Lumious Help

For Microsoft Entra administrators

Approve Lumi for your organisation

A one-off approval in Microsoft Entra that lets your colleagues sign in to Lumi with their work accounts. It takes about a minute.

Last reviewed

Your colleagues sign in to Lumi with their Microsoft work accounts. Before anyone in your organisation can do that, Microsoft needs an administrator to approve Lumi once. This is called admin consent. You do it once, and you can undo it at any time.

You don’t need a Lumi account to approve it.

Who can approve

You need one of these Microsoft Entra roles:

If you don’t have one of these roles, forward the approval email to someone who does. Or, if your organisation has turned on admin consent requests, people can ask for approval from Microsoft’s own page; see Let people request admin approval.

Approve Lumi

You’ll find the approval link in the email you received about Lumi. The link is made for your organisation, so use the one in your email rather than one from anyone else.

  1. Open the approval link. A private (incognito) browser window is best, so you sign in with the right account.
  2. Check the address starts with https://login.microsoftonline.com/. That’s Microsoft’s own sign-in page.
  3. Sign in with your administrator account.
  4. Microsoft shows what Lumi is asking for. Check the app is called Lumi and the permissions match the list below.
  5. Select Accept.

Microsoft then sends you back to Lumi. As you haven’t signed in to Lumi yourself, you may see a Lumi sign-in error page. That’s expected: your approval was saved the moment you selected Accept.

Let the person who set up Lumi know you’ve done it. They can then invite your colleagues.

If anything on Microsoft’s page looks different from this guide (a different app name, or more permissions than listed below), don’t accept. Check with the person who set up Lumi first.

What Lumi asks for

Lumi asks for four permissions. Each one acts on behalf of a person who is signed in, and only for that person.

Permission What Microsoft calls it What Lumi uses it for
openid Sign users in Signing people in to Lumi
profile View users’ basic profile Showing each person’s name
email View users’ email address Knowing each person’s work email address
User.Read Sign in and read user profile Reading the signed-in person’s basic profile

Groups

When someone signs in, Microsoft also tells Lumi which security groups that person belongs to, as group IDs. That lets your Lumi administrators give access to a whole team by group, rather than one person at a time.

This comes from how Lumi is set up, not from an extra permission, so it isn’t shown on the approval page.

What Lumi can’t do

Approving Lumi lets people sign in. It doesn’t give Lumi access to anything else. Lumi can’t:

Approving Lumi also doesn’t give anyone access to Lumi. People still need an invitation from your Lumi administrator.

If your organisation later connects other Microsoft services to Lumi (for example, documents in SharePoint), that’s a separate app with its own approval, and you’ll be asked for it then.

“Need admin approval”

If someone tries to sign in to Lumi before it has been approved, Microsoft shows a page headed Need admin approval. It means Lumi hasn’t been approved for your organisation yet, and that person isn’t allowed to approve apps themselves.

Check it worked

  1. Go to the Microsoft Entra admin center.
  2. Open Enterprise applications. Depending on your menu, it’s under Entra ID or under Identity → Applications.
  3. Under All applications, search for Lumi and open it.
  4. Select Permissions (under Security). On the Admin consent tab you should see the four permissions listed above.

If Lumi isn’t in the list, the approval didn’t complete. Open the approval link again.

Optional: choose who can sign in

By default, anyone in your organisation who has been invited to Lumi can sign in. If you’d rather limit sign-in to certain groups at the Microsoft end as well:

  1. In Enterprise applications → Lumi → Properties, set Assignment required? to Yes and select Save.
  2. In Users and groups, add the people or groups who should be able to sign in.

Anyone not assigned will see a Microsoft error when they try to sign in, even if they have a Lumi invitation.

Remove Lumi later

You can stop sign-in to Lumi at any time from Enterprise applications → Lumi → Properties:

Either way, nobody in your organisation can sign in to Lumi until it’s turned back on. Removing the app doesn’t delete anything held in Lumi; to close your organisation’s Lumi account, contact Lumious.