Skip to main content
Connecting your Microsoft Entra ID tenant to Nexus is a one-time setup that takes about 5 minutes. Nexus uses Microsoft’s delegated admin consent model — you grant read permissions once and Nexus handles the rest securely. There’s nothing to install, no firewall rules to change, and no service accounts to provision in your environment.

​
Before you begin

Make sure you have the following ready before starting the connection process:
  • A Microsoft Entra ID tenant (formerly Azure Active Directory)
  • An account with Global Administrator or Privileged Role Administrator rights in that tenant
  • A Scalio Nexus account — if you don’t have one yet, request access at scaliocloud.com

​
Step-by-step connection

1

Sign in to the Nexus portal

Go to app.nexus.scaliocloud.com and sign in with your work account. Make sure you’re signing in with an account that has the required administrator rights in the Entra tenant you want to connect.
2

Open Connected Tenants

Click Settings in the left navigation sidebar, then select Connected Tenants. This page lists all Entra tenants currently linked to your Nexus organization.
3

Start the connection flow

Click Connect New Tenant in the top-right corner of the Connected Tenants page. This opens the tenant connection dialog.
4

Enter your tenant identifier

Type your tenant’s primary domain (for example, contoso.com) or paste your directory ID (a UUID found in the Azure portal under Entra ID > Overview). Click Continue.
5

Grant admin consent on the Microsoft consent page

Your browser will redirect to Microsoft’s standard admin consent page. Review the list of permissions Nexus is requesting (detailed in the table below), then click Accept. You must be signed in as a Global Administrator or Privileged Role Administrator for this step to succeed.
6

Wait for the initial sync to complete

After you accept, Nexus redirects you back to the Connected Tenants page. The new tenant will appear with a status of Syncing. The initial sync — which imports users, groups, roles, applications, and recent audit logs — typically completes in 2–5 minutes for most tenants. Larger tenants with hundreds of thousands of objects may take up to 15 minutes.

​
Permissions Nexus requests

Nexus requests the minimum read-only permissions needed to give you full visibility into your identity posture. No write permissions are requested during this flow, and Nexus never modifies objects in your directory unless you explicitly configure an automation rule to do so.

​
Multi-tenant organizations

If your organization operates more than one Entra tenant — for example, separate tenants for production and development environments, or tenants inherited through mergers and acquisitions — you can connect all of them to a single Nexus account. Each connected tenant is managed and displayed independently, allowing you to compare posture across tenants or run cross-tenant access reviews. To add a second (or third, or fourth) tenant, simply repeat the connection steps above while signed into Nexus. When prompted for admin consent, make sure you’re signed in with an administrator account that belongs to the tenant you’re adding. All connected tenants appear under Settings > Connected Tenants, each with their own sync status, last-synced timestamp, and posture score.

​
Disconnecting a tenant

If you need to remove a tenant from Nexus — for example, because you’re decommissioning it or moving to a different Nexus organization — go to Settings > Connected Tenants, click the name of the tenant you want to remove, and select Disconnect. Nexus will immediately revoke its access token and queue the tenant’s data for deletion. All synced data for that tenant is permanently removed from Nexus within 24 hours.
Disconnecting a tenant permanently removes all synced data, posture history, and access review records for that tenant. This action cannot be undone. If you think you may want to reconnect the tenant in the future, consider pausing sync instead by contacting Scalio support before disconnecting.