IT Admin guide: Legora’s global authentication

​

Overview

This guide is for Admin or IT administrators responsible for completing the migration to Legora’s global authentication. You’ll need work through these migration tasks in order. All updates should be made in addition to your existing configuration. Do not remove any existing URLs or settings at any point during this process.

---

​

Migration

​

How to complete the migration

This section walks you through the required updates before rollout, including identity provider settings, integration callback URLs, your dedicated domain, firewall rules, testing, user rollout, and add-in reinstall steps. Important Note: All updates should be made in addition to your existing configuration. Do not remove any existing URLs or settings at any point during this process.

​

Update your identity provider (SSO only)

1. Legora uses two separate callback URLs, one for each sign-in protocol. Add the one that matches your protocol (or both, if you’re not sure which your organization will use):
   • https://sso.legora.com/api/oauth/saml — used only for SAML connections
   • https://sso.legora.com/api/oauth/oidc — used only for OIDC connections (this is what Microsoft Entra ID uses)
2. Add the URLs in the correct place for your provider:
   • Okta: Okta can be set up for either SAML or OIDC. Add the URL matching the protocol you’re configuring for Legora (add both if you’re unsure which one you’ll end up using).
   • Microsoft Entra ID: Entra ID connections should use OIDC. Add only the OIDC callback URL to the Redirect URIs in the Legora app registration. See Integration Overview - Entra ID Single Sign-on. Legora does not support multiple SAML app registrations in the same Microsoft Entra tenant. If your organization currently uses multiple SAML apps in Entra, you’ll need to move those connections to OIDC as part of the migration.
   • Other identity providers: Add the callback URL matching your provider’s protocol (SAML or OIDC), following your provider’s documentation.
3. SAML as Identity Provider requires an additional step: Because a SAML app registration is tied to the service provider’s Entity ID, the existing app registration can’t simply be repointed at the new platform.
   1. Create a new SAML app registration in your identity provider.
   2. Add the following values to the new SAML app registration in your identity provider’s administration console:
      1. Entity ID/Audience URI/Identifier: https://sso.legora.com/
      2. ACS URL/Single Sign-On/Reply URL: https://sso.legora.com/api/oauth/saml
   3. Keep your existing SAML app untouched. It will continue to serve logins exactly as it does today until you enable the self-serve migration.
   4. If you use Microsoft Entra ID and have more than one SAML app registration for Legora in the same Entra tenant, do not create additional SAML app registrations for the migration. Move these connections to OIDC instead.

​

OpenID Connect scopes and claims

When your identity provider asks which OpenID Connect scopes Legora needs, enable:

• openid — required for OpenID Connect sign-in
• profile — provides the user’s name
• email — provides the user’s work email address

Legora expects an email address after sign-in. Given name and family name are recommended. You do not need to enable a group scope for SSO sign-in. Legora organization membership controls access. Directory sync for users and groups is configured separately. If your identity provider asks which client flow Legora uses, select a standards-based OpenID Connect client with the Authorization Code flow. Use the exact redirect URL shown in your organization’s SSO setup.

​

Update integration callback URLs

1. For each active integration, add the new URL as an allowed redirect URI in that integration’s admin settings. Keep all existing URLs in place.

​

Review your organization’s dedicated domain

1. From your name on the menu, select Settings > People > Authentication migration.
2. Review Custom URL. That is the dedicated login URL Legora has pre-populated for your organization.
3. If you need to change it, select Edit custom URL and save before you select Complete migration.

​

Update firewall rules

If your network restricts traffic to Legora, allowlist the following domains. Apply to both inbound and outbound traffic as applicable to your network setup.

1. From the Authentication migration page (Settings > People > Authentication migration), allowlist your organization’s dedicated domain. The page shows it as Custom URL, for example https://acme.app.legora.com. This is the only domain the page shows.
2. Allowlist these Legora domains as well. They are the same for every organization and do not appear on the Authentication migration page:
   1. https://login.legora.com
   2. https://identity.legora.com
   3. https://token.legora.com
   4. https://sso.legora.com, if you use SSO
   5. https://auth.legora.com
3. Keep your existing regional authentication domain, such as auth.eu.legora.com, allowlisted until the migration is complete. For the full list, see Legora network and domain requirements.

​

Test before rolling out

If you have multiple Legora organizations, repeat these steps to test the roll out for all of them.

1. Once the setup is complete, from your name on the menu, select Settings > People > Authentication migration and run these pre-migration checks.
2. On the Authentication migration page, confirm:
   • Your organization’s dedicated login URL is set.
   • For each SSO connection listed, click Run test and confirm the status shows Passed.
   • For each integration listed (iManage, SharePoint, Google Drive, where applicable), click Run test and confirm Passed.
3. We recommend that an Admin or IT administrator uses the new dedicated login URL with a small user test group to validate day-to-day workflows before you communicate the URL to the wider organization. To do this:
   • The Admin or IT administrator should sign in using the new dedicated login URL and confirm:
     • The URL loads correctly.
     • Sign-in completes end to end using the configured sign-in method, such as SSO or username and password.
     • Integrations work in real use: iManage, SharePoint, and Google Drive where applicable.
     • Share the URL with the small group so they can complete the same checks.

​

Roll out to all users

If you have multiple Legora organizations, repeat these steps to roll out for all of them. Complete migration stays unavailable until your organization’s dedicated login URL is set and every check on the Authentication migration page has passed. After Complete migration, the Authentication migration page is removed and Settings > Authentication appears, where you manage sign-in from then on. See How do I manage authentication for my organization?. Before you select Complete migration, tell users that the regional Word and Outlook add-ins will stop working, and that they must export Word Assistant history, including Playbook results. That history is stored only in the Word add-in and is lost unless exported. Keep the downloaded file somewhere secure. See How to move your Word Add-in Assistant history to the Global Add-in. Agent chats and Outlook Assistant history are stored in Legora and are kept.

1. Once you select Complete migration (organization-wide cutover):
   1. Inform your organization beforehand and complete the migration outside of working hours.
   2. Tell users how to move to the Global Word and Outlook add-ins. See Reinstall Word and Outlook add-ins.
   3. This switches your entire organization to the new dedicated login URL and can’t be undone. Old regional URLs keep working. A user who opens one signs in as usual, and Legora then forwards them to your dedicated login URL. Regional Word and Outlook add-ins stop working as soon as you select Complete migration. When a user opens a regional add-in, it shows a message that asks them to switch to the Global add-in. The Word add-in still offers Export now on that message. History that is not exported is deleted once the user switches and cannot be recovered.
   4. Share the new dedicated login URL with your users so they land there directly.
2. Follow the relevant guidance for each sign-in method:
   1. SSO users: Continue signing in through SSO. The main change is that they should use the new dedicated login URL.
   2. Email, password, and multi-factor authentication users: Will have to reset their password the first time they log in after migration. They will receive a password reset email from Legora with a subject along the lines of Reset your Legora password. That email contains a one-time code. Users enter the code, then set a new password of at least 15 characters. If they see Invalid recovery link or Could not reset password., they should start Forgot password? again and finish promptly. For the full user steps, see Why can I not log in to Legora?.
3. Note that the minimum password length has changed from 12 to 15 characters. New passwords must be at least 15 characters long.

​

Reinstall Word and Outlook add-ins

The Global Word and Outlook add-ins are for organizations that have completed authentication migration by selecting Complete migration. After Complete migration, move users to those add-ins. Regional and Global add-ins are separate installs. The regional add-ins stop working as soon as you select Complete migration, so prepare the Global Word and Outlook add-in deployment before you select Complete migration.

1. Choose the installation method for your organization:
   1. Centrally managed by IT: Install the Global Word and Outlook add-ins from Microsoft AppSource. See Outlook add-in for admins and How do I enable the Word Add-in for users in my Legora org?.
   2. User-installed: Ask users to install the new Global Word and Outlook add-ins from Microsoft AppSource.
   3. On-premises Legora Global Outlook and Word: Reinstall the add-ins with the Global Word manifest and the Global Outlook manifest.

What users keep depends on where it was stored.

• Word Assistant history, including Playbook results, is stored only in the Word add-in. Users must export it before Complete migration. See How to move your Word Add-in Assistant history to the Global Add-in. The Word add-in still offers Export now after the regional add-in stops. History that is not exported is deleted once the user switches and cannot be recovered.
• Agent chats and Outlook Assistant history are stored in Legora and are kept.

​

Mobile app access

1. After Complete migration, users must sign in to the mobile app again. On the sign-in screen, they select Global in the region menu instead of their previous region.

---

If you have questions at any stage, contact your Legora representative. They can:

• Provide manifest files for the add-ins
• Arrange a walkthrough with your team if needed

You can also reach Legora at support@legora.com.