Using Azure AD for onboarding users (SSO)

If your organization uses Azure for rostering, you have the option to set up an Azure integration so that whenever someone uses their Microsoft 365 login, they will automatically join your school account on ThingLink. We will also attempt to automatically determine the user's account type.

• Availability
• How to set up the integration
• What happens to users who already have a ThingLink account
• What permissions & data are granted to ThingLink

Availability

This integration is available on School & District plan as well as all paid eLearning plans.

How to set up the integration

1. As the administrator of your ThingLink account, go to the 'My school' or 'My Users' page and open the 'Settings' tab on the left
2. Enter the Microsoft 365 organization ID (also known as Active Directory tenant ID) for your organization and click the 'Save changes' button at the bottom of the page. See the linked article or contact your IT department to learn where to find the organization ID.
   
3. You will be redirected to sign in with your Microsoft account to allow ThingLink to use your organization's data. If you are an admin of your Microsoft/Azure tenancy, you can consent on behalf of your organization right here by ticking the box:
   
   If you cannot grant consent on behalf of your organization, please go back to ThingLink, reach out to your Active Directory Global Administrator and ask them to grant tenant-wide admin consent to use ThingLink.
   Another way to grant consent is to have your admin log into ThingLink with their Microsoft account. While logging in, they'll be asked to provide consent on behalf of their organization.

Whenever somebody from your Office365 tenant creates a new ThingLink account using the 'Sign in with Microsoft' button, they are automatically added to your organizational account. If we can determine their account type, they won't have to go through the registration steps. If we are unable to determine their account type, they'll have to choose their role ('Teacher' or 'Student' for School accounts). 

You can choose not to grant access to your roster data. In this case, teachers and students will be added to your School account but they'll be asked to choose between a teacher and student account.

What happens to users who've already signed up?

Those who already have an account on ThingLink and have not joined your organization yet will be prompted to do so.  Upon login, the site will show them a banner with an option to join your organization:

If they decide to join your organization, you will need to approve their request via 'My School' (or 'My Users') - 'Management requests'. 

Note that students who are part of individual teacher subscriptions will not see this prompt. However, their teacher will. If the teacher decides to join your School, their students will join automatically as well.

What permissions & data are granted to ThingLink?

ThingLink uses Graph API to receive data about your users and determine their account type. You Azure Admin can review what kind of data we are accessing at any point by going to Azure Portal - 'Enterprise apps' - 'ThingLink' - 'Permissions':

Note that we receive this data only when users sign up to ThingLink, meaning that we won't store any information about those who do not use the platform.