Skip to main content

How to set up single sign-on (SSO) with Microsoft Entra ID (Azure Active Directory)

Set up single sign-on (SSO) for Legl with Microsoft Entra ID (Azure Active Directory), including testing and other supported providers.

Written by Shanté Simpson

Overview

Single Sign-On (SSO) allows users to log into Legl using their organisation’s existing identity provider credentials.

This guide explains how to set up SAML-based SSO with Microsoft Entra ID (formerly Azure Active Directory) and how to test the setup with Legl Support before rolling it out to all users.

Before you start

Before setting up SSO, make sure that:

  • You have admin permissions in Microsoft Entra ID

  • You can access the Microsoft Entra admin centre

  • You can download and upload XML metadata files

  • The users who will use SSO already exist in Legl and have accepted their invite

How to set up SSO with Microsoft Entra ID

Follow the steps below to configure SAML SSO for Legl using Enterprise applications in Microsoft Entra ID.

Step 1: Download the Legl SAML metadata file

  1. Go to https://account.legl.com/saml_metadata.xml.

  2. Download the XML file.

Step 2: Create a new Enterprise application in Microsoft Entra ID

  1. Open the Microsoft Entra admin centre. The Azure portal also still works and takes you to the same place.

  2. Go to Identity > Applications > Enterprise applications (or search to find it)

  3. Click New application.

  4. Select Create your own application.

  5. Name the application Legl.

  6. Make sure Integrate any other application you don’t find in the gallery (Non-gallery) is selected.

Step 3: Configure Single Sign-On

  1. Wait for the application to finish creating.

  2. Under Set up single sign on, click Get started.

  3. Select SAML.

  4. Click Upload metadata file.

  5. Upload the XML file downloaded in Step 1.

Step 4: Set the Relay State

  1. When the side panel opens, scroll to Relay State.

  2. Enter the relay state value provided by Legl Support.

  3. Click Save.

ℹ️ Tip

The relay state value is your firm’s Legl subdomain. For example, if your Legl URL is moysewhite.legl.com, enter moysewhite.

Step 5: Check the NameID claim

  1. On the SAML-based Sign-on page, go to Attributes & Claims and click Edit.

  2. Check that the Unique User Identifier (Name ID) claim is set to the user’s email address, and that the name identifier format is Email address.

  3. Confirm that the address this resolves to is the same address the user has on their Legl account.

  4. Click Save if you change anything.

ℹ️ Important

Legl matches users by their primary email address. The NameID must be set to the user’s primary email, and it must match the email address on their Legl account exactly.

If your firm uses different internal and external email domains, check this before testing. A mismatch lets users authenticate successfully in Microsoft Entra ID but return to the Legl login page instead of signing in.

Step 6: Send the Microsoft Entra ID metadata file to Legl

  1. Under Step 3 – SAML Signing Certificate, locate Federation Metadata XML.

  2. Click Download.

  3. Send the downloaded XML file to our Support team.

Step 7: Access your Legl account

  • The SSO setup is now complete.

  • You can invite users from the Settings > Team page in Legl.

  • Users will be redirected to log in using their Microsoft Entra ID credentials.

How to test SSO with Legl Support

Before migrating all users to SSO, testing is required.

  1. After sending the XML file, Legl Support will ask you to test SSO.

  2. SSO must be tested with one user account.

  3. Let Support know which account you would like to test (your own or a colleague’s).

  4. Once testing is successful, all users can be moved to SSO.

Other supported identity management tools

Legl supports any SAML-compatible identity provider.

Legl has experience supporting setup with:

If you use a different identity provider, contact our Support team and the team will assist you.

Important information

  • SSO must be tested with at least one user before full rollout

  • Microsoft Entra ID admin permissions are required to complete setup

  • The NameID must be the user’s primary email address and match their Legl account email. Legl matches users on email

  • Users must already exist in Legl and have accepted their invite. Legl does not create or update users automatically from Microsoft Entra ID

  • If you rotate the SAML signing certificate in Microsoft Entra ID, re-send the updated Federation Metadata XML to our Support team

Related Articles
Did this answer your question?