What this is about

To let your users sign in to the Word Add-in without entering credentials each time (Single Sign-On), the add-in needs a one-time consent from your Microsoft 365 tenant. An administrator grants this consent once – after that, sign-in works transparently in the background for everyone in your organisation.

Who needs to act

A person with the role „Global Administrator“ or „Application Administrator“ in your Azure AD / Microsoft Entra ID tenant – typically your IT admin.

What permission is granted

Exactly one: User.Read.

This allows the add-in to read only the signed-in user's identity (name, email, tenant ID). No data is written, and no other permissions are requested.

Two ways to grant consent

Option A (recommended): Automatically during central rollout

If you deploy the add-in centrally via the Microsoft 365 Admin Center (Settings → Integrated apps), the consent prompt appears automatically during deployment. Simply click „Accept permissions“ – done. No separate step required.

See the guide „Roll out the Word Add-in centrally“ for details on the rollout.

Option B: Direct consent link

If the add-in is not deployed centrally, or if consent needs to be granted afterwards, we will send you a link in this format (with your tenant ID inserted at the marked position):

Steps:

1. Open the link in a browser.
2. Sign in with an account that has the Global Administrator or Application Administrator role.
3. On the Microsoft consent screen „LAWLIFT Word Add-in (NAA) - PROD“, the User.Read permission is requested on behalf of all users in your organisation – click „Accept“ to confirm.
4. You will then be redirected to https://app.lawlift.de/word-addin/login. This page simply confirms that the process has been completed.

What we need from you upfront

Your Azure AD tenant ID (a GUID). You can find it here:

Azure Portal → Microsoft Entra ID → Properties → Tenant ID

Send us the ID and we will return the consent link tailored to your tenant.