Approving Scoutworks for work or school Microsoft accounts

If your organisation runs its email and logins through Microsoft 365, your volunteers may want to sign in to Scoutworks with their work account rather than a personal one. Most of the time this works with no setup at all. Some organisations hold new apps back until their IT team approves them, and then someone needs to do one thing in Microsoft.

This article is written for that IT administrator. If you are a leader who has hit the message about organisation accounts, send them this page.

What Scoutworks asks for#

That is the whole list. Scoutworks cannot read mailboxes, files, calendars, Teams messages, or your directory. It asks for no ongoing access either — the connection is used at the moment of sign-in and nothing is kept afterwards.

Scoutworks is registered as a multi-tenant app, so no separate setup, certificate exchange, or metadata swap is needed. There is nothing to configure on the Scoutworks side for your organisation.

When approval is needed#

Most tenants let people approve an app like this for themselves. The person sees a Microsoft consent screen once, accepts it, and is signed in.

You only need to act if someone reports one of these:

• Microsoft shows Need admin approval instead of the usual consent screen
• Scoutworks shows the message: That looks like an organisation account, which isn't enabled for Scoutworks yet

Both mean the same thing. Your tenant restricts who can approve new applications, so a user cannot accept on their own behalf.

How to approve it#

You need the Global Administrator or Privileged Role Administrator role.

1. Sign in to Microsoft with your administrator account.

2. Open this address, replacing nothing — it already carries the Scoutworks app ID:

   https://login.microsoftonline.com/organizations/adminconsent?client_id=5de9c202-66ab-4c3e-9b88-35cfb940ace8
   

   Copy codeCopiedFailed

3. Check the permissions listed on the screen. They should be the three above and nothing else.

4. Accept on behalf of your organisation.

Scoutworks then appears under Enterprise applications in the Microsoft Entra admin center, and your users can sign in without seeing a consent prompt.

If you would rather people request approval themselves as they hit it, turn on the admin consent workflow in the Entra admin center under Enterprise applications → Consent and permissions. Requests then arrive in your review queue instead of stopping the volunteer.

Limiting who can use it#

If you want only certain people to sign in this way, open Enterprise applications → Scoutworks → Properties, set Assignment required to Yes, then assign the users or group under Users and groups. Apps that require assignment always need administrator approval, so grant consent first if you have not already.

If you use Conditional Access#

Check that no policy blocks unapproved third-party applications, or requires a managed device or approved client app that a volunteer on a home laptop cannot meet. If you keep an allow-list of cloud apps, add Scoutworks to it.

Policies that require multi-factor authentication are fine. The volunteer is simply asked for their second factor by Microsoft, as they would be for any other app.

After approval, each person still links their account#

Approving the app does not create Scoutworks accounts, and it does not link anyone automatically. Microsoft does not tell us reliably which email address a work account owns, so we never match on it — every person confirms the link themselves, once:

1. Sign in to Scoutworks the usual way, with a password or a magic link.
2. Open your profile and go to the Connections tab.
3. On the Microsoft card, choose Link Microsoft account and confirm with the work account.

From then on, Sign in with Microsoft takes them straight in.

About scouts.org.uk addresses#

A scouts.org.uk address is a work account belonging to The Scout Association, not to your group or district. Only The Scout Association can approve Scoutworks for it, and they have not, so those addresses cannot be used to sign in yet. Use a personal Microsoft account, or one belonging to an organisation you administer.

What's next#

• Signing in with Microsoft — the volunteer's side of this, including linking and unlinking
• Signing In to Scoutworks — passwords, magic links, and the other sign-in options
• Two-Factor Authentication — how your group's second check works