Integration Overview - Entra ID Single Sign-on

​

Overview

This guide is for IT administrators who connect Microsoft Entra ID to Legora’s global authentication for single sign-on (SSO). Members then sign in to Legora with their Entra ID accounts. You work in two places: the Microsoft Entra admin center, and Authentication in Legora. Entra ID uses OpenID Connect on Legora’s global authentication.

​

How it works

Each step names where you do it. Finish the Entra steps before you test the connection in Legora.

​

Step 1: Create the app registration (in Entra)

Create an app registration in Entra that Legora uses to sign members in.

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > App registrations and select New registration.
3. Fill out the form and select Register:
   • Name: A name that says what the app is for, such as “Legora SSO.”
   • Supported account types: Leave the default, Accounts in this organizational directory only (single tenant).
   • Redirect URI: Leave it empty for now. You add it in step 2.
4. On the app’s Overview page, copy these values for step 4:
   • Application (client) ID
   • Directory (tenant) ID

​

Step 2: Add the redirect URI (in Entra)

Register Legora’s callback so Entra can send members back after they sign in.

1. In your app registration, go to Authentication.
2. Select Add a platform, then choose Web.
3. Paste this redirect URI and select Configure:

https://sso.legora.com/api/oauth/oidc Use that URI for every organization on Legora’s global authentication. After you create the connection in step 4, Redirect URL on the connection shows the same value. If Entra asks which OpenID Connect scopes to allow, enable openid, profile, and email. Legora needs the email address after sign-in. Given name and family name are recommended. If this app registration already has redirect URIs from an older Legora sign-in setup, leave them in place and add the URI above. Remove the older URIs only after your organization finishes moving to Legora’s global authentication. The full task list is in IT Admin guide: Legora’s global authentication.

​

Step 3: Create a client secret (in Entra)

Create the secret Legora uses to connect to your app registration.

1. In your app registration, go to Certificates & secrets > Client secrets and select New client secret.
2. Add a description, such as “Legora SSO secret,” and choose when the secret expires.
3. Select Add, then copy the Value and save it somewhere secure. Entra shows the Value only once. The secret ID cannot be pasted into Legora.

Set a reminder a few days before the secret expires. When the client secret expires Create a new client secret in Entra, then update Legora:

1. From your name on the menu, select Settings > People > Authentication.
2. Under SSO, select the connection.
3. Under Connection details, select Edit.
4. Enter the new value in Client secret. Leave the field blank only when you want to keep the current secret.
5. Save.

You do not need a new connection for a secret renewal.

​

Step 4: Add the connection details (in Legora)

Enter the values from steps 1 to 3 in Legora. For the domain, use a domain your organization owns. In the Entra admin center, find it under Entra ID > Domain names. Use a verified domain such as legora.com. Skip a domain that ends in onmicrosoft.com.

1. From your name on the menu, select Settings > People > Authentication.
2. Under SSO, select Add, then choose Entra ID.
3. Fill in the form:
   • Display Name: The name members see on the sign-in screen.
   • Domain: Your organization’s domain.
   • Tenant ID: The Directory (tenant) ID from step 1.
   • Client ID: The Application (client) ID from step 1.
   • Client Secret: The secret value from step 3.
4. Select Create connection. Legora opens the new connection.

Check the domain, tenant ID, and client ID before you create the connection. To use different values later, create a new connection. Edit can change the display name, the discovery URL, and the client secret.

​

Step 5: Assign users and groups (in Entra)

Choose who can sign in to Legora through Entra.

1. Open the enterprise application that Entra created for your app registration. Either select Managed application in local directory on the app registration’s Overview page, or go to Entra ID > Enterprise applications and select the app.
2. In Properties, choose whether every user in your directory can sign in or only users you assign. Assignment required? is No by default. Set it to Yes to allow only assigned users and groups.
3. If assignment is required, go to Users and groups and select Add user/group.
4. Select the users or groups who should have access to Legora, then select Assign.

​

Step 6: Test the connection (in Legora)

Confirm the connection works before members rely on it.

1. From your name on the menu, select Settings > People > Authentication.
2. Under SSO, select the connection.
3. Select Test connection. A sign-in window opens.

If Microsoft asks you to approve permissions, an Entra administrator may need to grant consent before the test can finish. If the test fails, check the redirect URI, the client ID, and the client secret, then run the test again. If it still fails, contact support@legora.com.

​

Step 7: Enable the connection (in Legora)

Make the connection available to members. On the connection, turn on Status. Members can then sign in with Entra ID. Until you do, the connection stays set up but does not appear as a sign-in method.

---

​

Who can join

Entra controls who can authenticate. Legora controls who becomes a member. You set membership on the connection, under Auto-provision and Email domains.

​

Auto-provision on

When Auto-provision is on, Legora adds a person the first time they sign in with an email address on a listed domain. They still need permission to authenticate in Entra. App assignment, Conditional Access, and multi-factor authentication stay in Entra. Add at least one domain under Email domains before you turn Auto-provision on. The connection must be active. If Directory Sync is on for the connection, use Directory Sync to manage membership instead. See Directory Sync.

​

Auto-provision off

When Auto-provision is off, a person can still authenticate in Entra. Legora adds them only after an Admin invites them and they accept. If they have no active membership, sign-in stops. Legora shows: “User has no active membership in any of the connection organisations.” To grant access, allow the person in Entra and invite them in Legora. To remove access, remove them from the Entra app, or remove them from the organization in Legora.

---

​

Frequently asked questions

These answers cover the sign-in problems admins report most often after the connection is on.

​

What happens when a user is removed from the enterprise app in Entra?

They can no longer sign in through that app. Their Legora profile remains. If you assign them to the app again, they can sign in, as long as they are still a member or Auto-provision can add them. If the organization also uses Directory Sync, deactivating or removing the user in Entra revokes their access to the organization. It does not delete their Legora profile.

​

Why does a user sign in to an empty Legora account?

When Auto-provision is on, Legora creates the account from the email address Entra sends. If that address differs from the invitation, for example jdoe@example.com instead of jane.doe@example.com, Legora creates a separate account for the Entra address. Make the email in Entra match the address used in Legora, or contact support@legora.com.

​

Why can’t someone finish signing in?

This usually means Auto-provision is off and the person has not been invited, or their membership was removed. Legora shows: “User has no active membership in any of the connection organisations.” Invite them in Legora, or turn on Auto-provision for their email domain. They also need access to the Legora app in Entra.

​

We have several domains, but SSO does not start for all of them

Add each domain under Email domains on the connection. Also include those domains in the organization’s allowed domains. From your name on the menu, select Settings > People > Authentication. Under Restrictions, select Approved email domains, then edit Allowed domains. With one SSO connection, Legora can route sign-in with the organization’s allowed domains. With more than one connection, only domains on a connection that has Auto-provision turned on are used to choose that connection.

​

Additional resources

These pages cover the rest of sign-in setup, and Microsoft’s app registration steps.

• How do I manage authentication for my organization?
• IT Admin guide: Legora’s global authentication
• Microsoft identity platform app registration