Students and teachers sign in to Nurture Signal with the school Microsoft account they already use. If your tenant does not allow users to consent to third-party applications themselves, the first person to try is stopped by Microsoft before they reach Signal — and so is everyone after them.
This page is for the Microsoft 365 or Entra administrator. One tenant-wide admin consent grant clears it, and it is worth doing before a class is waiting on it.
Also allowlist Nurture’s domains. If your school filters web traffic, Signal has to be allowed on the networks teachers and students use, or it loads to a blank screen even once consent is granted. See the domains to allowlist.
What your users are seeing
Instead of signing in, the student or teacher gets a Microsoft Approval required screen naming Nurture Signal, with a box asking them to type a justification for their request. The sign-in does not complete.
That screen is generated by your tenant, not by Signal. It is the tenant’s user consent setting — third-party applications need an administrator’s approval — and it has nothing to do with the join link, the session code, or anything the teacher set up. Reissuing them will not help.
Grant tenant-wide admin consent
A Global Administrator, Cloud Application Administrator or Privileged Role Administrator grants consent once, for the whole tenant.
Nurture Signal will not be listed under Enterprise applications yet — an application only appears there once your tenant has consented to it — so the grant is made by client ID, with the consent URL below.
The direct consent URL
Sign in as one of those roles and open the URL below, replacing
<school-domain> with your own tenant domain (for example, stmonicas.edu.au):
https://login.microsoftonline.com/<school-domain>/adminconsent?client_id=5bdae119-dd07-46d6-8289-b25e1832d237
Microsoft lists the permissions being requested; accept to grant consent. Nurture Signal then appears under Enterprise applications, where you can review its permissions, set who may use it, or remove it like any other application.
If someone has already requested approval
Approving a pending request grants the same tenant-wide consent, so if a user has already submitted a justification from the Approval required screen you can use that instead of the URL. In the Entra admin centre, go to Enterprise applications → Admin consent requests and approve the pending Nurture Signal request.
Once the grant is in place, the affected users sign in without the prompt.
Application details
The details your change record needs:
| Field | Value |
|---|---|
| Application (client) ID | 5bdae119-dd07-46d6-8289-b25e1832d237 |
| Publisher | Nurture |
| Tenancy | Multi-tenant, work and school accounts only |
| Redirect URI | Each deployment’s own address, so Microsoft returns the user to the
deployment that started the sign-in — for example
|
| Requested scopes |
|
| What those scopes cover | Sign in and read basic profile — the user’s name and email address.
|
| Not requested | Mail, files, calendar, directory data, or any write permission |
One grant covers every region
Signal runs at signal.gonurture.com, au.gonurture.com and
eu.gonurture.com. All three use the same Entra application, so a single
consent grant covers whichever regional host your school is on. There is
nothing to repeat per region.
The “unverified” label
The application currently shows as unverified, because Microsoft publisher verification is in progress. That label is all it affects — it does not change what the application requests or what it can access, which is the list above.
Do this before rollout
Treat the consent grant as a pre-rollout step, alongside allowlisting and anything else your tenant needs, so it is finished before a class is waiting on it.
Approving requests one at a time works as well, and Signal is usable that way — but every person who tries to sign in generates their own admin consent request, and each of them is stopped until you approve it.
Troubleshooting
Nurture Signal is not in Enterprise applications. That is expected before consent — an application is only listed there once your tenant has consented to it, so there is nothing to find and nothing to grant consent on. Use the direct consent URL above; the application appears afterwards.
Confirming which application your users are hitting. In the Entra admin centre, open the sign-in logs and filter to an affected user. The failed entry shows the Application and Application ID, so you can check them against the table above. The error is commonly AADSTS65001 — the user or administrator has not consented to use the application.
Questions your review will ask
Does this give Nurture access to our email, files or calendars? +
No. The application requests openid, profile and email — sign in, and the basic profile that carries the user’s name and email address — plus User.Read (the user’s own profile, for their photo) and offline_access (a refresh token, so users stay signed in). Mail, files, calendar, directory data and write permissions of any kind are not requested.
What changes for users after we grant consent? +
The affected users sign in without the prompt. There is nothing for a teacher or student to install, re-enter or set up afterwards.
Can we grant consent but still limit who uses Signal? +
Admin consent is tenant-wide. Who can actually use the application is a separate setting, on the enterprise application’s Properties and Users and groups tabs, once the grant has put it there — the same Entra tooling you use for any other application.
Do we need to repeat this for the Australian or European deployment? +
No. signal.gonurture.com, au.gonurture.com and eu.gonurture.com all use the same Entra application, so one grant covers the region your school is on.
Why does the app show as unverified? +
Microsoft publisher verification is in progress. It affects the label on the consent screen only, not the permissions the application requests or what it can access.
What happens if we change our mind? +
Revoke the permissions, or delete the enterprise application, in the Entra admin centre. Signing in with Microsoft then returns to the Approval required screen.