Setting up Varhugi at your company

Four roles come into play during Varhugi setup. You might be in one or more of them.

Workspace admin

The person who creates the Varhugi workspace and owns the curriculum. Usually someone from security, HR, or operations. They sign up first at varhugi.is/is/nyskra.

IT admin (you)

The person with administrator rights in Microsoft Entra ID at the company. You get a request to approve Varhugi in the tenant, and can optionally map Azure groups to Varhugi roles and allowlist email.

Department manager

Manages one department (sales, engineering, etc.) inside Varhugi after setup is done. Doesn't need any Azure rights.

Employee

Everyone else. They sign in with Microsoft, Google, or magic link and take the courses. Nothing for you to set up on their behalf.

This happens before you get involved. If nobody has created the workspace yet, someone from management or security needs to do it first.

1. Goes to varhugi.is/is/nyskra
2. Signs in with Microsoft, Google, or a magic link.
3. Enters the company name and ID number (kennitala). They become the first admin in the workspace.

If Microsoft sign-in fails with an "admin approval required" message, you've reached step 2 of this guide.

You'll receive (or have received) a link from the workspace admin starting with https://login.microsoftonline.com/.../adminconsent?client_id=... This is the admin-consent URL that grants Varhugi permission to handle Microsoft sign-in for your tenant. You don't need to navigate through Enterprise Applications or search for Varhugi — the link takes you straight to the right consent screen.

How to approve

1. Open the admin-consent URL in a browser where you're signed in as Global Admin or Application Administrator.
2. A consent screen appears, listing the permissions above and the publisher (Varhugi ehf.).
3. Click Accept.
4. You'll land on varhugi.is/is/sso-samthykki with confirmation: "Thank you — consent granted."

If you get "You don't have permission to grant consent", you need the Global Admin, Privileged Role Admin, Cloud Application Admin, or Application Admin role. Others (e.g. User Administrator) can't grant tenant-wide consent.

Email back to the workspace admin (optional)

If you approved and want to let the person who asked know, here's a template you can paste into a reply.

Hi,

I've approved Varhugi in our Entra tenant. Users with @[company].com email can now sign in at varhugi.is using Microsoft SSO without any further action from me.

The permissions I approved were basic profile only (name, email) — no access to mail, files, or any other content.

Let me know if anyone has trouble signing in.

Best,
[Your name]

Copy and paste — no special permissions needed.

After approving, a single test sign-in confirms everything is wired up.

1. Open varhugi.is/is/innskra in an incognito window.
2. Click "Sign in with Microsoft" and use your own company account.
3. You should land on /namskeid directly — no consent screen, no error.

These steps aren't required for basic functionality, but improve the experience in specific situations.