Setting up SSO on Lekhya's Firm plan means a firm admin registers Lekhya as an application inside the firm's own identity provider (Google Workspace, Microsoft Entra ID, Okta, or any other OIDC-compliant provider), gets back three values — an issuer URL, a client ID, and a client secret — and enters them into Lekhya's Settings page. Lekhya encrypts the secret at rest. There's no Lekhya-side platform secret involved anywhere in this; each firm's configuration is entirely its own.
Before starting: what you need in hand
- An active identity provider the firm already uses for staff logins — most firms already have one for email and other internal tools.
- Admin rights within that identity provider to register a new application (sometimes called an 'app integration' or 'OIDC client').
- Admin rights within Lekhya itself, since only a firm admin can reach the SSO configuration in Settings.
- Confirmation the firm is on the Firm plan — SSO isn't available on Practice or Practice Plus.
The setup, conceptually
- 01Register Lekhya as an application in the identity providerInside the identity provider's admin console, create a new OIDC application entry. Different providers name this step differently — Google Workspace, Microsoft Entra ID, and Okta each have their own flow — but the result is the same: the provider generates a client ID and a client secret specifically for this application, and gives a redirect URL field to fill in.
- 02Note the issuer URLEvery OIDC identity provider publishes an issuer URL — a fixed address that identifies that provider and that Lekhya uses to find the provider's public keys and authentication endpoints automatically. This is usually visible in the provider's own documentation or admin console for the application you just registered.
- 03Enter the three values into Lekhya's SettingsA firm admin goes to Lekhya's Settings page and enters the issuer URL, client ID, and client secret for the firm's identity provider. The secret is encrypted at rest from that point on; nobody retyping it later needs to see it in plaintext again.
- 04Confirm the firm-specific SSO login URLOnce configured, Lekhya generates a firm-specific SSO login URL containing the firm's own slug. This is the URL staff use to log in via SSO going forward — it's specific to the firm, so one firm's SSO configuration never gets confused with another's.
- 05Test with one already-invited member firstBecause Lekhya's SSO only authenticates existing, already-invited members, the first real test should be with someone who already has an active membership in the firm. A person who hasn't been invited yet will authenticate fine at the identity provider but won't get into Lekhya — that's expected behavior, not a setup error.
Regulatory requirement
SSO is available on the Firm plan only. A firm on Practice or Practice Plus wanting SSO needs to move to the Firm plan first — there's no add-on path to enable it separately.
Common setup snags
| Symptom | Likely cause |
|---|---|
| Login succeeds at the identity provider but fails to reach Lekhya | The person authenticating hasn't been invited into the firm's Lekhya account yet — expected, not a bug |
| Settings page rejects the issuer URL | Usually a copy-paste issue — the issuer URL needs to be the exact value the identity provider publishes, not a guessed variant |
| Client secret needs to be re-entered after rotation | If the firm rotates the secret on the identity-provider side for its own security hygiene, the new secret has to be re-entered in Lekhya's Settings to match |
What setup does not do
Turning on SSO does not change any existing member's role or which engagements they can see. It only changes how members prove their identity on login. A firm expecting SSO setup to also tighten or review who has access to what will need to do that separately, as its own access review — SSO and access governance are related but distinct exercises.
How we think about this
Lekhya keeps SSO configuration entirely per-firm, with no shared platform secret involved — the firm owns its identity provider relationship end to end, and Lekhya's role is limited to authenticating against whatever that firm has configured.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit workflow & automationSingle sign-on for audit firms: why it matters more at 80 engagements than at eightBelow a certain headcount, SSO is a convenience. Above it, it's the only realistic way offboarding actually happens on the day someone leaves.
- Audit workflow & automationMulti-office administration: organising a firm by branch without rebuilding access controlA firm with three branches needs to know who sits where. It doesn't need a second, parallel access-control system to find that out.
- Internal audit & IFCChange management controls audit for financial systems (ITGC)A change ticket with an approval signature doesn't tell you whether the change was actually tested before it hit the live financial system — those are two separate controls, tested separately.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.