{"id":297074,"date":"2026-04-29T08:04:40","date_gmt":"2026-04-29T08:04:40","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/sso-saml-login-azure-ad-entra-id\/"},"modified":"2026-05-15T06:27:04","modified_gmt":"2026-05-15T06:27:04","slug":"sso-saml-login-azure-ad-entra-id","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/sso-saml-login-azure-ad-entra-id\/","author":23491820,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.4","stable_tag":"1.0.4","tested":"6.9.4","requires":"6.3","requires_php":"8.0","requires_plugins":null,"header_name":"SSO & SAML Login \u2014 Azure AD \/ Entra ID","header_author":"MeritStory","header_description":"Log in to WordPress with Microsoft Azure AD \/ Entra ID using SAML 2.0 or OpenID Connect (OIDC). Simple setup, JIT provisioning, role mapping, and audit log.","assets_banners_color":"131317","last_updated":"2026-05-15 06:27:04","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/sso-saml-login-azure-ad-entra-id\/","header_author_uri":"https:\/\/meritstory.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":233,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.3":{"tag":"1.0.3","author":"karolismerit","date":"2026-04-29 09:23:37"},"1.0.4":{"tag":"1.0.4","author":"karolismerit","date":"2026-05-15 06:27:04"}},"upgrade_notice":{"1.0.1":"<p>Readme and compliance updates. No manual migration steps required.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3518091,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3518091,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3518091,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3518091,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.3","1.0.4"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3518091,"resolution":"1","location":"assets","locale":"","width":1508,"height":725},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3518091,"resolution":"2","location":"assets","locale":"","width":1505,"height":1209},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3518091,"resolution":"3","location":"assets","locale":"","width":439,"height":636}},"screenshots":{"1":"SP Information tab with Entity ID, ACS URL, and metadata\/certificate data.","2":"Configuration tab for SAML or OIDC setup and connection tests.","3":"WordPress login page with Microsoft sign-in button."}},"plugin_section":[],"plugin_tags":[138854,3883,43290,9213,2469],"plugin_category":[],"plugin_contributors":[261371,261380],"plugin_business_model":[],"class_list":["post-297074","plugin","type-plugin","status-publish","hentry","plugin_tags-azure-ad","plugin_tags-microsoft","plugin_tags-openid-connect","plugin_tags-saml","plugin_tags-sso","plugin_contributors-karolismerit","plugin_contributors-meritstory","plugin_committers-karolismerit","plugin_committers-meritstory"],"banners":{"banner":"https:\/\/ps.w.org\/sso-saml-login-azure-ad-entra-id\/assets\/banner-772x250.png?rev=3518091","banner_2x":"https:\/\/ps.w.org\/sso-saml-login-azure-ad-entra-id\/assets\/banner-1544x500.png?rev=3518091","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/sso-saml-login-azure-ad-entra-id\/assets\/icon-128x128.png?rev=3518091","icon_2x":"https:\/\/ps.w.org\/sso-saml-login-azure-ad-entra-id\/assets\/icon-256x256.png?rev=3518091","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/sso-saml-login-azure-ad-entra-id\/assets\/screenshot-1.png?rev=3518091","caption":"SP Information tab with Entity ID, ACS URL, and metadata\/certificate data."},{"src":"https:\/\/ps.w.org\/sso-saml-login-azure-ad-entra-id\/assets\/screenshot-2.png?rev=3518091","caption":"Configuration tab for SAML or OIDC setup and connection tests."},{"src":"https:\/\/ps.w.org\/sso-saml-login-azure-ad-entra-id\/assets\/screenshot-3.png?rev=3518091","caption":"WordPress login page with Microsoft sign-in button."}],"raw_content":"<!--section=description-->\n<p><strong>Microsoft Login for WordPress<\/strong> lets your users sign in to WordPress using their Microsoft Azure AD \/ Entra ID credentials - no separate password needed. Choose between SAML 2.0 and OpenID Connect (OIDC) to match your organization's configuration.<\/p>\n\n<h4>Why this plugin?<\/h4>\n\n<ul>\n<li><strong>Microsoft-focused.<\/strong> Built specifically for Azure AD \/ Entra ID.<\/li>\n<li><strong>Simple setup.<\/strong> Import SAML metadata or use OIDC discovery to auto-fill endpoints.<\/li>\n<li><strong>Clean admin UX.<\/strong> One settings area with guided setup and test tools.<\/li>\n<li><strong>Security-first.<\/strong> SAML uses <code>onelogin\/php-saml<\/code>; OIDC validates RS256 tokens against JWKS.<\/li>\n<\/ul>\n\n<h4>Free Features<\/h4>\n\n<ul>\n<li>SAML 2.0 SP login flow (Azure AD \/ Entra ID as IdP)<\/li>\n<li>OpenID Connect Authorization Code + PKCE login flow<\/li>\n<li>Auto-create WordPress users on first login (JIT provisioning)<\/li>\n<li>Configurable default role for new users<\/li>\n<li>SP metadata download and SAML metadata URL import<\/li>\n<li>OIDC tenant discovery and endpoint validation tools<\/li>\n<li>Emergency admin bypass URL for lockout recovery<\/li>\n<li>WP-CLI commands (<code>wp saml status<\/code>, <code>wp saml import-metadata<\/code>, <code>wp saml regen-cert<\/code>, <code>wp saml test<\/code>)<\/li>\n<\/ul>\n\n<h4>Pro Features (separate plugin)<\/h4>\n\n<ul>\n<li>Role mapping (map Azure AD roles\/groups to WordPress roles)<\/li>\n<li>SSO enforcement by WordPress role, with per-user bypass exceptions<\/li>\n<li>Attribute sync on login (first name, last name, display name)<\/li>\n<li>Audit log (login success\/failure, user creation, role mapping, SSO enforcement, logout)<\/li>\n<li>Audit log CSV export and retention settings<\/li>\n<li>Microsoft Graph user sync and import tools:<\/li>\n<li>App-only Graph connection test<\/li>\n<li>Group member preview\/import<\/li>\n<li>Daily background sync via WP-Cron<\/li>\n<li>Optional deprovisioning (remove role when user is disabled\/removed)<\/li>\n<\/ul>\n\n<h4>Requirements<\/h4>\n\n<ul>\n<li>PHP 8.0 or higher<\/li>\n<li>PHP extensions: <code>openssl<\/code>, <code>dom<\/code>, <code>zlib<\/code><\/li>\n<li>WordPress 6.3 or higher<\/li>\n<li>A Microsoft Azure AD \/ Entra ID tenant<\/li>\n<\/ul>\n\n<h4>Setup Overview<\/h4>\n\n<p><strong>SAML:<\/strong><\/p>\n\n<ol>\n<li>Install and activate the plugin.<\/li>\n<li>Go to <strong>Settings -&gt; SSO &amp; SAML Login<\/strong>.<\/li>\n<li>Copy the <strong>SP Entity ID<\/strong> and <strong>ACS URL<\/strong> from the SP Information tab.<\/li>\n<li>Create a new Enterprise Application in Azure AD (non-gallery app, enable SAML SSO).<\/li>\n<li>Paste your <strong>App Federation Metadata URL<\/strong> into the plugin and click <strong>Import Metadata<\/strong>.<\/li>\n<li>Save settings. Your Microsoft login button appears on <code>wp-login.php<\/code>.<\/li>\n<\/ol>\n\n<p><strong>OIDC:<\/strong><\/p>\n\n<ol>\n<li>Create an App Registration in Azure and add your site's <code>\/saml\/oidc-callback<\/code> as Redirect URI.<\/li>\n<li>In plugin settings, select <strong>OpenID Connect<\/strong>, enter Tenant ID, click <strong>Fetch Discovery<\/strong>.<\/li>\n<li>Enter <strong>Client ID<\/strong> and <strong>Client Secret<\/strong>, then save.<\/li>\n<\/ol>\n\n<h4>Privacy<\/h4>\n\n<p>This plugin does not send data to third parties except as described in the External services section below. SSO and audit data are stored in your own WordPress database.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects to external services to provide authentication and optional paid features. No data is sent to any external service except as described below.<\/p>\n\n<p><strong>1) Microsoft Azure AD \/ Entra ID (required for SSO login)<\/strong><\/p>\n\n<p>Used for SAML 2.0 and OpenID Connect authentication.<\/p>\n\n<p>Data sent and when:<\/p>\n\n<ul>\n<li>On SSO login start, the browser is redirected to Microsoft with Azure app\/protocol parameters (tenant endpoint, app\/client ID, redirect URI, state, scopes, SAML request\/relay state as applicable).<\/li>\n<li>On OIDC callback, the site sends the one-time authorization code (and PKCE verifier) to Microsoft's token endpoint.<\/li>\n<li>On SAML setup import\/test actions, the site fetches your tenant's federation metadata URL.<\/li>\n<li>On logout (if SLO\/end-session is enabled), the browser is redirected to Microsoft's logout endpoint.<\/li>\n<\/ul>\n\n<p>Returned identity claims (email, name, subject\/object ID, roles\/groups) are used to authenticate\/provision users and stored in your WordPress database.<\/p>\n\n<ul>\n<li>Service: https:\/\/login.microsoftonline.com\/<\/li>\n<li>Privacy Policy: https:\/\/privacy.microsoft.com\/en-us\/privacystatement<\/li>\n<li>Terms of Service: https:\/\/www.microsoft.com\/en-us\/servicesagreement<\/li>\n<\/ul>\n\n<p><strong>2) Microsoft Graph API (Pro only; when configured by the site admin)<\/strong><\/p>\n\n<p>Used to sync users and groups from Microsoft Entra ID into WordPress.<\/p>\n\n<p>Data sent and when:<\/p>\n\n<ul>\n<li>When an admin runs a Graph test, import, or sync (manual or scheduled), the site sends requests to Microsoft Graph using app-only access tokens.<\/li>\n<li>Requests include query parameters for the configured sync operations (group\/member lookups, account status checks, etc.).<\/li>\n<\/ul>\n\n<p>Returned directory fields (user principal name, email, display name, object IDs, group membership, account status) are used to create, update, or deprovision WordPress users per plugin settings.<\/p>\n\n<ul>\n<li>Service: https:\/\/graph.microsoft.com\/<\/li>\n<li>Privacy Policy: https:\/\/privacy.microsoft.com\/en-us\/privacystatement<\/li>\n<li>Terms of Service: https:\/\/www.microsoft.com\/en-us\/servicesagreement<\/li>\n<\/ul>\n\n<p><strong>3) Freemius (optional; only when admin opts in or activates a paid license)<\/strong><\/p>\n\n<p>Used for licensing, upgrade flow, and optional analytics.<\/p>\n\n<p>Data sent and when:<\/p>\n\n<ul>\n<li>On activation, an opt-in prompt is shown; no data is sent unless the admin consents.<\/li>\n<li>On license activation\/validation, the site exchanges license, account, and site information with Freemius servers.<\/li>\n<li><p>If telemetry opt-in is accepted, usage and diagnostic events may be sent per Freemius configuration.<\/p><\/li>\n<li><p>Service: https:\/\/freemius.com\/<\/p><\/li>\n<li>Privacy Policy: https:\/\/freemius.com\/privacy\/<\/li>\n<li>Terms of Service: https:\/\/freemius.com\/terms\/<\/li>\n<\/ul>\n\n<!--section=installation-->\n<h4>Automatic Installation<\/h4>\n\n<ol>\n<li>In WordPress admin, go to <strong>Plugins -&gt; Add New<\/strong>.<\/li>\n<li>Search for <strong>Microsoft Login for WordPress<\/strong>.<\/li>\n<li>Click <strong>Install Now<\/strong>, then <strong>Activate<\/strong>.<\/li>\n<\/ol>\n\n<h4>Manual Installation<\/h4>\n\n<ol>\n<li>Download the plugin ZIP.<\/li>\n<li>Go to <strong>Plugins -&gt; Add New -&gt; Upload Plugin<\/strong>.<\/li>\n<li>Upload the ZIP and activate.<\/li>\n<li>Go to <strong>Settings -&gt; SSO &amp; SAML Login<\/strong>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20work%20with%20microsoft%20entra%20id%20%28formerly%20azure%20active%20directory%29%3F\"><h3>Does this work with Microsoft Entra ID (formerly Azure Active Directory)?<\/h3><\/dt>\n<dd><p>Yes. Azure AD was renamed to Entra ID. This plugin supports both naming conventions.<\/p><\/dd>\n<dt id=\"do%20i%20need%20external%20software%3F\"><h3>Do I need external software?<\/h3><\/dt>\n<dd><p>No. SAML parsing is handled by bundled <code>onelogin\/php-saml<\/code>. OIDC validation uses built-in PHP OpenSSL.<\/p><\/dd>\n<dt id=\"saml%20or%20oidc%20-%20which%20should%20i%20choose%3F\"><h3>SAML or OIDC - which should I choose?<\/h3><\/dt>\n<dd><p>For most teams, OIDC is simpler to configure. Choose SAML if your organization already standardizes on SAML or requires SAML-specific controls.<\/p><\/dd>\n<dt id=\"can%20users%20still%20log%20in%20with%20wordpress%20passwords%3F\"><h3>Can users still log in with WordPress passwords?<\/h3><\/dt>\n<dd><p>Yes by default. If Pro SSO enforcement is enabled for selected roles, password login is blocked for those roles.<\/p><\/dd>\n<dt id=\"what%20happens%20on%20first%20login%3F\"><h3>What happens on first login?<\/h3><\/dt>\n<dd><p>If auto-create is enabled, a new WordPress account is created from IdP identity data and assigned your configured default role.<\/p><\/dd>\n<dt id=\"i%20am%20locked%20out.%20how%20do%20i%20recover%3F\"><h3>I am locked out. How do I recover?<\/h3><\/dt>\n<dd><p>Use the emergency bypass URL shown in <strong>Settings -&gt; SSO &amp; SAML Login -&gt; Misc \/ Reset<\/strong>.<\/p><\/dd>\n<dt id=\"what%20is%20the%20difference%20between%20free%20and%20pro%3F\"><h3>What is the difference between Free and Pro?<\/h3><\/dt>\n<dd><p><strong>Free<\/strong> includes core SAML\/OIDC login and provisioning for unlimited users.<\/p>\n\n<p><strong>Pro<\/strong> (a separate plugin) adds role mapping, SSO enforcement, attribute sync, audit log (with CSV export\/retention), and Microsoft Graph import\/sync\/deprovision features.<\/p><\/dd>\n<dt id=\"how%20do%20i%20upgrade%20from%20free%20to%20pro%3F\"><h3>How do I upgrade from Free to Pro?<\/h3><\/dt>\n<dd><p>Use the <strong>Upgrade to Pro<\/strong> links inside plugin settings or the account\/upgrade entry in the plugin UI.<\/p><\/dd>\n<dt id=\"what%20developer%20hooks%20are%20available%3F\"><h3>What developer hooks are available?<\/h3><\/dt>\n<dd><p><strong>Available in all plans<\/strong><\/p>\n\n<pre><code>ssosamlentra_login_success\n<\/code><\/pre>\n\n<p>Fires after a successful SSO login.<\/p>\n\n<pre><code>ssosamlentra_login_failed\n<\/code><\/pre>\n\n<p>Fires when an SSO login attempt fails.<\/p>\n\n<pre><code>ssosamlentra_after_provision_user\n<\/code><\/pre>\n\n<p>Fires after JIT provisioning completes.<\/p>\n\n<p><strong>Pro-only hooks (active with valid Pro license)<\/strong><\/p>\n\n<pre><code>ssosamlentra_user_attributes *(filter)*\n<\/code><\/pre>\n\n<p>Filter normalized attributes before provisioning.<\/p>\n\n<pre><code>ssosamlentra_pre_role_mapping *(filter)*\n<\/code><\/pre>\n\n<p>Filter resolved WordPress role before applying role mapping.<\/p>\n\n<pre><code>ssosamlentra_role_mapped\n<\/code><\/pre>\n\n<p>Fires after mapped role is applied.<\/p>\n\n<pre><code>ssosamlentra_sso_enforced\n<\/code><\/pre>\n\n<p>Fires when password login is blocked due to SSO enforcement.<\/p>\n\n<pre><code>ssosamlentra_graph_sync_user *(filter)*\n<\/code><\/pre>\n\n<p>Filter whether an individual Graph user should be synced.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Documentation and compliance updates.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<li>SAML 2.0 SP flow using <code>onelogin\/php-saml<\/code>.<\/li>\n<li>OIDC + PKCE flow with RS256 JWT validation.<\/li>\n<li>JIT user provisioning and default role assignment.<\/li>\n<li>Metadata import\/discovery tools.<\/li>\n<li>Pro features (separate plugin): role mapping, SSO enforcement, attribute sync, audit log, and Graph user sync.<\/li>\n<li>WP-CLI commands and emergency bypass URL.<\/li>\n<\/ul>","raw_excerpt":"Log in to WordPress with Microsoft Azure AD \/ Entra ID using SAML 2.0 or OpenID Connect (OIDC). Simple setup, enterprise-grade security.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/297074","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=297074"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/meritstory"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=297074"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=297074"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=297074"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=297074"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=297074"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=297074"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}