Allowlisting URLs for Nurture

School networks filter the web, and they should. But a filter that has never heard of Nurture can quietly break it: a tab in Teams or Canvas that stays blank, a Signal session that never loads for students, or a join screen that spins forever on student devices while working fine on staff Wi-Fi.

This page is for whoever manages your school’s web filter or firewall — Smoothwall, Linewize, Lightspeed, FortiGuard, or whatever your network runs. Which Nurture domains to allow depends on the region your school is hosted in. Allow the every-region list plus your region’s complete list below, on both staff and student network policies, and Nurture works everywhere on your network, including student devices.

All Nurture traffic is HTTPS on port 443 — there are no unusual ports to open. If your filter performs SSL inspection and Nurture loads but live sessions drop, exempting the Nurture domains from inspection is the first thing to try.

Domains to allow per region

Every region

The lists below are the complete set of hosts Nurture Signal needs for each deployment. Find your region and allow the whole block — every entry, not just the ones that look new — on both staff and student policies. A school that is missing one entry sees exactly the same symptom as a school that is missing all of them.

🌐 Global (default)

🇦🇺 Australia

🇪🇺 Europe

If Nurture runs inside your own Microsoft tenant — an on-tenant deployment — some hosts are unique to your tenant and are not listed here. We send that list to your central IT team directly; write to us if you need it again.

Endpoints you likely already allow

Nurture signs people in with the account the school already runs, so its sign-in flow touches your identity provider’s endpoints, not new ones. Schools running Microsoft 365 already allow login.microsoftonline.com and Microsoft’s published endpoint list; schools on Canvas already allow their Canvas instance’s domains.

Allowing those endpoints is not the same as your tenant permitting the sign-in. If students or teachers reach a Microsoft Approval required screen instead of Nurture Signal, that is your tenant’s consent setting rather than your filter — see granting Entra admin consent.

Tutorial videos on this site are hosted on YouTube, so they play only where the school network allows YouTube. Nothing in the product itself depends on it.

How to test

The quickest proof is the real path, on the filtered network, on a student device:

1. Open app.gonurture.com in a browser on the school network — the sign-in page should load.
2. Have a teacher start a Signal session and a student join it from a student device on the student network.
3. Have the student submit a response and confirm the teacher sees it arrive live.
4. If teachers launch Nurture from Teams or Canvas, open it from there too — the tab should load, not sit blank.

If staff Wi-Fi works and the student network does not, the difference is almost always a filtering policy applied only to student traffic.

Still blocked?

Write to hello@gonurture.com with the filtering product you use and what you see — a blank tab, a spinner, a block page — and we will pinpoint the entry your allowlist is missing.