legora.com domains, and your workspace runs in one region.
Required domains
Allow outbound HTTPS (TCP 443) to the domains in Global domains, plus the domains in the table for your region.Global domains
Allow these domains whatever region hosts your workspace. They sit outside the regional wildcard, so a regional rule does not cover them.Regional domains
Legora runs in four regions: EU, US, APAC, and AU. Your region is the one in your Legora address, soapp.ap.legora.com means your workspace is hosted in APAC. If you are not sure, ask your Legora representative or email support@legora.com.
The wildcard in each region table, such as *.eu.legora.com, already covers the other domains listed for that region. Those domains are listed individually for firewalls and proxies that cannot match wildcards.
EU
Allow these domains if your workspace is hosted in the EU.US
Allow these domains if your workspace is hosted in the US.APAC
Allow these domains if your workspace is hosted in APAC.AU
Allow these domains if your workspace is hosted in Australia.Callback URLs
Add these URLs to your identity provider and integration settings so sign-in and integrations can return users to Legora.SSO callback URLs
If your organization uses SSO, add the callback URL that matches your sign-in protocol as an allowed callback or redirect URI in your identity provider configuration:https://sso.legora.com/api/oauth/samlfor SAML connectionshttps://sso.legora.com/api/oauth/oidcfor OpenID Connect (OIDC) connections, including Microsoft Entra ID
Integration callback URLs
If your organization uses these integrations, add the relevant Legora callback URL as an allowed redirect URI in the integration’s admin settings. Keep any existing URLs in place.Document uploads
Legora uses a dedicated upload domain to make document uploads faster and more reliable, especially for larger files and large batches. When someone uploads a document, the browser sends the file directly to a secure, Legora-managed upload location for the workspace region. The product experience does not change. The upload domain:- Is only used for uploads
- Is not a website where users can browse files
- Is not a general-purpose API endpoint
- Uses HTTPS over port 443
Optional third-party domains
Depending on your organization’s configuration, Legora may also use these third-party domains.Optional integration domains
If your organization uses integrations with Legora, allow the domains required for those services.Network requirements
- Allow outbound HTTPS (TCP 443).
- If your network setup restricts inbound callback, proxy, or inspection traffic, allow the required domains inbound where applicable.
- Allow WebSocket over TLS (WSS 443) for realtime features.
- Prefer domain allowlisting over IP allowlisting, because cloud service IPs can change.
- Make sure large file uploads are not blocked or interrupted by your proxy, firewall, or inspection rules.
TLS inspection
If you use TLS inspection, make sure it does not break:- Authentication (OIDC / SSO)
- Microsoft Office add-ins
- WebSocket connections
- Large document uploads
Legacy regional authentication
Some organizations still sign in through a regional authentication domain and use the regional Word and Outlook add-ins. If your organization does, also allow these domains for your region.
Also allow
auth.legora.com, the legacy authentication domain.
If your organization is moving off regional authentication, keep these domains allowed alongside the global domains until the move is complete. For the steps, see IT Admin guide: Legora’s global authentication.
Troubleshooting
If something does not work, open connectivity.legora.com first. The page shows which connections your network blocks. Then use the matching section below.If the Word or Outlook add-in shows “We couldn’t start…”
Make sure your firewall or proxy allows outbound HTTPS (TCP 443) toappsforoffice.microsoft.com and the Word and Outlook Add-in domains in Global domains. If you use TLS inspection, exclude Microsoft Office add-in traffic so certificates are not rewritten.