> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scaliocloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Scalio Nexus Quickstart: Connect Your Entra Tenant
> Connect your Microsoft Entra ID tenant to Scalio Nexus and get your first identity posture and access governance insights in under ten minutes.
Nexus connects to your Microsoft Entra ID tenant via delegated admin consent — no agents to install and no infrastructure changes required. The entire setup is browser-based: you authorize Nexus through Microsoft's standard OAuth consent flow, Nexus performs an initial sync of your directory, and your Identity Dashboard is ready within minutes.
**Before you begin, make sure you have:**
* A Microsoft Entra ID tenant (formerly Azure Active Directory)
* A user account with **Global Administrator** or **Privileged Role Administrator** rights in that tenant — required to grant admin consent for the Microsoft Graph permissions Nexus requests
* A Scalio Nexus account — if you don't have one yet, [contact the Scalio sales team](https://scalio.cloud/contact) to get access
## Setup steps
Navigate to the [Scalio Nexus portal](https://nexus.scalio.cloud) and select **Sign in**. Use your work account — the same Microsoft identity you use for Microsoft 365 or the Azure portal. Nexus supports single sign-on via Microsoft Entra ID, so you won't need a separate password.
Once signed in, you'll land on the **Home** screen with a prompt to connect your first tenant.
From the Home screen, click **Connect Tenant**. Enter your tenant's primary domain (for example, `contoso.onmicrosoft.com`) or your Entra tenant ID (a GUID you can find in the Entra portal under **Overview**).
Click **Continue**. You'll be redirected to Microsoft's consent page, which lists the specific Microsoft Graph permissions Nexus is requesting. Review the permissions, then click **Accept** to grant admin consent on behalf of your organization. Microsoft redirects you back to Nexus automatically once consent is approved.
You must be signed in to the Microsoft consent page with an account that holds **Global Administrator** or **Privileged Role Administrator** rights in the target tenant. If you're prompted to sign in with a different account, use the **Switch account** option on the Microsoft consent page.
After consent is granted, Nexus immediately begins an initial sync of your Entra estate — users, groups, roles, service principals, and application registrations. A progress indicator on the **Tenant Setup** screen shows sync status in real time.
For most tenants this takes **2–5 minutes**. Larger directories (50,000+ objects) may take up to 15 minutes for the first sync. Subsequent incremental syncs run continuously in the background and reflect changes within seconds.
Do not close the browser tab while the initial sync is running. If the sync is interrupted, navigate back to **Settings → Tenants** and select **Retry Sync** to resume.
Once the initial sync completes, Nexus automatically takes you to your **Identity Dashboard**. You'll see a full inventory of your Entra estate alongside your organization's posture score, active risk flags, and a breakdown of identity health across users, groups, and applications.
From here you can drill into any object, launch your first access review, or navigate to **Posture Insights** to explore the specific findings Nexus has identified in your tenant.
## What Nexus reads from your tenant
Nexus requests the following Microsoft Graph API permission scopes during the admin consent step. All permissions are **read-only** — Nexus never writes to or modifies objects in your directory.
| Permission scope | What Nexus uses it for |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `User.Read.All` | Reads all user profiles, assigned licenses, sign-in activity, and account status to populate the user inventory and flag risky or stale accounts. |
| `Group.Read.All` | Reads group memberships, types, and settings to surface over-privileged groups, empty groups, and groups eligible for access reviews. |
| `Application.Read.All` | Reads app registrations, enterprise applications, and service principals to identify applications with excessive permissions or inactive credentials. |
| `Directory.Read.All` | Reads directory roles and role assignments to identify privileged accounts, standing admin access, and role assignment history. |
| `AuditLog.Read.All` | Reads Entra audit and sign-in logs to detect unusual access patterns, dormant accounts, and changes to sensitive directory objects. |
You can view and revoke Nexus's consent grant at any time from your Entra admin center under **Enterprise applications → Scalio Nexus → Permissions**.
## Next steps
Now that your tenant is connected, here are the best places to go next.
Learn how to navigate your identity inventory, filter by risk level, and investigate individual users, groups, and applications.
Set up your first access review campaign — define scope, assign reviewers, configure recurrence, and send notifications.
Understand your posture score, explore individual findings, and track remediation progress over time.
Dive deeper into the tenant connection model, manage multiple tenants, and learn how to update or revoke consent grants.