> ## Documentation Index
> Fetch the complete documentation index at: https://support.legora.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO Integration Guide

> Set up SAML 2.0 single sign-on for an organisation on Legora’s global authentication.

## Overview

This guide is for IT administrators who connect a SAML 2.0 identity provider to Legora’s global authentication. Members then sign in to Legora with their work credentials.

The same steps apply when you select **SAML**, **ADFS**, or **PingFederate** in Legora. Microsoft Entra ID on Legora’s global authentication uses OpenID Connect. See [Integration Overview - Entra ID Single Sign-on](https://support.legora.com/en-AU/integration-overview-entra-id-single-sign-on.md).

> [!NOTE]
>
> Your organisation must use Legora’s global authentication, and your role must include **Manage authentication security**. See [How do I manage authentication for my organisation?](https://support.legora.com/en-AU/how-do-i-manage-authentication-for-my-organization.md).
>
> If your organisation has not moved yet, Legora support sets up single sign-on (SSO). Contact [support@legora.com](mailto:support@legora.com).

## How it works

You create a SAML application in your identity provider and give it Legora’s service provider details. You then enter your identity provider’s details in Legora. That exchange is what lets Legora trust the sign-in.

## Prerequisites

You need both of these before you start:

* Administrator access to your organisation’s SAML 2.0 identity provider.
* **Manage authentication security** in the Legora organisation.

## Set up the connection

Do the identity provider steps first, then the Legora steps. The service provider values are the same for every organisation on Legora’s global authentication.

### Create the SAML application

Start in your identity provider’s administration console.

1. Create a new SAML 2.0 application for Legora.
2. If the organisation already has a Legora SAML app, keep that app and create this one beside it. The migration section below says when that applies.

### Enter Legora’s service provider details

Copy these values into the new application. They do not change by region.

* **Entity ID**, **Audience URI**, or **Identifier**: `https://sso.legora.com`
* **ACS URL**, **Single Sign-On URL**, or **Reply URL**: `https://sso.legora.com/api/oauth/saml`

`https://sso.legora.com` is a sign-in service, not a website. Opening that root address shows **404 Not Found** by design. Use the full ACS URL.

After you create the connection, **ACS URL** on the connection shows the same reply URL. **Entity ID** on the connection shows your identity provider’s identifier. Enter `https://sso.legora.com` in the identity provider as Legora’s Entity ID.

Legora requires an `email` claim. `given_name` and `family_name` are recommended. Map your identity provider’s attributes to those names.

### Add the identity provider in Legora

Enter your identity provider’s details so Legora can send members to the right sign-in page.

1. From your name on the menu, select **Settings** > **People** > **Authentication**.
2. Under **SSO**, select **Add**, then choose **SAML**, **ADFS**, or **PingFederate**.
3. Enter a **Display Name**. Members see this name on the sign-in screen.
4. Enter your identity provider’s details. Use one of these:
   * **Metadata URL**: Legora fetches the sign-in endpoint and certificate from this address. This is the usual choice.
   * Or enter your identity provider’s **Entity ID**, **Sign-In Endpoint URL**, and **Signing Certificate (PEM)**.
5. Select **Create connection**. Legora opens the new connection.

**Edit** on a SAML connection changes the display name only. To change the metadata, create a new connection.

### Test and turn on the connection

Confirm the connection before members rely on it.

1. In your identity provider, assign a test user to the Legora SAML application.
2. In Legora, open the connection and select **Test connection**. A sign-in window opens.
3. Sign in with the test user. You should return to Legora.
4. Turn on **Status** so members can sign in with this connection.

If the test fails, compare the ACS URL and Entity ID in your identity provider with the values in the previous steps. Also confirm the assertion includes `email`.

## Migrating to Legora’s global authentication

Use this section only when the organisation already has a SAML app for Legora and you are moving that organisation to Legora’s global authentication. A first-time setup is finished after you turn on **Status**.

A SAML app is tied to the service provider Entity ID. You can’t point the existing app at Legora’s global authentication. Create a new SAML app with the values above. Leave the existing app unchanged until the migration is complete.

To test during the migration, from your name on the menu, select **Settings** > **People** > **Authentication migration**. Run the connection test and confirm it shows **Passed**.

Legora does not support more than one SAML app in the same Microsoft Entra tenant. Move those connections to OpenID Connect. See [Integration Overview - Entra ID Single Sign-on](https://support.legora.com/en-AU/integration-overview-entra-id-single-sign-on.md).

For integration callback URLs, firewall rules, and the rest of the move, see [IT Admin guide: Legora’s global authentication](https://support.legora.com/en-AU/it-admin-guide-legora-s-new-authentication-protocol.md).

## Troubleshooting

Start with the assertion and the two Legora URLs.

### Sign-in fails or the user is not found

Legora requires an `email` claim, and it rejects an assertion that marks the email as unverified. Confirm the identity provider sends `email`, and that `given_name` and `family_name` use those names when you send them. Also confirm the test user is assigned to the application.

### The reply URL or entity ID is rejected

The ACS URL and Entity ID in your identity provider must match the values in this guide exactly. Use `https://sso.legora.com` with no trailing slash, and use the full ACS URL `https://sso.legora.com/api/oauth/saml`.

If those checks don’t fix it, contact [support@legora.com](mailto:support@legora.com).