Skip to content

Getting Started

This is the fastest path from a fresh install to a connected, working Scalio Nexus console. Pick the section that matches your deployment. If you are unsure which model you have, see Deployment models.

Before you start (both modes)

You will need:

  • An account that can sign in to the console as an administrator.
  • A Microsoft Global Administrator (or Privileged Role Administrator) available to grant admin consent once.
  • For Hybrid deployments: the on‑premises agent installed and reporting connected (see Operation mode).

The whole first‑run flow is driven by the Setup Wizard, which opens automatically after your first admin login while setup is incomplete. You can re‑open it at any time (see below).

A. First steps — Self‑Hosted

You run the container yourself and connect it to your own Entra ID tenant.

  1. Sign in as the initial admin and let the Setup Wizard open (or open Settings → Microsoft 365, choose Assistant mode, and click Start Wizard).
  2. Step 1 — Operation mode. Choose Hybrid (cloud + on‑prem AD) or Cloud‑Only. Hybrid needs the on‑prem agent connected.
  3. Step 2 — Directory access (Microsoft Graph). In Assistant mode the guided card does the work:
  4. Generate the certificate (app‑generated, self‑signed, validity capped at ≤ 729 days).
  5. Copy or download the PowerShell bootstrap script and run it once in your tenant — it creates the app registration with the required permissions, redirect URI and certificate.
  6. Click Grant admin consent (1‑click) and approve on the Microsoft screen. The step turns green on its own once Graph is reachable and the wizard auto‑advances. Prefer to do it by hand? Switch Settings → Microsoft 365 to Manual and enter Tenant ID / Client ID + upload a certificate yourself. See Connection — Assistant vs Manual and Certificates.

    The Graph step is a hard gate — you cannot continue until Graph is actually connected. Missing individual permissions are shown as a non‑blocking warning.

  7. Step 3 — Single sign‑on (optional). Enable "Sign in with Microsoft"; you can turn it on/off later.
  8. Step 4 — Exchange Online (optional). Assign the app the Exchange Administrator role once so it can create a scoped send policy, then downgrade to Exchange Recipient Administrator (least privilege). You may Finish now and complete Exchange later.
  9. Finish setup. The banner clears. If Cloud Sync is in use it is auto‑detected and on‑demand provisioning is enabled for you (see Cloud Sync).

Re‑open the wizard later: Settings → Microsoft 365 → Assistant → Start Wizard.

B. First steps — SaaS (managed)

The vendor hosts the app; there is no certificate to generate or upload and no app registration to create — you only grant consent against the central vendor application.

  1. Sign in. The first person to sign in with Microsoft SSO is promoted to admin automatically; the Setup Wizard opens after login.
  2. Step 1 — Operation mode. Choose Hybrid or Cloud‑Only.
  3. Step 2 — Directory access. Click Grant admin consent and approve on the Microsoft screen. The step turns green automatically (the wizard polls for consent) and auto‑advances.
  4. Step 3 — Single sign‑on. SSO is already available; confirm the default role for new SSO users.
  5. Step 4 — Exchange Online. Assign the vendor app the Exchange Administrator role once — Exchange Online runs on the central vendor certificate, so there is nothing to upload. Downgrade to Exchange Recipient Administrator afterwards.
  6. Finish setup.

Everything after consent lives in one place: Settings → Microsoft 365 → "Microsoft Entra Connection" card — Grant/Re‑check, a Directory/SSO/Exchange status list, the auto‑detected organization identity, a Test connection button, and a Graph credential badge. Full detail: Setup — SaaS (managed) (and the developer reference docs/SAAS_SSO.md in the repository).

After setup — verify it works

  • Settings → Microsoft 365 → Test connection (SaaS) or Test connection (Self‑Hosted) should report a successful Graph token.
  • Open the Dashboard — user/group counts should populate once the first directory sync runs.
  • Send a test notification (Settings → Channels → Send test message / Send test email).
  • Configure notifications and per‑event routing: Notifications.

Where to go next

I want to… Guide
Understand the two deployment models Deployment models
See the whole first‑run flow in detail Setup Wizard
Connect Graph + Exchange Online Microsoft connection
Add admins & define roles Admins, roles & settings
Onboard my first employee User Guide → Common tasks
Fix a connection problem Troubleshooting