--- title: 'Granting Entra admin consent for Nurture Signal' description: 'Why a Microsoft sign-in to Nurture Signal can stop at an Approval required screen, and how a school Entra administrator grants tenant-wide admin consent once.' canonical: 'https://www.gonurture.com/docs/it-admins/microsoft-entra-admin-consent' siteGuide: 'https://www.gonurture.com/llms.txt' --- [← All IT admin guides](https://www.gonurture.com/docs/it-admins.md) Why a Microsoft sign-in to Nurture Signal can stop at an Approval required screen, and how a school Entra administrator grants tenant-wide admin consent once. Students and teachers sign in to Nurture Signal with the school Microsoft account they already use. If your tenant does not allow users to consent to third-party applications themselves, the first person to try is stopped by Microsoft before they reach Signal — and so is everyone after them. This page is for the Microsoft 365 or Entra administrator. One tenant-wide admin consent grant clears it, and it is worth doing before a class is waiting on it. **Also allowlist Nurture’s domains.** If your school filters web traffic, Signal has to be allowed on the networks teachers and students use, or it loads to a blank screen even once consent is granted. See [the domains to allowlist](https://www.gonurture.com/docs/it-admins/allowlisting.md). ## What your users are seeing Instead of signing in, the student or teacher gets a Microsoft **Approval required** screen naming **Nurture Signal**, with a box asking them to type a justification for their request. The sign-in does not complete. That screen is generated by your tenant, not by Signal. It is the tenant’s user consent setting — third-party applications need an administrator’s approval — and it has nothing to do with the join link, the session code, or anything the teacher set up. Reissuing them will not help. ## Grant tenant-wide admin consent A **Global Administrator**, **Cloud Application Administrator** or **Privileged Role Administrator** grants consent once, for the whole tenant. Nurture Signal will not be listed under **Enterprise applications** yet — an application only appears there once your tenant has consented to it — so the grant is made by client ID, with the consent URL below. ### The direct consent URL Sign in as one of those roles and open the URL below, replacing `` with your own tenant domain (for example, `stmonicas.edu.au`): Admin consent URL Copy https://login.microsoftonline.com//adminconsent?client\_id=5bdae119-dd07-46d6-8289-b25e1832d237 Microsoft lists the permissions being requested; accept to grant consent. Nurture Signal then appears under **Enterprise applications**, where you can review its permissions, set who may use it, or remove it like any other application. ### If someone has already requested approval Approving a pending request grants the same tenant-wide consent, so if a user has already submitted a justification from the **Approval required** screen you can use that instead of the URL. In the Entra admin centre, go to **Enterprise applications → Admin consent requests** and approve the pending **Nurture Signal** request. Once the grant is in place, the affected users sign in without the prompt. ## Application details The details your change record needs: | Field | Value | | --- | --- | | Application (client) ID | `5bdae119-dd07-46d6-8289-b25e1832d237` | | Publisher | Nurture | | Tenancy | Multi-tenant, work and school accounts only | | Redirect URI | Each deployment’s own address, so Microsoft returns the user to the deployment that started the sign-in — for example `https://au.gonurture.com/api/auth/callback/microsoft` | | Requested scopes | `openid`, `profile`, `email`, `User.Read`, `offline_access` | | What those scopes cover | Sign in and read basic profile — the user’s name and email address. `User.Read` reads the signed-in user’s own profile, used for their profile photo; `offline_access` issues a refresh token | | Not requested | Mail, files, calendar, directory data, or any write permission | ## One grant covers every region Signal runs at `signal.gonurture.com`, `au.gonurture.com` and `eu.gonurture.com`. All three use the same Entra application, so a single consent grant covers whichever regional host your school is on. There is nothing to repeat per region. ## The “unverified” label The application currently shows as **unverified**, because Microsoft publisher verification is in progress. That label is all it affects — it does not change what the application requests or what it can access, which is the list above. ## Do this before rollout Treat the consent grant as a pre-rollout step, alongside allowlisting and anything else your tenant needs, so it is finished before a class is waiting on it. Approving requests one at a time works as well, and Signal is usable that way — but every person who tries to sign in generates their own admin consent request, and each of them is stopped until you approve it. ## Troubleshooting **Nurture Signal is not in Enterprise applications.** That is expected before consent — an application is only listed there once your tenant has consented to it, so there is nothing to find and nothing to grant consent on. Use the direct consent URL above; the application appears afterwards. **Confirming which application your users are hitting.** In the Entra admin centre, open the **sign-in logs** and filter to an affected user. The failed entry shows the **Application** and **Application ID**, so you can check them against the table above. The error is commonly **AADSTS65001** — the user or administrator has not consented to use the application. ## Questions your review will ask **Does this give Nurture access to our email, files or calendars? +** No. The application requests openid, profile and email — sign in, and the basic profile that carries the user’s name and email address — plus User.Read (the user’s own profile, for their photo) and offline\_access (a refresh token, so users stay signed in). Mail, files, calendar, directory data and write permissions of any kind are not requested. **What changes for users after we grant consent? +** The affected users sign in without the prompt. There is nothing for a teacher or student to install, re-enter or set up afterwards. **Can we grant consent but still limit who uses Signal? +** Admin consent is tenant-wide. Who can actually use the application is a separate setting, on the enterprise application’s Properties and Users and groups tabs, once the grant has put it there — the same Entra tooling you use for any other application. **Do we need to repeat this for the Australian or European deployment? +** No. signal.gonurture.com, au.gonurture.com and eu.gonurture.com all use the same Entra application, so one grant covers the region your school is on. **Why does the app show as unverified? +** Microsoft publisher verification is in progress. It affects the label on the consent screen only, not the permissions the application requests or what it can access. **What happens if we change our mind? +** Revoke the permissions, or delete the enterprise application, in the Entra admin centre. Signing in with Microsoft then returns to the Approval required screen. [← All IT admin guides](https://www.gonurture.com/docs/it-admins.md) Make feedback matter ## Rolling Signal out to classes? Our team will confirm the consent grant has landed in your tenant and check a test session before a class relies on it. [Book a demo](https://www.gonurture.com/request-demo.md)