The Assistance Publique – Hôpitaux de Paris brings together several dozen establishments in Île-de-France. For healthcare professionals working there, professional messaging is an essential daily tool, necessary for exchanges between departments, coordination of care, and transmission of sensitive data. Access to this messaging has undergone recent technical changes that deserve to be detailed.
URL Switch: courriel.aphp.fr replaces messagerie.aphp.fr
The first obstacle encountered by many AP-HP agents is neither a forgotten password nor a network issue. It relates to a change in web address that the IT department implemented without all users being informed at the same pace.
The reference address for webmail is now courriel.aphp.fr. The old URL messagerie.aphp.fr has not disappeared, but it now serves as a Citrix/NetScaler gateway (AAA portal). Professionals who keep the old link in their favorites find themselves redirected to this gateway, causing redirection loops or authentication errors that are difficult to interpret.
A guide published by Open Syd in August 2026 and an article from Geek Daily updated in September 2026 document this issue. The most straightforward solution remains to replace the old favorite with courriel.aphp.fr and to clear the browser cache before the first connection via the new address. To access the AP-HP professional messaging without error, this bookmark update is the first step to take.
AP-HP Multi-Factor Authentication: What MFA Changes in Practice
The generalization of multi-factor authentication (MFA) for connections from outside the hospital network has changed login habits. The Microsoft Authenticator app is now required to validate off-site access.
Specifically, after entering their username and password on courriel.aphp.fr, the professional receives a push notification on their phone via Authenticator. They must approve this notification to access their inbox. The process adds a few seconds to the login, but it blocks identity theft attempts related to password theft.
Set Up Authenticator Before You Need It
The most common mistake is discovering the MFA requirement when trying to log in urgently from home or another establishment. Enrolling the phone in Authenticator must be done in advance, from the hospital’s internal network, via the Microsoft 365 account management portal.
Field feedback varies on the ease of this step. Some departments have digital referents who assist with the procedure, while others leave agents to navigate sometimes hard-to-find intranet documentation. In case of a phone change, the new device must be re-registered before losing access to the old one, otherwise account recovery goes through central IT support, with variable delays.
Difference Between AP-HP Internal Messaging and MSSanté
A recurring confusion pertains to the very nature of the messaging. The AP-HP professional inbox (accessible via courriel.aphp.fr) is a Microsoft enterprise messaging system, hosted in the institution’s Office 365 environment. It is used for internal exchanges between agents, administrative communications, and coordination within teams.
MSSanté is a distinct system, managed by the Digital Health Agency. It is a trusted space that allows healthcare professionals to exchange medical data securely with correspondents outside their establishment. MSSanté messaging operators (industrials, public organizations, establishments) provide mailboxes compliant with security and interoperability rules defined by the ANS.
In practice, an AP-HP doctor may have two professional addresses: their internal inbox (@aphp.fr) and a MSSanté address for communication with city medicine or other university hospitals. The two systems do not share the same login portal or credentials.
- AP-HP internal messaging: access via courriel.aphp.fr, AP-HP network credentials, MFA required off-site, administrative use and internal coordination
- MSSanté: access via the operator chosen by the establishment or the liberal professional, Pro Santé Connect identifier or CPS card, use focused on the exchange of health data between structures
- The two coexist without substituting for one another, and confusion between the two generates errors in sending sensitive documents to the wrong channel
Mobile Connection and Citrix Access: Two Paths, Two Logics
From a smartphone, access to AP-HP messaging generally goes through the Outlook app configured with the professional account. MFA via Authenticator applies in the same way as on a desktop browser. Mobile synchronization requires that the phone be enrolled in AP-HP’s device management policy.
Access via Citrix, on the other hand, meets another need. It allows opening a complete virtual desktop from any workstation, including a personal computer. It is through this gateway that messagerie.aphp.fr now redirects. The Citrix environment provides access not only to messaging but also to internal business applications.
Which Path to Favor Depending on the Context
For a simple email check off-site, webmail via courriel.aphp.fr or the Outlook mobile app remains the quickest route. Citrix access is justified when the professional needs to use internal software (patient file, planning tools) that are not available outside the hospital network.
- Quick email check: courriel.aphp.fr on browser or Outlook mobile
- Full work on business applications: Citrix gateway via messagerie.aphp.fr
- From a shared or public workstation: prefer private browsing and systematically log out of Authenticator after use
The distinction between these two paths avoids frustrations related to Citrix loading times when only email access is needed, and the limitations of webmail when a complete work environment is required. Choosing the right entry point according to your actual need remains the key to a smooth connection.
