Single sign-on (SSO) with Microsoft Entra ID in Legale
Legale lets your users sign in with their Microsoft work account through single sign-on (SSO) with Microsoft Entra ID, formerly Azure Active Directory. They use their organization’s credentials and, when they sign in, the security policies you already have in place apply, such as multi-factor authentication (MFA) and conditional access. This guide summarizes what your IT or security team needs to review.
What your organization gains with SSO
- One sign-in: users access Legale with their organization’s Microsoft account.
- Your policies, always: MFA, conditional access and the other rules in your Entra ID tenant apply at authentication.
- Authentication happens at Microsoft: users enter their credentials on Microsoft’s sign-in page, and Legale receives tokens, not passwords.
- Accounts kept up to date: on sign-in, the user’s account is created or updated in Legale.
How sign-in works
- The user chooses Sign In with SSO on the Legale sign-in page.
- A Microsoft sign-in window opens.
- The user authenticates in their organization’s Microsoft Entra ID tenant, with the policies configured there. The first time, they accept the permissions the application requests.
- Microsoft returns a code that is exchanged for an ID token and an access token for the Legale API.
- Every request to the Legale API carries that access token.
- Legale validates the token on every request: signature, issuer, audience and expiry. It then creates or updates the user’s account and authorizes the request.
- Access tokens are short-lived and renew automatically, without the user having to do anything.
Permissions the application requests
All of them are delegated permissions: the application acts only on behalf of the signed-in user. It doesn’t use application permissions, and none of them require admin consent; users accept them the first time they sign in.
- openid: enables sign-in and issues the token that confirms the user’s identity.
- profile: reads basic profile data, such as the name, to identify and create the account.
- email: reads the email address, which Legale uses as the account identifier.
- User.Read (Microsoft Graph): signs the user in and reads their basic profile.
- read, a permission defined by the Legale API: allows obtaining access tokens that the Legale API accepts.
Technical details for your IT team
- Protocol: OpenID Connect over OAuth 2.0, using the authorization code flow with PKCE.
- Identity provider: the Microsoft identity platform (login.microsoftonline.com).
- Two app registrations in Microsoft Entra ID: a single-page application for browser sign-in, using Microsoft’s official MSAL.js library, and a web API that defines the permission that application consumes.
- Public client: the browser application stores no client secrets, and tokens never leave the user’s browser session.
- Encryption: all communication uses HTTPS.
The application identifiers and the redirect URL are in the help center guide Microsoft Entra ID SSO Integration, prepared for cybersecurity reviews.
Frequently asked questions
Does a Microsoft administrator have to approve the permissions?
The permissions Legale requests don’t require admin consent. If your organization restricts user consent in Entra ID, your IT team can review it with the technical guide.
Do our MFA and conditional access policies apply?
Yes. They apply while the user authenticates in your organization’s Entra ID tenant.
Does Legale see my users’ Microsoft passwords?
No. Users authenticate on Microsoft’s page, and Legale only receives the tokens Microsoft issues.
What happens when a token expires?
It renews automatically, without the user having to sign in again.
If you want to enable SSO with Microsoft Entra ID for your organization, contact us and we’ll review it with your IT team.