What we process

For Microsoft Entra and Microsoft Teams for Education integrations, Elemental acts as a Data Processor under UK GDPR Article 28 for the following data from those systems:

• User profiles (student and teacher email addresses, first names and last names)
• Class rosters (class names and identifiers, teacher identifiers and student identifiers)
• Assignments (identifiers and statuses)

Our commitments on where Student Data is stored, how quickly we notify you of a breach, and how deletion and data subject requests are handled are set out in full in the Data Processing Agreement.

Permissions we request

These scopes and their associated permissions are defined and described by Microsoft and are documented at https://learn.microsoft.com/en-us/graph/permissions-reference.

Setting up

Prerequisites

• Microsoft Entra and Microsoft Teams for Education
• Whitelisting of https://elementalmusic.app, https://*.elementalmusic.app and https://cognito-idp.eu-west-2.amazonaws.com (https://auth.elementalmusic.app and https://media.elementalmusic.app should explicit subdomains be required) in any firewalls or network / device policies
• Whitelisting of *@elementalmusic.app (support@elementalmusic.app should explicit email addresses be required) in any email spam policies

Signing in

Teachers and students sign in at elementalmusic.app/sign-in using the Continue with Microsoft button, after entering their school email address.

Elemental links users to a school account based on their email domain. If your school uses multiple email domains (for example @school.org and @students.school.org), contact us so we can add them to your account. New users are set up with Student permissions and have no access to other students' data. An administrator can grant Teacher or Admin permissions from the Department page.

Authentication happens against your school's own Microsoft Entra tenant, not Elemental's. Teachers and students sign in with their existing school credentials, and their passwords are never shared with or stored by Elemental. Your school also stays in control of who can sign in (see Restricting access below).

Step-by-step guides, with short videos, are available for both signing in and creating an account:

• Signing in with Microsoft
• Creating a Microsoft Account

Granting the required permissions

A Microsoft Entra tenant administrator needs to grant Elemental the permissions listed above. They can do this by using the link below to approve these permissions on behalf of their organisation.

Alternatively, the first time a teacher opens a page that needs these permissions, such as Classes & Students or Manage Homework, Microsoft shows an administrator consent prompt. An administrator can sign in and tick Consent on behalf of your organisation so that other teachers can use the integration without further administrator involvement.

Checking it worked

Once permissions are granted, confirm that teachers can open the Classes & Students page and that the expected classes are listed. If too many classes appear, you can hide the ones you do not need.

To see the workflow teachers and students follow once connected, from assigning homework through to marks being returned to Microsoft Teams for Education, read our Sharing Homework and Marks with Microsoft Teams help article.

Restricting access to specific users and groups

By default, anyone in your tenant can sign in to Elemental. If you would rather limit access to particular staff or student groups, you can do that from Entra without changing anything in Elemental.

Start from the Cross-tenant access settings page in the Azure portal, then:

1. Open Cross-tenant access settings under External Identities, then on the Organizational settings tab choose Add organization and enter the Elemental tenant ID below.
   Elemental tenant ID90f2dd8c-5ea8-4d9f-9191-43d8122dcfb3
   
2. Elemental now appears in the table. Select the link in its Outbound access column (it will usually read Inherited from default).
3. On the B2B collaboration tab, choose Customize settings, then under Applies to select the specific users and groups that should be allowed access.

Data Protection Impact Assessments (DPIAs)

We are happy to support the completion of a Data Protection Impact Assessment (DPIA), including any security questionnaires. Our DPIA information pack and a blank template are on the Documents page, and you can reach us at privacy@elementalmusic.app.