Using Azure AD for onboarding students & teachers

If your school uses Azure for rostering, you have the option to set up an Azure integration so that whenever someone uses their Microsoft 365 login, they will automatically join your school account on ThingLink. We will also attempt to automatically determine user's account type.

• How to set up the integration
• What happens to users who already have a ThingLink account
• Allowing users to sign in with their Microsoft account
• What permissions & data are granted to ThingLink

How to set up the integration

1. As the administrator of your ThingLink school account, go to the 'My school' page and open the 'School settings' tab on the left
2. Enter the Microsoft 365 organization ID (also known as Active Directory tenant ID) for your organization and click the 'Save changes' button at the bottom of the page.
   
3. You will be redirected to sign in with your Microsoft account to allow ThingLink to use your organization's data. If you are an admin of your Microsoft/Azure tenancy, you can consent on behalf of your organization:
   
   If you cannot grant consent on behalf of your organization, please go back to ThingLink, reach out to your Active Directory Global Administrator and ask them to grant tenant-wide admin consent to use ThingLink.
   Another way to grant consent is to have your admin log into ThingLink with their Microsoft account. While logging in, they'll be asked to provide consent on behalf of their organization.

Whenever somebody from your Office365 tenant creates a new ThingLink account using the 'Sign in with Microsoft' button, they are automatically added to your school account. If we can determine their account type, they won't have to go through the registration steps. If we are unable to determine their account type, they'll have to choose between 'Student' and 'Teacher' roles. 

You can choose not to grant access to your roster data. In this case, teachers and students will be added to your School account but they'll be asked to choose between a teacher and student account.

What happens to students and teachers who've already signed up?

Those who already have an account on ThingLink and have not joined your School yet will be prompted to do so.  Upon login, the site will show them a banner with an option to join your School:

If they decide to join your School, you will need to approve their request via 'My School' - 'Management requests'. 

Note that students who are part of individual teacher subscriptions will not see this prompt. However, their teacher will. If the teacher decides to join your School, their students will join automatically as well.

What permissions & data are granted to ThingLink?

ThingLink uses Graph API to receive data about your users and determine their account type. You Azure Admin can review what kind of data we are accessing at any point by going to Azure Portal - 'Enterprise apps' - 'ThingLink' - 'Permissions':