---
title: Microsoft Entra ID SSO Integration
description: "# Legale.io - Microsoft Entra SSO Integration **Cybersecurity Review - Requested Information** **Date:** August 1, 2026 This document provides the information requested as part of the cybersecurity review of the Legale.io application, regarding its Single Sign-On (SSO) integration with Microsoft…"
url: "https://legale.io/docs/microsoft-entra-id-sso-integration/"
updated: "2026-08-03"
category: "Single Sign-On (SSO) Integration"
---

# Microsoft Entra ID SSO Integration

# Legale.io - Microsoft Entra SSO Integration

**Cybersecurity Review - Requested Information**
 **Date:** August 1, 2026

This document provides the information requested as part of the cybersecurity
 review of the Legale.io application, regarding its Single Sign-On (SSO)
 integration with Microsoft Entra ID (formerly Azure Active Directory).

## 1. Application Name and Identifier

- **Application (solution) name:** Legale.io
- **Identity provider:**
   Microsoft Entra ID (Microsoft identity platform)
- **Provider domain:**
   `login.microsoftonline.com`
- **Production application URL:**
   `https://app.legale.io`

The integration is implemented through two application registrations in
 Microsoft Entra ID, which together identify the application:

| Display name | Application (Client) ID | Registration type | Purpose |
| --- | --- | --- | --- |
| **Legale.io SPA** | `eb16e890-e8a1-4595-9437-b5c52cf0b163` | Public client - Single-page application | Handles the interactive user sign-in with Microsoft from the web frontend (MSAL.js). |
| **Legale.io Backoffice** | `7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc` | Web API - confidential client | Exposes the scope consumed by the SPA; it is the audience of the access tokens accepted by the Legale.io backend API. |

- **Application ID URI (API identifier):**
   `api://7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc`
- **Redirect URI (SPA):**
   `https://app.legale.io`

## 2. Requested Permissions

All requested permissions are delegated permissions, i.e., the application
 acts strictly on behalf of the signed-in user.

No application permissions are used. Consent is granted by the user at first
 sign-in, and none of the requested permissions require administrator consent.

| Permission / scope | API | Type | Purpose |
| --- | --- | --- | --- |
| `openid` | Microsoft identity platform | Delegated (OIDC scope) | Enables SSO sign-in and the issuance of an ID token that authenticates the user's identity. |
| `profile` | Microsoft identity platform | Delegated (OIDC scope) | Allows reading the user's basic profile claims (e.g., display name) to identify and provision the account. |
| `email` | Microsoft identity platform | Delegated (OIDC scope) | Allows reading the user's email address, used as the account identifier within Legale.io. |
| `User.Read` | Microsoft Graph | Delegated | Allows the application to sign in the user and read the signed-in user's basic profile information. |
| `api://7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc/read` | Legale.io Backoffice (custom scope) | Delegated | Allows the SPA to obtain access tokens that are accepted by the Legale.io backend API, in order to call protected API endpoints on behalf of the signed-in user. |

## 3. Authentication Method and High-Level Workflow

**Authentication protocol:**
 OpenID Connect (OIDC) built on top of OAuth 2.0, using the
 **Authorization Code Flow with PKCE**.

The frontend is a React single-page application using Microsoft's official
 **MSAL.js** library; the backend is a Django application that
 validates the issued tokens.

**High-level integration workflow:**

| Step | Authentication Workflow |
| --- | --- |
| 1 | The user selects **“Sign In with SSO”** on the Legale.io login page: `https://app.legale.io` |
| 2 | The SPA opens a Microsoft login pop-up and initiates the **OAuth 2.0 Authorization Code Flow with PKCE** against the Microsoft identity platform: `https://login.microsoftonline.com/common` |
| 3 | The user authenticates against their organization's **Microsoft Entra ID tenant**. The tenant's own security policies, including **MFA** and **Conditional Access**, apply during authentication. On first use, the user consents to the permissions listed in Section 2. |
| 4 | Microsoft Entra ID returns an authorization code to the SPA, which is redeemed for an **ID token** and an **access token** scoped to the Legale.io API. **Audience:** `api://7fdb37ac-d4c9-4bdd-bd60-b317d4afa2fc` |
| 5 | The SPA includes the access token in the **Authorization: Bearer** header of every request to the Legale.io API. The SPA is a public client: it holds no client secret, and tokens are never exposed outside the user's browser session. |
| 6 | The backend validates the token on every request: **• Signature** against Microsoft's published signing keys **• Issuer** **• Audience** **• Expiration** After successful validation, the user account is created or updated locally and the request is authorized. |
| 7 | Access tokens are short-lived and are transparently renewed by **MSAL** without user interaction. All communication occurs exclusively over **HTTPS**. |

**Please note:**

No client secrets or other sensitive credentials are included in this document.