Microsoft Entra ID SSO Integration

Legale.io – Microsoft Entra SSO Integration Cybersecurity Review – Requested Information Date: August 1, 2026 This document provides the information requested as part of the cybersecurity review of the Legale.io application, regarding its Single Sign-On (SSO) integration with Microsoft Entra ID (formerly Azure Active Directory). 1. Application Name and Identifier Application (solution) name: Legale.io Identity provider: Microsoft Entra ID (Microsoft identity platform) Provider domain: login.microsoftonline.com Production application URL: https://app.legale.io The integration is implemented through two application registrations in Microsoft Entra ID, which together identify the application: Display name Application (Client) ID Registration type Purpose Legale.io SPA eb16e890-e8a1-4595-9437-b5c52cf0b163 Public client – Single-page application Handles the interactive user sign-in with Microsoft from the web frontend (MSAL.js). Legale.io Backoffice 7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc Web API – confidential client Exposes the scope consumed by the SPA; it is the audience of the access tokens accepted by the Legale.io backend API. Application ID URI (API identifier): api://7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc Redirect URI (SPA): https://app.legale.io 2. Requested Permissions All requested permissions are delegated permissions, i.e., the application acts strictly on behalf of the signed-in user. No application permissions are used. Consent is granted by the user at first sign-in, and none of the requested permissions require administrator consent. Permission / scope API Type Purpose openid Microsoft identity platform Delegated (OIDC scope) Enables SSO sign-in and the issuance of an ID token that authenticates the user’s identity. profile Microsoft identity platform Delegated (OIDC scope) Allows reading the user’s basic profile claims (e.g., display name) to identify and provision the account. email Microsoft identity platform Delegated (OIDC scope) Allows reading the user’s email address, used as the account identifier within Legale.io. User.Read Microsoft Graph Delegated Allows the application to sign in the user and read the signed-in user’s basic profile information. api://7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc/read Legale.io Backoffice (custom scope) Delegated Allows the SPA to obtain access tokens that are accepted by the Legale.io backend API, in order to call protected API endpoints on behalf of the signed-in user. 3. Authentication Method and High-Level Workflow Authentication protocol: OpenID Connect (OIDC) built on top of OAuth 2.0, using the Authorization Code Flow with PKCE. The frontend is a React single-page application using Microsoft’s official MSAL.js library; the backend is a Django application that validates the issued tokens. High-level integration workflow: Step Authentication Workflow 1 The user selects “Sign In with SSO” on the Legale.io login page: https://app.legale.io 2 The SPA opens a Microsoft login pop-up and initiates the OAuth 2.0 Authorization Code Flow with PKCE against the Microsoft identity platform: https://login.microsoftonline.com/common 3 The user authenticates against their organization’s Microsoft Entra ID tenant . The tenant’s own security policies, including MFA and Conditional Access, apply during authentication. On first use, the user consents to the permissions listed in Section 2. 4 Microsoft Entra ID returns an authorization code to the SPA, which is redeemed for an ID token and an access token scoped to the Legale.io API. Audience: api://7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc 5 The SPA includes the access token in the Authorization: Bearer header of every request to the Legale.io API. The SPA is a public client: it holds no client secret, and tokens are never exposed outside the user’s browser session. 6 The backend validates the token on every request: • Signature against Microsoft’s published signing keys • Issuer • Audience • Expiration After successful validation, the user account is created or updated locally and the request is authorized. 7 Access tokens are short-lived and are transparently renewed by MSAL without user interaction. All communication occurs exclusively over HTTPS. Please note: No client secrets or other sensitive credentials are included in this document.