Participation in the service is restricted to institutions operating in the fields of education or scientific research, or entities organizationally and functionally affiliated therewith, following an assessment of their legal status, technical and security readiness, and their ability to comply with operational and support requirements.

Institutions may be accredited as an Identity Provider (IdP), Service Provider (SP), or both, based on their technical infrastructure. Each role shall be evaluated independently without presumption of mutual entitlement.

The Egyptian Universities Network reserves the right to conduct periodic reviews and audits, and to request any necessary operational documents and evidence, without prejudice to the competencies of other relevant regulatory authorities (such as the National Telecommunications Regulatory Authority) in this regard.

The Network is committed to implementing a national data protection policy that governs data collection, processing purposes, retention periods, and disclosure entities, in compliance with relevant Egyptian laws.

The Network defines escalation mechanisms for incidents, faults, and complaints, as well as response levels and points of contact, to ensure prompt resolution and service continuity.

Tracing shall be conducted, when necessary, through technical logs and trust relationships between the concerned entities (IdP / SP / NRO), within legal and procedural frameworks, without prejudice to the privacy principles upon which the service is established.

The Network is committed to providing official and updated communication channels with participating institutions and relevant regional and international entities, while making support information available via the official service website: eduroam.eg.

Identity Providers are required to restrict the issuance of eduroam credentials to eligible categories according to the institution's regulations and the Egyptian Universities Network policies, with a clear definition of the start and end of eligibility, and immediate revocation of credentials upon termination of affiliation (e.g., graduation, resignation, transfer to another institution, etc.).

The service user or beneficiary must be clearly identified, with explicit specification of authorizations and available services.

Each user must be associated with a unique, traceable individual account. Shared or anonymous accounts are strictly prohibited.

Identity Providers are required to implement secure authentication mechanisms compliant with eduroam, based on EAP protocols, with support for mutual authentication and encryption. The use of digital certificates is preferred whenever possible.

Entities are required to protect the credential lifecycle, including password policies, temporary suspension after five (5) consecutive failed attempts, prohibition of storing confidential data, and prompting users to change passwords at least every 180 days.

Identity Providers are required to retain sufficient authentication and verification logs linking usage to specific users for a minimum period of six (6) months, provided this does not conflict with eduroam requirements.

Continuous updates to Intrusion Detection and Prevention Systems (IDS/IPS) and the utilization of technical solutions approved by Information Security and Incident Management (SIEM) administration are required.

Identity Providers are required to provide basic support to their affiliated users regarding device configuration and service usage.

Identity Providers are required to cooperate with the Egyptian Universities Network in cases of relevant complaints, incidents, and technical investigations.

The National Telecommunications Regulatory Authority (NTRA) shall be enabled to conduct inspections and audits of the university networks participating in the system to ensure compliance with all controls and stipulations in accordance with local policies and laws.

Service Providers are required to provide the eduroam service to all eligible users from recognized participating institutions without imposing any fees on visiting users or their home institutions.

Service Providers are required to broadcast the wireless network with the SSID "eduroam" and deliver it via an 802.1X infrastructure integrated with approved authentication mechanisms. Alternatives such as Captive Portals shall not be used.

Service Providers are required to enforce strict separation (logical via VLANs or physical) between eduroam users and the institution's sensitive internal networks, ensuring protection of the internal infrastructure without impacting service availability.

Local security controls (such as firewall policies, bandwidth management, and prevention of malicious activities) may be applied, provided they do not affect the authentication mechanism or discriminate among eligible users.

It is required to ensure that university systems are not used to distribute any malicious, destructive, or fraudulent code or information, or to introduce or enable computer viruses or virus code, or to engage in any hacking activities within or outside the university environment.

Commitment is required to ensure that communication ports are deactivated when not in use and that activation is performed exclusively by the institution's Information Technology personnel.

A maximum limit of four (4) devices per user operating simultaneously shall be enforced.

Service Providers are required to retain sufficient logs to link connection sessions to technical trace elements, such as Access Point data and MAC addresses, and to correlate IP addresses where necessary. Retention shall be for the locally mandated period (six months) or any longer period required by law or eduroam obligations.

Commitment is required to connect these networks to the Internet solely through companies licensed by the National Telecommunications Regulatory Authority (NTRA).

Service Providers are required to report major incidents and faults and to cooperate with the Egyptian Universities Network in technical investigations through approved channels.

Compliance is required regarding the conformity of equipment used in these networks with the technical specifications, coverage areas, and frequencies approved by the National Telecommunications Regulatory Authority (NTRA).

The National Telecommunications Regulatory Authority (NTRA) shall be enabled to conduct inspections and audits of the university networks participating in the system to ensure compliance with all controls and stipulations in accordance with local policies and laws.

The eduroam service is designated for educational, academic, research, and professional use associated with the institution's mission. Users are required to comply with Egyptian laws, regulations, and institutional policies.

The use of the service for any illegal or harmful activities is prohibited, including but not limited to distributing malware, infringing intellectual property rights, circumventing security controls, or sharing credentials.

The user is required to maintain the confidentiality of their credentials and configure connection settings according to their home institution's instructions, particularly regarding secure connections and server validation.

The user is required to use strong passwords (consisting of at least eight (8) characters, including letters, numbers, and symbols) and to update them periodically, at least every 180 days.

The account shall be temporarily suspended after five (5) consecutive failed login attempts, with a maximum usage limit of four (4) devices simultaneously.

The user acknowledges awareness that usage and connection logs are retained for operational, security, and investigative purposes, in accordance with applicable policies and relevant laws.