Required domains
Legora runs in four regions: EU, US, APAC, and AU. Your region is the one in your Legora address, soapp.ap.legora.com means your workspace is hosted in APAC. If you are not sure, ask your Legora representative or email support@legora.com.
Allow outbound HTTPS (TCP 443) to the domains in All regions, plus the domains in the table for your region.
The variable in each region table, such as *.eu.legora.com, already covers the other domains listed for that region. Those domains are listed individually for firewalls and proxies that cannot match wildcards.
All regions
Allow these domains whatever region hosts your workspace. They sit outside the regional wildcard, so a regional rule does not cover them.EU
Allow these domains if your workspace is hosted in the EU.US
Allow these domains if your workspace is hosted in the US.APAC
Allow these domains if your workspace is hosted in APAC.AU
Allow these domains if your workspace is hosted in Australia.Authentication migration requirements
If your organization is migrating to or already uses Legora’s global authentication, also allow HTTPS (TCP 443) to:The Authentication migration page appears only after Legora enables self-service migration for your organization. You must also be an Admin with permission to manage authentication. If you do not see the page, contact your Legora representative or support@legora.com.
Keep your regional authentication domain, such as
auth.eu.legora.com, allowed until the migration is complete.
Apply these rules to outbound traffic by default, and to inbound traffic where applicable to your network, proxy, or firewall setup.
SSO callback URLs
If your organization uses SSO, add the callback URL that matches your sign-in protocol as an allowed callback or redirect URI in your identity provider configuration:https://sso.legora.com/api/oauth/samlfor SAML connectionshttps://sso.legora.com/api/oauth/oidcfor OpenID Connect (OIDC) connections, including Microsoft Entra ID
Integration callback URLs
If your organization uses these integrations, add the relevant Legora callback URL as an allowed redirect URI in the integration’s admin settings. Keep any existing URLs in place.Document uploads
Legora uses a dedicated upload domain to make document uploads faster and more reliable, especially for larger files and large batches. When someone uploads a document, the browser sends the file directly to a secure, Legora-managed upload location for the workspace region. The product experience does not change. The upload domain:- Is only used for uploads
- Is not a website where users can browse files
- Is not a general-purpose API endpoint
- Uses HTTPS over port 443
Optional third-party domains
Depending on your organization’s configuration, Legora may also use these third-party domains.Optional integration domains
If your organization uses integrations with Legora, allow the domains required for those services.Network requirements
- Allow outbound HTTPS (TCP 443).
- If your network setup restricts inbound callback, proxy, or inspection traffic, allow the required domains inbound where applicable.
- Allow WebSocket over TLS (WSS 443) for realtime features.
- Prefer domain allowlisting over IP allowlisting, because cloud service IPs can change.
- Make sure large file uploads are not blocked or interrupted by your proxy, firewall, or inspection rules.
TLS inspection
If you use TLS inspection, make sure it does not break:- Authentication (OIDC / SSO)
- Microsoft Office add-ins
- WebSocket connections
- Large document uploads
Troubleshooting
If the Word or Outlook add-in shows “We couldn’t start…”
Make sure your firewall or proxy allows outbound HTTPS (TCP 443) toappsforoffice.microsoft.com, as well as the Legora Word Add-in domains for your region. If you use TLS inspection, exclude Microsoft Office add-in traffic so certificates are not rewritten.