.

Scenario 1

Accessing Hosted Applications from a personal or public computer

Follow the steps in this section if you are accessing Michigan Medicine's hosted applications using a personal or public device (i.e., one that is not owned and managed by Michigan Medicine). Examples are your personally owned Mac, kiosk devices available at conferences, or shared devices available from a hotel lobby. In these cases, you will access the Michigan Medicine network through a web browser.

NOTE: This scenario is also referred to as the "Clientless Access Scenario."

IMPORTANT: In a clientless setting, you will not receive client drive mappings. Therefore, for security reasons, you will not be able to save documents to local drives on the PC/device you are working on. You will also not be able to access printers with this method.

1. Validate you are on a supported device.
   1. Windows 10+
   2. macOS 10.15+
   3. iOS (latest)
   4. Android (latest)
2. Validate you are using an HTML 5 browser.
   1. Apple Safari
   2. Google Chrome
   3. Microsoft Edge
   4. Mozilla Firefox
      
      
3. Open https://vplaces.med.umich.edu
   
   
4. Provide your uniqname and UMICH password.
    
   
   
5. As of January 2025, only Duo Passcodes are accepted for two-factor authentication. Use either the Duo mobile application or a Duo Hardware Token to get a passcode.
   
   As shown in the following screenshot, open the Duo mobile application, click on University of Michigan, note the 6-digit passcode, and then enter it into the login window's Duo Passcode field.
   
   Having trouble with Duo?  Follow these instructions to enroll or reenroll in Duo.
   
   
   
   
   
   If you are using a Duo Hardware Token, note the passcode and enter it into the login window's Duo Passcode field.
   
   
   
6. Click Log On.
   
   
7. If you see the following page, click on Use Light Version.
   
   Note:  You must not be connected to the VPN.  You will get a connection error if you are using the VPN at the same time.  By policy, the VPN is not compatible with a personally owned device.  Users that need internal network connectivity on a personal device are directed to use Windows Virtual Desktop (WVD).
   
   
8. Click a hosted application to launch it.
   
   
   
   

Scenario 2

Accessing Hosted Applications from a Michigan Medicine CoreImage Device

Michigan Medicine uses a standard "CoreImage" software configuration for its managed desktop, laptop, and tablet PC devices. A device that has the CoreImage loaded already has the software tools, security features, and device management features that Michigan Medicine users need. CoreMacs have a similar set of applications.  This includes the Citrix Workspace application.

The procedure you use to open your hosted applications from a CoreImage or CoreMac device depends on whether you are connecting from within the Michigan Medicine network or connecting from a remote location (i.e., outside the Michigan Medicine network).

From within the Michigan Medicine network

You are considered within the Michigan Medicine network if any one of the following apply:

• You are physically located at a Michigan Medicine facility and hard-wired to the network.
• You are connected to the Mfleet Wi-Fi network.
• You are connected to the Michigan Medicine VPN.

If the device is within the Michigan Medicine network, you can open your hosted applications directly from the Citrix Workspace application in the start menu.

When remote (outside the Michigan Medicine network)

You can open your hosted applications directly from the Citrix Workspace application in the start menu, but in this scenario, you will need to complete additional login steps.

Note that if you are working remotely with your CoreImage or CoreMac device and are using the VPN, you cannot connect to the Vplaces website.  Vplaces will not work when the VPN is in use. Use the Citrix Workspace application instead as shown below.

Open the Citrix Workspace application available on your device's platform (available in the CoreImage start menu; CoreMac Finder; iPhone home screen).

1. Enter your uniqname.
   
   
2. Enter your UMICH password.
   
   
3. Enter the passcode the Passcode/Token field.  You can retrieve this passcode using either your Duo mobile app or your Duo Hardware Token.
   
   
   • Open the Duo mobile application, click on University of Michigan, note the 6-digit passcode, and then enter it into the Passcode/Token field.
     
     Having trouble with Duo?  Follow these instructions to enroll or reenroll in Duo.
     
     
     
     --OR--
     
     
   • If you are using a Duo Hardware Token, note the passcode and enter it into the Passcode/Token field.
     
     
     
4. If prompted, enter "umhs" as the domain.

Click Sign In (application) or Go (mobile app) to complete your login.