To access iManage from an external application (Office & Dragons) via Entra Application Proxy, you configure an enterprise application in Entra ID that utilizes the Application Proxy service. This involves specifying the internal URL of your iManage server and an external URL for O&D to access from outside the network. Entra Application Proxy acts as a secure intermediary.
Requirements:
iManage version 10.3 and above installed on premises or in a private cloud (single-tenant instance in iManage cloud).
Microsoft Entra Application Proxy connector installed on your iManage instance.
Microsoft Entra Application Proxy set up and configured in your Azure Cloud.
Note the following:
The Microsoft Entra ID registered tenant domain must match the domain associated with the on-premises iManage server.
Microsoft Entra Application Proxy connector must be deployed within the same network as the iManage server.
Use of an SSL wildcard is needed to configure Microsoft Entra Application Proxy.
Install Microsoft Entra Application Proxy Connector
To install the Microsoft Entra Application Proxy connector on iManage, you first download the connector from the Microsoft Entra admin center and then install it on a Windows Server (2016 or later) that has access to your iManage server.
Note: You must ensure the server can reach Azure endpoints over HTTPS (port 443) so your network/firewall must allow outbound connections on port 443 to Azure.
In the Microsoft Entra admin center, select Enterprise applications.
Select New application. The Browse Microsoft Entra Gallery page is displayed.
Select Add an on-premises application.
Scroll down to the information message and select the link
In the Private Network connectors page, select Download connector service and follow the Microsoft instructions for installation.
Set up Microsoft Entra Application Proxy in Azure Cloud
In this step, you add an enterprise application that utilizes the Application Proxy service to your Microsoft Entra tenant. All requests from Litera Office and Dragons will be to this proxy application which will then forward the requests to iManage.
Tip: If you have multiple instances of iManage, you’ll need to create a new enterprise application for each.
To create a new enterprise application, you’ll need a Cloud Application Administrator or Application Administrator role
In the Microsoft Entra admin center, select Enterprise applications.
Select New application. The Browse Microsoft Entra Gallery page is displayed.
Select Add an on-premises application.
In the Basic tab, enter the following:
Name: A name for the proxy application, for example, “Office and Dragons-iManageProxy”.
Internal Url: The internal URL of your iManage server (on-prem DNS FQDN).
External Url: Build the URL for the proxy application (external FQDN). This is the URL you will add to the Litera Office and Dragons configuration.
Note: You must use the same internal and external domain name that matches the wild-card certificate on the Application Proxy server.
Navigate to your external DNS configuration page and configure a CNAME to point the external FQDN to the address provided by Microsoft Entra Application Proxy ending in “msappproxy.net”.
Select Microsoft Entra ID as the Pre Authentication. This ensures that every request Litera Office and Dragons makes to the iManage server is bypassed through the Azure App proxy connector.
From the Connector Group dropdown, select the connector group specified during the installation of the Microsoft Entra Application Proxy connector.
Note: If a connector group name is not specified during installation, the connector is added to the default group.
Tip: Assign a connector to connector group to align with the intended application mapping.
Select the Advanced tab and set the options as follows .
Backend Application Timeout: Default
Use Http-Only Cookie: Not selected
User Persistent Cookie: Not selected
Translate Urls in headers: Not selected
Translate Urls in application body: Not selected
Validate Backend SSL certificate: Selected
Select Create
Once created, navigate to the newly created proxy application and select Application Proxy in the left panel to upload the wildcard domain certificate. The SSL certificate must be monitored and managed according to the IT team’s existing SSL management procedures.
Open the newly created proxy application and select Properties in the left panel.
Configure the options as follows:
Assignment required: No
Visible to users: No
Open the Single sign-on in the left panel and verify that the method is set as Disabled.
Configure App Registration for Microsoft Entra Application Proxy
In this step, you set up the app registration for the newly created proxy application.
In the Microsoft Entra admin center, select App registration.
Select the All application view and search for the proxy application created in
the previous section.
Select Authentication in the left panel and verify the Web Redirect URIs match
the external FQDN of the iManage URL.
Configure the Front-channel logout URL to match the FQDN value as well.
Under Implicit grand and hybrid flows, select both Access tokens and ID
tokens.
Select Certificates and Secrets in the left panel then select the Client secrets tab.
Create a new secret.
Select New client secret.
Enter a description and an expiration date. We recommend a 24 month
expiry or whatever aligns to your internal corporate policy. Since the client
secret is used in the configuration in Litera Office and Dragons, you will need to update
that configuration with the new client secret once it expires.
Select Add.
Note: Save the client secret in a secure location as you will add it to the Litera Office and Dragons configuration.
Select API permissions in the left panel. You need to add the following control
permissions: User.Read to access user profile information from Microsoft Entra
via Microsoft Graph, and User.Impersonation to access or impersonate users in
a custom enterprise application.
Add User.Read:
Select Add a permission.
Select Microsoft Graph.
Select Delegated permissions.
Enter user.read.
Select Add permissions.
Add User.Impersonation:
Select Add a permission.
Select APIs my organization uses.
Select the name of the proxy application created previously.
Select Delegated permissions.
Enter user.impersonation.
Select Add permissions.
Once completed, the configured API permissions must be granted admin
consent and listed under Configured permissions.
Select Expose an API in the left panel. Here, you’ll add scopes for the API
permissions added above.
Verify that the Application ID URI is the external FQDN.
Select Add a scope, and enter the following:
In Scope name, enter user_impersonation.
In Who can consent?, select Admins only.
In Admin consent display name, enter what the scope will be called in the
consent screen when admins consent to this scope. For example, “Access
Office and Dragons-iManage-Proxy”.
Enter details in Admin consent description, User consent display name,
and User consent description.
Select Add scope.
Repeat the above steps to add a scope for user_read.
In the Authorized Client Application section, select Add a client application.
In Client ID, copy and paste the application (client) ID for the proxy application, and select the authorized scopes for the client ID.
Tip: You can find the application (client) ID by selecting Overview in the left panel.
Select App roles and verify the options match the image below.
Configure iManage in the Office and Dragons Admin Portal
For this step, you’ll need your iManage client ID, client secret and URL, and your Azure client ID, client secret and URL.
In the admin settings, select Integrations from the side panel
Toggle on iManage, and select Self-host / on-prem
From the iManage Integration Type dropdown, select iManage via Azure App Proxy
Enter your iManage client ID and client secret in the iManage Client ID and iManage Client Secret fields.
In the Azure Client ID and Azure Client Secret fields, enter the client ID and client secret of the proxy application (Office and Dragons-iManage-Proxy) created in the above procedure.
In the Azure External URL field, enter the URL of the proxy application (Office and Dragon-iManage-Proxy) created in the above procedure. The URL must be externally accessible.
In the Azure Tenant ID field, enter the Directory (tenant) ID of the proxy application (Office and Dragons-iManage-Proxy) created in the above procedure.
Tip: The client ID, client secret and tenant ID of the proxy application are found in the App registration > Overview page in the Microsoft Entra admin center.
Click Add Server.