Sign in with Microsoft (Entra ID)

People on your team can sign in with Continue with Microsoft instead of an email code. NextSDS is a multi-tenant app in Microsoft Entra ID. Your organisation does not have to register anything. An Entra administrator approves the NextSDS app once, and from then on your users sign in with their work account.

NextSDS asks for two permissions: View users' basic profile and Maintain access to data you have given it access to. The second one only keeps the user signed in. NextSDS cannot read mail, files or your directory.

Before you start

• You need someone with Entra admin rights who can grant admin consent: a Global Administrator, Cloud Application Administrator or Application Administrator.
• Each person must already be added to your team in NextSDS. See Who gets access.

1. Request access from NextSDS

1. Open the NextSDS login page and select Continue with Microsoft.
2. Sign in with your work account.
3. Most organisations do not let users approve apps themselves. In that case Microsoft shows Approval required. Enter a reason and select Request approval.

This sends a request to your Entra administrators. Depending on how your tenant is set up, they may also get an email about it.

2. Approve the request in Entra ID

1. Sign in to the Azure portal and open Microsoft Entra ID. The Entra admin center has the same menus.
2. Under Manage, select Enterprise applications.
3. In the left menu, open Activity → Admin consent requests. The Overview page also shows a card with the number of requests awaiting approval.
4. On the My Pending tab, select NextSDS. The details panel opens on the right.
5. Select Review permissions and consent, check the permissions, then select Accept.

The request leaves the pending list and NextSDS now appears under Enterprise applications → All applications.

3. Optional: limit which accounts can sign in

By default, anyone in your tenant can sign in to NextSDS with Microsoft once consent is granted. They still need to be a member of a NextSDS team to see anything. To restrict sign-in to named people or groups:

1. In Enterprise applications, open NextSDS.
2. Under Properties, set Assignment required? to Yes and save.
3. Under Users and groups, select Add user/group.
4. Under Users and groups, select None Selected, search for the users or groups, tick them and choose Select. Leave the role on Default Access.
5. Select Assign.

Anyone who is not assigned is blocked by Microsoft before they reach NextSDS.

4. Sign in

Go back to the NextSDS login page and select Continue with Microsoft. Signing in now goes straight to your NextSDS dashboard without asking for approval.

Who gets access

Approving NextSDS in Entra ID does not give anyone access to your team's data. NextSDS does not sync users or groups from Entra ID. Access is controlled in NextSDS:

• A team admin adds each person's email address in Users and gives them a role.
• The email address must be the same one the person uses to sign in with Microsoft.

When someone leaves and you disable their Microsoft account, they can no longer sign in with Microsoft or receive email login codes. That cuts off their access to NextSDS too. To remove them from your team completely, delete them in Users.

Workers who use QR codes and the Safety Portal do not sign in, so they need no account in Entra ID or NextSDS.