ABDM M1 Only Certificate? The Two-Milestone Sandbox Exit Rule Explained (2026)

No, you cannot get only the ABDM M1 certificate. To exit the ABDM sandbox and receive production credentials, NHA requires any two milestones to be completed, so an M1-only (ABHA-only) integration cannot go live on its own. In practice hospital software pairs M1 with M2, and products that only read records pair M1 with M3. Facilities that just want ABHA at the registration desk usually do not need to certify at all: they use software that is already certified.

This guide shows where the two-milestone rule comes from, which milestone pairs work for which products, and the certified-stack route for teams that only want ABHA. Updated September 2026.

The rule: any two milestones to exit the sandbox

NHA's integration support team stated the rule on the official ABDM sandbox developer forum, in answer to the question "Is it possible to get only M1 certificate?":

"The exit process criteria currently require any 2 milestones to be completed to exit sandbox and get the credentials for production environment."

A related thread on completing the milestones discusses the same criteria. The sandbox exit application enforces it: an application with only M1 does not clear the exit criteria.

Where the rule is, and is not, written

The rule is not in a gazetted circular. The NDHM sandbox guidelines and the sandbox FAQ document do not state a milestone minimum. It is an operational criterion published through the forum and applied in the exit process. If you need it in writing for your own records, ask NHA integration support through sandbox support and keep the reply.

A short refresher: what M1, M2 and M3 are

M1 is identity; M2 and M3 are the exchange of health data. The full detail of each is in our ABDM milestones M1 to M4 guide, and the build sequence is in our ABDM integration step-by-step guide.

If you are unsure which milestones your product needs, our ABDM integration services team can tell you in one conversation, and build them if you need to certify.

Why NHA does not certify M1 alone

ABDM is a health data exchange, not an ID programme. An application that only creates ABHA numbers adds identities to the network but exchanges no records. Requiring a second milestone means every certified product either shares records (M2) or reads them (M3). That is our reading of the rule's purpose; NHA's forum answer states the criterion without a rationale.

Which two milestones should you pick?

• M1 + M2 (most hospital software). Registration creates the ABHA; the OPD notes, prescriptions, lab reports and discharge summaries your software already produces become linked records. Most of the M2 effort is producing those records as FHIR bundles, which also prepares you for claims work later. See what M2 certification involves.
• M1 + M3 (products that read records). Apps, payers and platforms that consume records rather than create them. M3 means building consent requests, decryption and a record viewer, and purging data when consent is revoked.
• All three. Hospitals that also want clinicians to see records from other providers. Plan M3 after going live with M1 and M2 if you serve hospitals that need it.

What an M1 plus M2 scope actually contains

If you are a software company and M1 plus M2 is your pair, this is the scope NHA's test cases cover. Plan both together; the registration screens you build for M1 are where M2 linking starts.

The decision as a flowchart

The route most facilities should take: use certified software

Certification attaches to the software, not to the hospital. A facility registers in the Health Facility Registry and becomes ABDM-enabled by using an HMIS or technology partner that has already cleared the milestones. The facility never touches the sandbox, the security audit or the exit paperwork.

So the honest answer to "we only want M1" depends on who is asking:

• A hospital or clinic that wants ABHA at registration: use certified software or a certified technology partner. No M1-only certificate is needed, because none exists.
• A software company whose customers ask for ABDM: you must certify your product, with at least two milestones. Plan M1 and M2 together from the start.
• A platform that is not where records are created (billing, scheduling, analytics): embed or partner with a certified stack. Our guide on whether your platform needs ABDM certification covers this case by platform type.

What happens after you have two milestones

With two milestones working in the sandbox, the exit runs through functional testing of each milestone, a security audit of the application (WASA), a demo to NHA's team and the exit form, after which production credentials are issued. Each stage and its paperwork is explained in our ABDM certification process guide.

Does NHCX count as a milestone?

No. NHCX, the National Health Claims Exchange, is a separate onboarding track with its own participant registry, FHIR profiles and testing. It does depend on ABDM: provider onboarding to NHCX requires ABDM M1, because claims are tied to the patient's verified ABHA identity. Doing M1 and M2 now is the shortest route to cashless claims later. Our NHCX guide for hospital leaders explains the claims side.

Planning ABDM for your product and want the milestones decided before you start? Talk to our team; we have taken hospital software through all three milestones and can tell you quickly whether you need to certify, and which pair to build.