> ## Documentation Index
> Fetch the complete documentation index at: https://support.legora.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integration Overview - Entra ID Single Sign-on

> Set up Entra ID single sign-on for an organization on Legora’s global authentication.

## Overview

This guide is for IT administrators who connect Microsoft Entra ID to Legora’s global authentication for single sign-on (SSO). Members then sign in to Legora with their Entra ID accounts.

You work in two places: the Microsoft Entra admin center, and **Authentication** in Legora. Entra ID uses OpenID Connect on Legora’s global authentication.

> [!NOTE]
>
> Your organization must use Legora’s global authentication, and your role must include **Manage authentication security**. See [How do I manage authentication for my organization?](https://support.legora.com/en-US/how-do-i-manage-authentication-for-my-organization.md).
>
> If your organization has not moved yet, Legora support sets up single sign-on (SSO). Contact [support@legora.com](mailto:support@legora.com). To move an existing organization, see [IT Admin guide: Legora’s global authentication](https://support.legora.com/en-US/it-admin-guide-legora-s-new-authentication-protocol.md).

## How it works

Each step names where you do it. Finish the Entra steps before you test the connection in Legora.

| Step | Where |
| - | - |
| 1. Create the app registration | Entra |
| 2. Add the redirect URI | Entra |
| 3. Create a client secret | Entra |
| 4. Add the connection details | Legora |
| 5. Assign users and groups | Entra |
| 6. Test the connection | Legora |
| 7. Enable the connection | Legora |

### Step 1: Create the app registration (in Entra)

Create an app registration in Entra that Legora uses to sign members in.

**Legora must be a non-gallery enterprise application.** Gallery applications report that they do not support SCIM, so [Directory Sync](https://support.legora.com/en-US/how-to-set-up-directory-sync-scim.md#before-you-start) provisioning stays unavailable. If yours is a gallery application, create a new app registration and use it for sign-in and provisioning.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **App registrations** and select **New registration**.
3. Fill out the form and select **Register**:
   * **Name**: A name that says what the app is for, such as “Legora SSO.”
   * **Supported account types**: Leave the default, **Accounts in this organizational directory only** (single tenant).
   * **Redirect URI**: Leave it empty for now. You add it in step 2.
4. On the app’s **Overview** page, copy these values for step 4:
   * **Application (client) ID**
   * **Directory (tenant) ID**

### Step 2: Add the redirect URI (in Entra)

Register Legora’s callback so Entra can send members back after they sign in.

1. In your app registration, go to **Authentication**.
2. Select **Add a platform**, then choose **Web**.
3. Paste this redirect URI and select **Configure**:

`https://sso.legora.com/api/oauth/oidc`

Use that URI for every organization on Legora’s global authentication. After you create the connection in step 4, **Redirect URL** on the connection shows the same value.

If Entra asks which OpenID Connect scopes to allow, enable `openid`, `profile`, and `email`. Legora needs the email address after sign-in. Given name and family name are recommended.

If this app registration already has redirect URIs from an older Legora sign-in setup, leave them in place and add the URI above. Remove the older URIs only after your organization finishes moving to Legora’s global authentication. The full task list is in [IT Admin guide: Legora’s global authentication](https://support.legora.com/en-US/it-admin-guide-legora-s-new-authentication-protocol.md).

### Step 3: Create a client secret (in Entra)

Create the secret Legora uses to connect to your app registration.

1. In your app registration, go to **Certificates & secrets** > **Client secrets** and select **New client secret**.
2. Add a description, such as “Legora SSO secret,” and choose when the secret expires.
3. Select **Add**, then copy the **Value** and save it somewhere secure. Entra shows the **Value** only once. The secret ID cannot be pasted into Legora.

Set a reminder a few days before the secret expires.

**When the client secret expires**

Create a new client secret in Entra, then update Legora:

1. From your name on the menu, select **Settings** > **People** > **Authentication**.
2. Under **SSO**, select the connection.
3. Under **Connection details**, select **Edit**.
4. Enter the new value in **Client secret**. Leave the field blank only when you want to keep the current secret.
5. Save.

You do not need a new connection for a secret renewal.

### Step 4: Add the connection details (in Legora)

Enter the values from steps 1 to 3 in Legora.

For the domain, use a domain your organization owns. In the Entra admin center, find it under **Entra ID** > **Domain names**. Use a verified domain such as `legora.com`. Skip a domain that ends in `onmicrosoft.com`.

1. From your name on the menu, select **Settings** > **People** > **Authentication**.
2. Under **SSO**, select **Add**, then choose **Entra ID**.
3. Fill in the form:
   * **Display Name**: The name members see on the sign-in screen.
   * **Domain**: Your organization’s domain.
   * **Tenant ID**: The Directory (tenant) ID from step 1.
   * **Client ID**: The Application (client) ID from step 1.
   * **Client Secret**: The secret value from step 3.
4. Select **Create connection**. Legora opens the new connection.

Check the domain, tenant ID, and client ID before you create the connection. To use different values later, create a new connection. **Edit** can change the display name, the discovery URL, and the client secret.

### Step 5: Assign users and groups (in Entra)

Choose who can sign in to Legora through Entra.

1. Open the enterprise application that Entra created for your app registration. Either select **Managed application in local directory** on the app registration’s **Overview** page, or go to **Entra ID** > **Enterprise applications** and select the app.
2. In **Properties**, choose whether every user in your directory can sign in or only users you assign. **Assignment required?** is **No** by default. Set it to **Yes** to allow only assigned users and groups.
3. If assignment is required, go to **Users and groups** and select **Add user/group**.
4. Select the users or groups who should have access to Legora, then select **Assign**.

### Step 6: Test the connection (in Legora)

Confirm the connection works before members rely on it.

1. From your name on the menu, select **Settings** > **People** > **Authentication**.
2. Under **SSO**, select the connection.
3. Select **Test connection**. A sign-in window opens.

If Microsoft asks you to approve permissions, an Entra administrator may need to grant consent before the test can finish. If the test fails, check the redirect URI, the client ID, and the client secret, then run the test again. If it still fails, contact [support@legora.com](mailto:support@legora.com).

### Step 7: Enable the connection (in Legora)

Make the connection available to members.

On the connection, turn on **Status**. Members can then sign in with Entra ID. Until you do, the connection stays set up but does not appear as a sign-in method.

***

## Who can join

Entra controls who can authenticate. Legora controls who becomes a member. You set membership on the connection, under **Auto-provision** and **Email domains**.

### Auto-provision on

When **Auto-provision** is on, Legora adds a person the first time they sign in with an email address on a listed domain.

They still need permission to authenticate in Entra. App assignment, Conditional Access, and multi-factor authentication stay in Entra.

Add at least one domain under **Email domains** before you turn **Auto-provision** on. The connection must be active. If Directory Sync is on for the connection, use Directory Sync to manage membership instead. See [Directory Sync](https://support.legora.com/en-US/how-to-set-up-directory-sync-scim.md).

### Auto-provision off

When **Auto-provision** is off, a person can still authenticate in Entra. Legora adds them only after an Admin invites them and they accept.

If they have no active membership, sign-in stops. Legora shows: “User has no active membership in any of the connection organisations.”

To grant access, allow the person in Entra and invite them in Legora. To remove access, remove them from the Entra app, or remove them from the organization in Legora.

***

## Frequently asked questions

These answers cover the sign-in problems admins report most often after the connection is on.

### What happens when a user is removed from the enterprise app in Entra?

They can no longer sign in through that app. Their Legora profile remains. If you assign them to the app again, they can sign in, as long as they are still a member or **Auto-provision** can add them.

If the organization also uses Directory Sync, deactivating or removing the user in Entra revokes their access to the organization. It does not delete their Legora profile.

### Why does a user sign in to an empty Legora account?

When **Auto-provision** is on, Legora creates the account from the email address Entra sends. If that address differs from the invitation, for example `jdoe@example.com` instead of `jane.doe@example.com`, Legora creates a separate account for the Entra address. Make the email in Entra match the address used in Legora, or contact [support@legora.com](mailto:support@legora.com).

### Why can’t someone finish signing in?

This usually means **Auto-provision** is off and the person has not been invited, or their membership was removed. Legora shows: “User has no active membership in any of the connection organisations.”

Invite them in Legora, or turn on **Auto-provision** for their email domain. They also need access to the Legora app in Entra.

### We have several domains, but SSO does not start for all of them

Add each domain under **Email domains** on the connection. Also include those domains in the organization’s allowed domains. From your name on the menu, select **Settings** > **People** > **Authentication**. Under **Restrictions**, select **Approved email domains**, then edit **Allowed domains**.

With one SSO connection, Legora can route sign-in with the organization’s allowed domains. With more than one connection, only domains on a connection that has **Auto-provision** turned on are used to choose that connection.

## Additional resources

These pages cover the rest of sign-in setup, and Microsoft’s app registration steps.

* [How do I manage authentication for my organization?](https://support.legora.com/en-US/how-do-i-manage-authentication-for-my-organization.md)
* [IT Admin guide: Legora’s global authentication](https://support.legora.com/en-US/it-admin-guide-legora-s-new-authentication-protocol.md)
* [Microsoft identity platform app registration](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)