Legale.io – Microsoft Entra SSO Integration #
Cybersecurity Review – Requested Information
Date: August 1, 2026
This document provides the information requested as part of the cybersecurity
review of the Legale.io application, regarding its Single Sign-On (SSO)
integration with Microsoft Entra ID (formerly Azure Active Directory).
1. Application Name and Identifier #
- Application (solution) name: Legale.io
-
Identity provider:
Microsoft Entra ID (Microsoft identity platform) -
Provider domain:
login.microsoftonline.com -
Production application URL:
https://app.legale.io
The integration is implemented through two application registrations in
Microsoft Entra ID, which together identify the application:
Display name |
Application (Client) ID |
Registration type |
Purpose |
|---|---|---|---|
Legale.io SPA |
eb16e890-e8a1-4595-9437-b5c52cf0b163
|
Public client – Single-page application |
Handles the interactive user sign-in with Microsoft from the web frontend (MSAL.js). |
Legale.io Backoffice |
7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc
|
Web API – confidential client |
Exposes the scope consumed by the SPA; it is the audience of the access tokens accepted by the Legale.io backend API. |
-
Application ID URI (API identifier):
api://7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc -
Redirect URI (SPA):
https://app.legale.io
2. Requested Permissions #
All requested permissions are delegated permissions, i.e., the application
acts strictly on behalf of the signed-in user.
No application permissions are used. Consent is granted by the user at first
sign-in, and none of the requested permissions require administrator consent.
Permission / scope |
API |
Type |
Purpose |
|---|---|---|---|
openid
|
Microsoft identity platform |
Delegated (OIDC scope) |
Enables SSO sign-in and the issuance of an ID token that authenticates the user’s identity. |
profile
|
Microsoft identity platform |
Delegated (OIDC scope) |
Allows reading the user’s basic profile claims (e.g., display name) to identify and provision the account. |
email
|
Microsoft identity platform |
Delegated (OIDC scope) |
Allows reading the user’s email address, used as the account identifier within Legale.io. |
User.Read
|
Microsoft Graph |
Delegated |
Allows the application to sign in the user and read the signed-in user’s basic profile information. |
api://7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc/read
|
Legale.io Backoffice (custom scope) |
Delegated |
Allows the SPA to obtain access tokens that are accepted by the Legale.io backend API, in order to call protected API endpoints on behalf of the signed-in user. |
3. Authentication Method and High-Level Workflow #
Authentication protocol:
OpenID Connect (OIDC) built on top of OAuth 2.0, using the
Authorization Code Flow with PKCE.
The frontend is a React single-page application using Microsoft’s official
MSAL.js library; the backend is a Django application that
validates the issued tokens.
High-level integration workflow:
Step |
Authentication Workflow |
|---|---|
1 |
The user selects
|
2 |
The SPA opens a Microsoft login pop-up and initiates the
|
3 |
The user authenticates against their organization’s The tenant’s own security policies, including On first use, the user consents to the permissions listed in Section 2. |
4 |
Microsoft Entra ID returns an authorization code to the SPA, Audience:
|
5 |
The SPA includes the access token in the The SPA is a public client: it holds no client secret, and tokens are |
6 |
The backend validates the token on every request: • Signature • Issuer • Audience • Expiration After successful validation, the user account is created or updated |
7 |
Access tokens are short-lived and are transparently renewed by All communication occurs exclusively over |
Please note:
No client secrets or other sensitive credentials are included in this document.
