The recommended order of steps when setting up NextTables from a freshly provisioned tenant — from accepting the very first administrator invitation through folders, database connections, roles, and users, to your first working table — with links to the detailed how-to article for each step, and which steps are optional or can be done later.
This article is for administrators and key users setting up a new tenant.
Prerequisites#
- A newly provisioned NextTables tenant. You (or the address named during onboarding) have received the first administrator invitation email.
- If you want to connect your own data platform: access credentials for at least one supported database — Databricks, PostgreSQL, or SAP Datasphere. If not, NextTables can store data in its own Integrated database instead, so you can start without any external platform.
📝 Note: A fresh tenant is intentionally empty — no folders, no tables, no visible database connections, and exactly one built-in role (Administrator). Email-and-password login is enabled out of the box, so nothing has to be configured before the first sign-in.
The setup sequence at a glance#
- Accept the first administrator invitation — your account, sent at provisioning
- Invite a second administrator — the single most important safeguard
- (Optional) Enable single sign-on — Microsoft or Google
- Plan and create your folder structure — the security and organisation backbone
- Connect a database — your own platform, or the Integrated database — and scope it to folders
- Create roles — who can do what, and where
- Invite your team — every invitation carries at least one role
- (Optional) Create master data objects — controlled value lists for validation
- Create your first table — or connect an existing one
- (Optional) Add row-level security — per-row access on top of roles
Steps 3 can be done at any point. Everything else builds on what comes before it: connections can only be scoped to folders that exist, invitations require roles that exist, and master data / row-level security needs a table to attach to.
Step-by-Step Instructions#
1) Accept the first administrator invitation#
When your tenant is provisioned, NextTables automatically sends an invitation to the administrator email address named during onboarding. The invitation link is valid for 365 days (subject to change).
Opening it shows a “Welcome to NextTables” page. Choose Continue with email and set a password (at least 8 characters) — single sign-on can be added later, no identity provider is needed on day one. After signing up you land in the (empty) workspace as the tenant’s first Administrator.
2) Invite a second administrator#
Never operate a NextTables tenant with only one administrator. If the sole admin loses access — locked account, offboarding, forgotten password — nobody can restore permissions or reopen access.
Open the avatar menu → Administration → Users, click Add user, and assign the Administrator role to a trusted colleague. The full flow is in How to Invite and Manage Users in NextTables.
3) (Optional) Enable single sign-on#
Under Administration → Login methods, you can enable Microsoft IDP and Google IDP alongside (or instead of) email and password. Users invited afterwards choose from whatever is enabled when they accept their invitation. See How to Enable Single Sign-On with Microsoft and Google (Identity Providers).
⚠️ Caution: At least one login method must always stay enabled, and disabling a method locks out every user who signs in with it. If you switch the tenant to SSO-only later, make sure all active users have an SSO identity whose email matches their NextTables email first.
4) Plan and create your folder structure#
Folders are more than organisation: they are the inheritance boundary for roles and the scope unit for database connections. Getting the structure roughly right before content exists is far cheaper than restructuring later. Read the folder design guidance in Introduction to Authorization in NextTables: Roles, Folder Scoping, and Row-Level Security — the short version: mirror your data domains (HR, Finance, ESG, …), put restricted areas inside their domain folder, keep the top level shallow.
Folders are created directly in the workspace: in the sidebar’s Tables tree, open the context menu and choose Create folder…. Subfolders are created the same way from a folder’s own menu (Create folder…, Rename folder…, Delete folder — a folder can only be deleted while it is empty and unused in any role).
5) Connect a database — and scope it to folders#
Open Administration → Databases and click Connect database. Two paths:
- Your own data platform: pick the Type — Databricks, SAP Datasphere, or PostgreSQL — and fill in host, port, schema, and credentials. You may need to whitelist the NextTables IP in your network first (the connection form shows it). Detailed guides: How to Create a Database Connection to Databricks, How to Create a Database Connection to PostgreSQL, How to Create a Database Connection to SAP Datasphere.
- No platform yet? Flip the Integrated database switch in the same form and NextTables stores your data in its cloud. This is a one-time choice per tenant: once created, the integrated database cannot be edited, duplicated, or deleted, and the switch disappears.
While creating the connection (or any time later), set Mapped folders. The default Site (all folders) makes the connection usable everywhere; for anything sensitive, restrict it to its matching domain folder — which is why folders come first. Details and the rules around narrowing scope later: Scoping Database Connections to Folders.
📝 Note: A connection marked Read-only connection can never host new tables — its tables can only be connected for reading. Keep at least one write-enabled connection (or the Integrated database) if business users should maintain data.
6) Create roles#
NextTables ships with exactly one role, the locked site-level Administrator. Everything else you design yourself, under Administration → Roles → Add role — a role is one or more permissions, each an Object (site, folder, or table) plus the Actions allowed on it. Permissions are additive and inherit downward; there is no deny.
Start with the read / edit / key-user archetypes on your domain folders, as described in Introduction to Authorization in NextTables: Roles, Folder Scoping, and Row-Level Security; the click-by-click flow and the full action catalog are in How to Manage Roles in NextTables.
7) Invite your team#
Open Administration → Users → Add user. Every invitation requires an email, first and last name, and at least one role — which is why roles come first. Invited users receive a personal link (valid 365 days, subject to change) and become Active when they accept and choose their login method. The full flow, including resending invitations and deactivating accounts, is in How to Invite and Manage Users in NextTables.
💡 Tip: Invite people in waves. Start with the key users who will build and curate content; invite the broader user base once the first tables are ready and verified — an invited user who lands in an empty workspace has nothing to do.
8) Create your first table#
Tables are created in the workspace, not in administration: in the sidebar’s Tables tree, open the context menu of the target folder and choose Create table…. A two-step wizard opens:
- 1 Name table: pick the Datasource (only write-enabled connections mapped to this folder — or site-wide ones — are offered), a Business name (how the table appears in NextTables), and a Technical name (how it appears in your database).
- 2 Add fields: define the columns — name, type (Text, Number, Decimal, Checkbox, Date, Time), key and required flags, and optionally a Masterdata binding for validated columns (can be done later, if none are connected yet, see step 9).
Click Finish. The table appears in the folder, ready for manual entry or file upload (drag a file onto the empty grid to import).
Already have the data in your platform? Connect the existing table instead: Administration → Tables → Connect table, pick the database, table, and target folder. For SAP Datasphere specifics see How to Connect an Existing Table from SAP Datasphere.
📝 Note: In NextTables, an “application” is not a separate object you create — it is a folder with its tables, plus the roles scoped to it. When this guide talks about your first application, it means exactly that: a domain folder, a table or two inside it, and roles that give the right people the right access.
9) (Optional) Create master data objects#
If your tables should validate entries against controlled value lists — cost centers, product codes, emission types — connect those lists as master data objects before the transactional tables that use them: Administration → Masterdata. Full walkthrough: How to Create and Use Master Data Objects in NextTables.
10) (Optional) Add row-level security#
When different users should see different rows of the same table — each subsidiary maintains its own data, each controller sees their own cost centers — add a Row-Level Security Object. It is a two-step setup: create the object under Administration → Row level security, then connect it to the table under the table’s View settings → Row level security. Click-by-click: How to Create and Use Row-Level Security Objects (RLSO) in NextTables.
Roles decide whether someone can open the table; the RLSO decides which rows they see and write. Most tenants need it on a handful of tables, not everywhere.
Putting it together#
After these steps your tenant has: two or more administrators, a folder structure that mirrors your data domains, a scoped database connection, roles on the domain folders, an invited team, and a first table — your first application. For a complete worked example that combines every layer (folders, four roles, master data, row-level security) in one realistic app, follow Tutorial: Designing a Data Maintenance App with Role-Based Access and Row-Level Security- An ESG Example.
Troubleshooting / FAQs#
Q: Do I need to set up SSO before anything else?
A: No. Email and password login is enabled out of the box, and the first administrator signs up with it. Add Microsoft or Google SSO whenever it suits — users invited afterwards will see the new options.
Q: Should I use the Integrated database or connect our own platform?
A: Connect your own platform when the data should live in your governed environment (most enterprise scenarios). Use the Integrated database to start immediately without infrastructure — but note it is a one-time, irreversible choice per tenant, and both can coexist: you can connect external platforms later at any time.
Q: Can I change the folder structure later?
A: Folders can be created, renamed, and (while empty and unused in roles) deleted at any time. But roles and connection scopes attach to folders, so restructuring a populated tenant means re-checking both — designing the structure first is much cheaper.
Q: I invited a colleague, but they cannot see the table I created. What did I miss?
A: Two things to check, in order: their role must cover the table’s folder (roles grant access; without one they see nothing), and the table’s database connection must be mapped to a folder their role covers. A connection scoped away from their folder hides its tables regardless of role.
Q: Why must roles exist before I invite users?
A: The invitation form requires at least one role per user — there is no “role-less” account. Create the roles first, then invite.
Q: The first administrator invitation was lost or expired. What now?
A: Invitation links are valid for 365 days and single-use. If the initial invitation cannot be found, contact NextTables support to have it re-issued for your tenant.
Q: How do I share my first application with the team?
A: There are no share links. Access is granted through roles: scope a role to the application’s folder, assign it to the users, and the folder and its tables appear in their workspace tree.
