Hey there - probably a simple answer, but struggling to figure it out. Supposing we have: * A Project for each customer of ours * A superadmin client app that has write capabilities If we want to write FHIR resources to those different Projects, how do we do so?

My recommendation would be to a client ClientApp that's scoped within each project, rather than using the SuperAdmin client app. SuperAdmin bypasses a lot of our schema validation (we assume you have a good reason), and in general we advise people keep the use for super admin client apps as tightly scoped as possible.

> SuperAdmin bypasses a lot of our schema validation @rahul1 what sort of validation is skipped?

Probably a longer answer than you need Super Admins can always: - Overwrite fields in the

.meta

section, including rewriting the author, last updated time, account, etc. - They can overwrite the

id

field of a resource, which is typically server generated (see this doc: https://www.medplum.com/docs/access/admin#super-admin) Additionally, the Super Admin Project does not default to "strict mode" (https://www.medplum.com/docs/access/projects#settings) - This bypasses a lot of schema validation, and allows you to do things like write numbers to a string field, etc. - This was really only a setting needed by some legacy customers. You can enable strict mode for your super admin project to tighten up the validation

Okay, thanks, that's actually very appropriate length and detail - helps a lot. We need to do this

They can overwrite the id field of a resource, which is typically server generated

So I think we need superadmin for that reason. But we can (and should) enabled strict mode, it sounds like.

> We need to do this > They can overwrite the id field of a resource, which is typically server generated Understood. Just be aware that your code is then responsible for all uniqueness checks. Because this is the primary id of the resource in our DB, having two resources with the same id is likely to cause instability

Hi @rahul1 thanks for your help so far. We have begun deploying the Medplum App and have run into some trouble when setting up access control based on our technical requirements. In a world where each Project has its own ClientApplication, how might we deploy the Medplum App? I noticed that the Medplum App uses an environment variable

MEDPLUM_CLIENT_ID

. Does this mean that we'd need to deploy a new instance of the Medplum App for every ClientApplication?

Hi @dylman123 , good question! It turns out, it's ok if the MEDPLUM_CLIENT_ID isn't set here. What matters most is that the base URL is set properly

Hi @rahul1 thanks for your quick reply. Our use case is as follows: We need to restrict user access to specific Projects in Medplum. As an example: - Brendan to have access to Project A and B - Dylan to have access to Project A only - Josh (Super Admin) to access all Projects - Patient access is not allowed What is your recommended path forward in this case?

Thanks for the explanation. I think I have an understanding of what you want, so I'll try to answer the best I can. Medplum is inherently a multi-tenant system, with each proejct being a tenant. You can run a single instance of the Medplum App for multiple tenants. To give a user access to a project, you would just invite them to that project. See our User Management Guide here (https://www.medplum.com/docs/auth/user-management-guide)

Thank you Rahul!