Configure Single Sign-on

Single sign-on (SSO) lets your users log in to Legalsense using their existing Microsoft Azure AD account, instead of a separate Legalsense username and password. This article explains how to configure SSO as an administrator, and how to link and manage users afterward.

Legalsense currently supports Microsoft Azure AD as an SSO provider, with more providers planned for the future.

Configuration

To set up SSO, complete the following steps:

1. Contact Legalsense Support to enable SSO for your environment; this can only be turned on by Legalsense.
2. Add a provider. Go to Settings → Security → Single Sign-on and click New Single Sign-on provider.

Enter the following information for the new provider:

The New Single Sign-On provider form in Legalsense, showing the Tenant ID, Client ID and Client secret fields.

• Tenant ID: found in your Microsoft Azure account, on the overview page under your organization's name.
• Client ID: first create a new app registration in Microsoft Azure: go to App registrations and click New registration. Choose Single tenant and Web as the redirect URL type, and enter https://yourfirmname.legalsense.nl/single_signon/microsoft_azure/callback/ as the redirect URL.

Once you've created the registration, copy its Application (client) ID into this field.

• Client secret: in Microsoft Azure, go to Client credentials and click New client secret. Copy the generated value (not the Secret ID) into this field. Important: Microsoft Azure only shows the client secret value once, immediately after you generate it. Store it somewhere secure before leaving that screen. You will also need to set an expiration date for this secret. Make sure to create a new secret before the old one expires, as you won't be able to log in with SSO once the secret expires.

Now click Save to go to the next page.

• Group: start typing the name of the Microsoft Azure group whose members can log in with SSO, and select it. Legalsense only imports the Microsoft accounts of members of this group.
• Enforce login: select this checkbox to block logging in with a Legalsense username and password for users who are linked to a Microsoft account. Users who aren't linked can still log in with their username and password. Keep this checkbox cleared to allow both methods of logging in.

3. Set up client access in Microsoft Azure. Go to API permissions, click New permission, then Microsoft Graph, then Application permissions, and select GroupMember.Read.All and User.Read.All. Remove the existing User.Read permission.

Important: When adding the permission, select Application permissions, not Delegated permissions. 4. Grant admin consent. Click the Grant admin permission for... button. In the application settings for the newly created application, you might also need to grant admin consent under Security → Permissions. Finally, indicate in Legalsense whether logging in through Microsoft Azure should be enforced for all linked users. You do this at the very last setting in Legalsense:

Important: Only an Admin user can complete this step.

All active users who aren't yet linked can still log in as usual, with a username and password.

Once you've completed the steps above and entered the correct data for the provider, click Save to finish configuring SSO.

Using SSO

Sync users

The Microsoft Azure AD SSO integration can synchronize Legalsense users to their Microsoft accounts. Before this can happen, Legalsense needs an up-to-date list of the available Microsoft accounts. This synchronization runs automatically in the background, but you can also start it manually.

Go to the configured provider and click Synchronize now.

The configured provider page in Legalsense, with the Synchronize now button highlighted.

Link users

Link Legalsense users to their Microsoft account from Users → Users.

1. Click the user you want to link.
2. Click Edit next to Microsoft Azure account.

A user's profile page in Legalsense, showing the Edit button next to the Microsoft Azure account field.

3. Select the Microsoft account the user should log in with, and click Save.

If you want to disconnect a user, repeat these steps but select the blank option instead of a Microsoft account.

You can also link users in bulk. Go to Settings → Security → Single Sign-on and open your configured Microsoft Azure provider, then click Bulk link in the top right.

The Single Sign-On provider page in Legalsense, showing the Bulk link button in the top-right corner.

Clicking this button opens a screen listing all Microsoft accounts that aren't linked to a Legalsense user yet. Legalsense suggests a matching user based on the email address. Review or complete the user for each account, then click Save.

The Users → Users overview shows an SSO column indicating whether each user is linked.

The Users overview page in Legalsense, showing the SSO column indicating which users are linked to a Microsoft account.

Log in via SSO

To log in via SSO, click Sign in with Microsoft on the login screen.

The Legalsense login screen, showing the Sign in with Microsoft button.

The first time a user does this, Microsoft shows a permission pop-up.

Click Accept. The user is then logged in via Microsoft Azure AD.

Note: Users who log in with Sign in with Microsoft aren't asked for a Legalsense two-factor authentication code. The security settings of their Microsoft account apply instead.

Troubleshooting

A user can't log in with Sign in with Microsoft

• The user sees No account: the message Your Microsoft account is not linked with any account. Please contact your administrator. means the Microsoft account isn't linked to a Legalsense user. Check that the user signed in with the right Microsoft account, and link it as described in Link users.
• The user was removed from the Microsoft Azure group: Legalsense synchronizes the group every 20 minutes and removes accounts that are no longer in it, including their link. After you add the user to the group again, click Synchronize now and link the user again.
• The user returns to the login page without a message: the Legalsense user is archived or past their end date. Check the user's status under Users → Users.

A linked user can't log in with a password

With Enforce login selected, a linked user who logs in with a username and password sees Your account is configured to log in through your Microsoft account, please use the Sign in with Microsoft button to access Legalsense. This is expected. To let one user log in with a password, unlink their Microsoft account. They can then use Forgot password? on the login page to set a password.

Nobody can log in with SSO

If every user gets an error after signing in with Microsoft, the client secret has most likely expired. Create a new client secret in Microsoft Azure and enter it on the provider in Legalsense.

Important: If all your administrators are linked to a Microsoft account and Enforce login is selected, nobody may be able to log in to change the provider. In that case, contact Legalsense Support.