Why manage security twice? Linking application security to Microsoft Entra
Most firms manage identity and access carefully in Microsoft Entra: who people are, which devices they use, how they sign in. Then they do much of it again, by hand, inside each application. It is worth asking why.
The cost of managing it twice
Every application with its own user list and its own roles is another place a joiner must be set up, a mover's access must be changed, and a leaver must be removed. Each one is a chance for access to be wrong, and for nobody to notice. The more applications a firm runs, the bigger the gap between what the directory says and what people can actually do.
What can be driven from Microsoft Entra
- Sign-in: single sign-on, so one identity and one set of access rules covers every system.
- Accounts: automatic creation and removal of user accounts in the application (often through a standard called SCIM), so a leaver disabled in Entra loses access everywhere.
- Roles: application roles assigned from Entra groups, so someone added to the cashiers group becomes a cashier in the legal system.
- Attributes: groups that update themselves from directory attributes such as department, office or job title, so a move between teams changes access without anyone touching the application.
- Reviews: periodic access reviews, where managers confirm who should still have access.
Some of these capabilities depend on higher Microsoft Entra licence levels, so check what your licences include.
What only the application can know
Entra knows people, groups and attributes. It does not know matters, clients or ethical walls. Matter-level and document-level security will always live in the legal system. The aim is a clean division: Entra decides who someone is and what role they hold; the application decides which matters that role can see.
The data has to be right
Driving access from directory attributes only works if those attributes are accurate and kept up to date, usually by linking the directory to HR. That is a decision in itself, and one worth making early.
What to ask, and what to see
- Do you support single sign-on and automatic account creation and removal from Microsoft Entra?
- Can roles be assigned from Entra groups, and can those groups be driven by directory attributes?
- Show a leaver disabled in Entra losing access to every part of the system, including mobile apps.
- Which permissions must still be managed inside the application, and how are changes audited?
Technical notes: small decisions, big consequences
Start with the overview: The details that decide the project
Accounts and finance
- Core accounting is still the gold standard
- One-way or two-way sync? Connecting your legal system to Xero
- Units or minutes? How time is recorded
- Your matter and nominal structure
- Making Tax Digital: the firm and its clients
Workflow, data and documents
- Workflow: deep, basic or none?
- Client onboarding and matter inception: portal, e-signature and ID checks working as one
- Custom data: what you rely on, and how you move it
- Precedents, merge codes and macros: your document bank in a new system
Your types of work
- Legal aid: your records, not just the Legal Aid Agency’s
- Litigation: Precedent H starts with time recording
- Family: Form E and financial disclosure
- Private client: where does the tax software fit?
Security and access
- Roles or individuals? How user permissions are set up
- Why manage security twice? Linking application security to Microsoft Entra (you are here)
- How granular is the security inside the system?
- Who can see what in reporting?
- Shared platform, your data: separation, restore and erasure
- When the supplier is the target: where your data lives, who can reach it, and your real risk
Microsoft 365
- How does it connect to Outlook?
- What did you just give it permission to do?
- What happens behind the scenes? Background integrations with Microsoft 365
- OneDrive is not a document management system
- Microsoft 365 is not a backup
Data and decisions
Official sources
Check the detail for yourself at the source. Rules and guidance change, so always use the current version.
- NCSC: small organisations guide to cyber security: Practical security steps for smaller firms.
- Cyber Essentials: The government-backed baseline security certification.
Where does your firm stand?
Our free practice management review shows how much of your current system you really use and, if you are thinking of moving, builds an independent requirements specification that takes your reasons into account. Nothing is sent to us.
Start the free review Talk to us