How Scalio Nexus works

Scalio Nexus is a console for managing the employee lifecycle — onboarding, day‑to‑day changes and offboarding — across Microsoft 365 / Entra ID and (optionally) your on‑premises Active Directory.

What it connects to

• Microsoft Entra ID (Azure AD) — the console reads and writes your directory (users, groups, licenses and more) through Microsoft's official cloud APIs.
• Exchange Online — for mailbox tasks that Entra alone can't do (shared mailboxes, distribution lists) and for sending notification email from a tightly scoped sender.
• On‑premises Active Directory (hybrid only) — through a lightweight agent you install on a domain‑joined Windows machine. The agent makes outbound‑only connections to the console, so no inbound firewall rules are needed.

The two ways to run it

• Self‑Hosted — you run Scalio Nexus in your own environment and connect it to your Entra tenant. A guided Setup Wizard walks you through connecting Microsoft (see Installation and the Setup Wizard).
• SaaS (managed) — the vendor hosts everything; each tenant connects with one‑click admin consent. Nothing to install.

See Deployment models for a side‑by‑side comparison.

Safe by design

• Every action is tracked with an automatic undo path, so a mistake can be rolled back.
• A complete, searchable audit log records who changed what and when.
• Role‑based access controls what each administrator can see and do.
• Least‑privilege access to Microsoft — the console requests only the permissions it needs, and notification email is restricted to a single approved sender.

Live vs. demo

Until Microsoft is connected, the console runs in a safe demo/empty state — no changes reach your real tenant. Once you connect and grant admin consent, it switches to live and manages your real directory. The Setup Wizard and the connection status chips always make it clear which state you're in.