Skip to main content

​
Overview

Legora is moving to Legora’s global authentication so each user has one identity across Legora, no matter which region or organization they work in. As part of this change, your organization will use a dedicated login URL and updated authentication routes. To prepare for rollout, admins and IT administrators need to make the following updates:
  1. Add the new callback URLs in your identity provider and active integration settings.
  2. Whitelist the required domains on your network.
Keep all existing URLs and settings in place. These updates should be added alongside your current configuration.

​
Add callback URLs

​
Identity provider callback URLs

If your organization uses SSO, add the callback URL that matches your sign-in protocol as an allowed callback URI in your identity provider configuration:
  • https://sso.legora.com/api/oauth/saml for SAML connections
  • https://sso.legora.com/api/oauth/oidc for OpenID Connect (OIDC) connections, including Microsoft Entra ID
https://sso.legora.com is an authentication host, not a website. Opening the root address shows 404 Not Found by design. This does not mean SSO is unavailable. Configure the full callback URL that matches your sign-in protocol.
Important note: All updates should be made in addition to your existing configuration. Do not remove any existing URLs or settings at any point during this process. Where to add them depends on your provider:
  1. Okta: Add the URL for the protocol you configure for Legora to the Sign-in redirect URIs in the Legora application settings. If you are not sure which protocol you will use, add both.
  2. Microsoft Entra ID: Entra ID connections use OIDC. Add only the OIDC URL to the Redirect URIs in the Legora app registration. See Integration Overview - Entra ID Single Sign-on.
  3. Other identity providers: Add the URL for your provider’s protocol (SAML or OIDC) as an allowed callback URI, following your provider’s documentation.

​
Integration callback URLs

For each active integration, add the relevant redirect URI in that integration’s admin settings:

​
Allowlist domains

If your network restricts traffic to Legora, allowlist the following domains, for both inbound and outbound traffic as applicable to your network setup:
The Authentication migration page appears only after Legora enables self-service migration for your organization. You must also be an Admin with permission to manage authentication. If you do not see the page, contact your Legora representative or support@legora.com.
  • From the Authentication migration page: allowlist your organization’s dedicated domain. Settings > People > Authentication migration shows it as Custom URL, for example https://acme.app.legora.com. This is the only domain the page shows.
  • The same for every organization: these domains do not appear on the Authentication migration page.
    • https://login.legora.com
    • https://identity.legora.com
    • https://token.legora.com
    • https://sso.legora.com, if you use SSO
    • https://auth.legora.com
Keep your existing regional authentication domain, such as auth.eu.legora.com, allowlisted until the migration is complete. For the full list, see Legora network and domain requirements.

​
Portal and mobile app

​
Portal

If your organization invites another Legora customer to your Portal, both organizations must be on Legora’s global authentication before the invitation can work. Portal invitations to clients who do not use Legora are not affected.

​
Mobile app

Mobile app access remains unchanged. Users may need to sign in again after migration.

​
Word and Outlook Add-in

The Global Word and Outlook add-ins are for organizations that have completed authentication migration by selecting Complete migration. After Complete migration, move users to those add-ins. Install them from Microsoft AppSource. To choose the Word listing, see How do I enable the Word Add-in for users in my Legora org?. Regional and Global add-ins are separate installs. The regional add-ins stop working as soon as you select Complete migration, so prepare the Global Word and Outlook add-in deployment before you select Complete migration. For the full sequence, see Reinstall Word and Outlook add-ins. What users keep depends on where it was stored.
  • Word Assistant history, including Playbook results, is stored only in the Word add-in. Users must export it before Complete migration. See How to move your Word Add-in Assistant history to the Global Add-in. The Word add-in still offers Export now after the regional add-in stops. History that is not exported is deleted once the user switches and cannot be recovered.
  • Agent chats and Outlook Assistant history are stored in Legora and are kept.

​
Review your organization’s dedicated domain

  1. From your name on the menu, select Settings > People > Authentication migration.
  2. Review the dedicated login URL that Legora has pre-populated for your organization.
  3. If you need to change it, make the change before the migration.

​
Additional help

If you are unsure which updates apply to your organization, contact your Legora representative.