The requirement buried on page three
The firm's IT director sends a list of requirements before a rollout. Near the top: single sign-on through the firm's Microsoft Entra ID, automatic provisioning and deprovisioning, and no local passwords. Your product has email and password login with optional two-factor authentication. Users are created by your support team from a spreadsheet the firm sends.
The IT director explains why. Trainees rotate between departments every six months. Fee earners join and leave through the year. Secretaries move between teams. The firm cannot rely on someone remembering to email every supplier each time, and a leaver with a live password to a product holding client documents is exactly what their auditors look for.
Why login is a law firm deal breaker
Law firms are heavy Microsoft users, and most manage identities centrally. Their security teams answer to clients who ask how access to their information is controlled.
- Local passwords are outside the firm's control and cannot be forced to follow its policies.
- Users created by hand from spreadsheets drift from the firm's directory.
- Leavers are removed late, or not at all, when removal relies on an email.
- Trainee seat rotations and team moves need roles changed, not just accounts created.
- Without SSO, the firm cannot apply its own conditional access rules, such as requiring a managed device.
What missing SSO costs a legal tech startup
Many mid-sized and larger firms simply will not proceed without SSO, so the lack of it closes the door on the firms you most want. Where firms do go ahead, your support team spends time creating, changing and removing users by hand, and your product becomes the item on their audit list that never matches the directory. It also affects pricing disputes, because seat counts include people who left months ago.
Adding SSO in a hurry, under deal pressure, often produces a half-built version that handles sign-in but not provisioning or roles, which fixes the first question and fails the second.
There are awkward details that a rushed build tends to miss. Firms merge and take on lateral hires in groups, so dozens of users can arrive in one day. Some staff have two accounts, such as a partner with a separate admin identity. Consultants and secondees may sit outside the main directory. Each case needs a rule, agreed with the firm, before it turns into a support ticket.
How we build identity the way firms expect
What we build connects your product to the firm's directory for sign-in, user lifecycle and roles.
- Single sign-on through Microsoft Entra ID using OpenID Connect or SAML, with support for other identity providers such as Okta where your target firms use them.
- Per-firm configuration so each firm connects its own tenant, with an option to disable local passwords entirely for that firm.
- SCIM provisioning so users are created, updated and deactivated in your product automatically as the firm's directory changes.
- Group-to-role mapping: the firm's groups, such as a department or a trainee group, map to roles and access in your product, so a seat rotation changes access automatically.
- Deprovisioning that ends sessions and access at once, with the user's work kept and reassigned as the firm chooses.
- An admin view for the firm listing users, their source, last sign-in and role, with a record of every provisioning change.
| Firm event | What happens in your product |
|---|---|
| New joiner added to directory | User created with the right role |
| Trainee moves seat | Role and access updated from group change |
| Fee earner leaves | Access ended, sessions closed, work kept |
| Firm requires managed devices | Applied through the firm's own sign-in rules |
| Firm disables local passwords | Only SSO sign-in allowed for that firm |
The next rollout
The firm's IT team adds your product as an enterprise application in Entra ID, connects SCIM, and maps their departments to your roles. Users appear in your product with the right access, and no one at your company types a name. When trainees rotate in September, their access changes with their group membership. When an associate leaves on Friday, their access ends when IT disables their account. At the next audit, your product matches the directory.
Checklist: identity for law firms
- Your product only supports email and password sign-in.
- Users are created and removed by your support team from spreadsheets.
- Firms' IT teams have asked for SCIM provisioning.
- Seat rotations and team moves need manual role changes.
- Your user list at a firm does not match its directory.