> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scaliocloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Your Microsoft Entra ID Tenant to Scalio Nexus

> Link your Microsoft Entra ID tenant to Scalio Nexus using admin consent — no agents or infrastructure changes required. Detailed step-by-step guide.

Connecting your Microsoft Entra ID tenant to Nexus is a one-time setup that takes about 5 minutes. Nexus uses Microsoft's delegated admin consent model — you grant read permissions once and Nexus handles the rest securely. There's nothing to install, no firewall rules to change, and no service accounts to provision in your environment.

## Before you begin

<Info>
  Make sure you have the following ready before starting the connection process:

  * A **Microsoft Entra ID tenant** (formerly Azure Active Directory)
  * An account with **Global Administrator** or **Privileged Role Administrator** rights in that tenant
  * A **Scalio Nexus account** — if you don't have one yet, request access at [scaliocloud.com](https://scaliocloud.com)
</Info>

## Step-by-step connection

<Steps>
  <Step title="Sign in to the Nexus portal">
    Go to [app.nexus.scaliocloud.com](https://app.nexus.scaliocloud.com) and sign in with your work account. Make sure you're signing in with an account that has the required administrator rights in the Entra tenant you want to connect.
  </Step>

  <Step title="Open Connected Tenants">
    Click **Settings** in the left navigation sidebar, then select **Connected Tenants**. This page lists all Entra tenants currently linked to your Nexus organization.
  </Step>

  <Step title="Start the connection flow">
    Click **Connect New Tenant** in the top-right corner of the Connected Tenants page. This opens the tenant connection dialog.
  </Step>

  <Step title="Enter your tenant identifier">
    Type your tenant's primary domain (for example, `contoso.com`) or paste your directory ID (a UUID found in the Azure portal under **Entra ID > Overview**). Click **Continue**.
  </Step>

  <Step title="Grant admin consent on the Microsoft consent page">
    Your browser will redirect to Microsoft's standard admin consent page. Review the list of permissions Nexus is requesting (detailed in the table below), then click **Accept**. You must be signed in as a Global Administrator or Privileged Role Administrator for this step to succeed.
  </Step>

  <Step title="Wait for the initial sync to complete">
    After you accept, Nexus redirects you back to the Connected Tenants page. The new tenant will appear with a status of **Syncing**. The initial sync — which imports users, groups, roles, applications, and recent audit logs — typically completes in 2–5 minutes for most tenants. Larger tenants with hundreds of thousands of objects may take up to 15 minutes.
  </Step>
</Steps>

## Permissions Nexus requests

Nexus requests the minimum read-only permissions needed to give you full visibility into your identity posture. No write permissions are requested during this flow, and Nexus never modifies objects in your directory unless you explicitly configure an automation rule to do so.

| Permission Scope       | Purpose                                                                                                            |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------ |
| `User.Read.All`        | Read all users and their properties, including account status, assigned licenses, and profile attributes           |
| `Group.Read.All`       | Read all groups and their memberships, including security groups, Microsoft 365 groups, and role-assignable groups |
| `Application.Read.All` | Read enterprise applications and app registrations, including OAuth permissions granted to each app                |
| `Directory.Read.All`   | Read directory objects and role assignments, including privileged role holders and administrative unit memberships |
| `AuditLog.Read.All`    | Read sign-in logs and audit logs for risk detection, anomaly analysis, and access review evidence                  |

## Multi-tenant organizations

If your organization operates more than one Entra tenant — for example, separate tenants for production and development environments, or tenants inherited through mergers and acquisitions — you can connect all of them to a single Nexus account. Each connected tenant is managed and displayed independently, allowing you to compare posture across tenants or run cross-tenant access reviews.

To add a second (or third, or fourth) tenant, simply repeat the connection steps above while signed into Nexus. When prompted for admin consent, make sure you're signed in with an administrator account that belongs to the tenant you're adding. All connected tenants appear under **Settings > Connected Tenants**, each with their own sync status, last-synced timestamp, and posture score.

## Disconnecting a tenant

If you need to remove a tenant from Nexus — for example, because you're decommissioning it or moving to a different Nexus organization — go to **Settings > Connected Tenants**, click the name of the tenant you want to remove, and select **Disconnect**. Nexus will immediately revoke its access token and queue the tenant's data for deletion. All synced data for that tenant is permanently removed from Nexus within 24 hours.

<Warning>
  Disconnecting a tenant permanently removes all synced data, posture history, and access review records for that tenant. This action cannot be undone. If you think you may want to reconnect the tenant in the future, consider pausing sync instead by contacting Scalio support before disconnecting.
</Warning>