Title: SSO for Entra ID Author: Marco Published: May 12, 2020 Last modified: July 4, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/sso-for-azure-ad.svg) # SSO for Entra ID By [Marco](https://profiles.wordpress.org/qlcvea/) [Download](https://downloads.wordpress.org/plugin/sso-for-azure-ad.zip) * [Details](https://syr.wordpress.org/plugins/sso-for-azure-ad/#description) * [Reviews](https://syr.wordpress.org/plugins/sso-for-azure-ad/#reviews) * [Installation](https://syr.wordpress.org/plugins/sso-for-azure-ad/#installation) * [Development](https://syr.wordpress.org/plugins/sso-for-azure-ad/#developers) [Support](https://wordpress.org/support/plugin/sso-for-azure-ad/) ## Description This plugin allows users to authenticate to a site with a Microsoft Entra ID account using OAuth. This plugin requires an app registration in the Entra ID portal. **Warning**: guest users and users created with a linked consumer Microsoft account may lead to strange behavior. See the “How are Entra ID users matched to site users?” FAQ for more information. Not affiliated with or approved by Microsoft. ## Installation After installing the plugin, an application must be created in Entra ID to allow for authentication. 1. In the plugin’s settings (Settings -> SSO for Entra ID), make a note of the Redirect URL displayed in the “Endpoints” section. 2. In the Entra ID admin panel for your directory, select “New registration”. 3. Enter a name. This will be visible to users. Note: unless you know you need to change this option, leave “Supported account types” set to “Accounts in this organizational directory only”. 4. Under “Redirect URI”, select “Web” and enter the Redirect URL that you copied earlier. If the “URL may not contain a query string” error appears, please see the dedicated FAQ entry for that error. 5. Select “Register”. 6. Make a note of the “Application (client ID)” and the “Directory (tenant) ID”. 7. Select “Certificates & secrets”. 8. Select “New client secret” 9. Enter a description and select an expiration, then select “Add”. Note: if you select any option other than “Never”, do not forget to create a new client secret and change it in the plugin settings before the current one expires! 10. Make a note of the client secret. 11. In the plugin’s settings, enter the values noted down earlier in the corresponding fields and save your changes. ## FAQ ### Why is the “Login with Entra ID” button not visible on my site’s login page? The login button will not be displayed until the plugin has been fully configured. Make sure that the following options are configured and valid inside the plugin’s settings (Settings -> SSO for Entra ID): 1. Application (client) ID 2. Client secret 3. Directory (tenant) ID ### How are Entra ID users matched to site users? The plugin will look for a user whose email address is the same as their email address on Entra ID. If the user does not have an email address, the plugin will attempt to match based on the User Principal Name (UPN) instead. For example, when the user whose mailbox is `user@example.com` logs in to the site, the plugin will look for a user with the email address `user@example.com`. ### What happens when an AD user who does not have an account on the site attempts to log in? The behavior for this case is configurable. In the “Login options” section of the plugin’s settings (Settings -> SSO for Entra ID), there is an option named “Create new users if they don’t already exist”. If it is enabled, when a user logs in and the plugin cannot find the corresponding site user, a new one will be created. By default, the user will be created with the same role as new site signups. This can be changed in the “Role for new profiles”. The plugin can also automatically fill the user’s name on the new account by enabling the “Generate user profiles automatically” option. The plugin will set the user’s username to be their email address. Alternatively, the email domain can be removed (`user@example.com` -> `user`) by enabling the “ Create usernames without domain name” option. **Warning**: if multiple users have the same name but different domain names (`user@1.example.com` and `user@2.example. com`) enabling this option may cause conflicts. If it is disabled, when a user logs in and the plugin cannot find the corresponding site user, the following error message will be displayed: “Your account has not been registered on this site. Please contact your administrator.” ### How can I add the site administration panel to the Azure application list? To add the site administration panel to the Azure application list, copy the “Homepage/ Login URL” displayed in the “Endpoints” section of the plugin’s settings (Settings- > SSO for Entra ID). This URL must be pasted in the “Home page URL” field in the “Branding” section of your app registration on the Entra ID portal. ### Error while setting up on Entra ID: “URL may not contain a query string” In some cases, Azure may reject the callback URL provided by the plugin with the error “URL may not contain a query string”. In this case, URL rewrites are required. In the plugin settings page, enable “Use rewrites” and save. The callback and login/homepage URLs listed in the plugin settings will change. These new URLs do not contain a query string and should therefore work. **Warning**: if you had previously referenced the callback URL with a query string, those references must be changed to the new value displayed in the plugin settings. ## Reviews ![](https://secure.gravatar.com/avatar/94c9b65a47e68b65cce0c7e6b90f7f4c1e52864644e8776cb66819d0b0ea9648? s=60&d=retro&r=g) ### 󠀁[Perfect Solution](https://wordpress.org/support/topic/perfect-solution-291/)󠁿 [Mike Meinz](https://profiles.wordpress.org/mikemeinz/) June 13, 2026 The other SSO plugins seemed too complicated and their feature set didn't match with my needs. This plugin simply matches the WordPress user's email address with the Microsoft Entra ID user's email address. For us, that was the perfect solution. Thank you!!! ![](https://secure.gravatar.com/avatar/9cb8b38dc8c570a88758afe89327753089188fcae1a7e0b369bfba8ef34ef2b7? s=60&d=retro&r=g) ### 󠀁[10 out of 5 Stars – no headache, just SSO.](https://wordpress.org/support/topic/10-out-of-5-stars-no-headache-just-sso/)󠁿 [Alexander Walther](https://profiles.wordpress.org/alexplus/) October 29, 2025 After testing 5 different plugins and finding out, that these are not FREE of charge if you want to use them, this was the only plugin tested that keeps it's promise: You want Azure Entra ID SSO? You get Azure Entra ID SSO. Period. There are some UX potentials to make this plugin even better (hiding the regular form at all or put the login button below the form, not between input fields and submit button) but I really appreciate having this basic feature working for free, not for 199$/ year. I'd like to sponsor this developer for keeping this a working plugin. ![](https://secure.gravatar.com/avatar/1331e1c38aac41a7511900229577a8b270538a1c918cb86010b0a87f6bae0b90? s=60&d=retro&r=g) ### 󠀁[Worked like a charm.](https://wordpress.org/support/topic/worked-like-a-charm-265/)󠁿 [musback](https://profiles.wordpress.org/musback/) November 5, 2024 This just works. I just contacted my Microsoft-admin at the office. He delivered some generated client/directory/… keys, I filled them out and done! All users that were already active on the site (and used their correct corporate email address) could instantly sign-in with their Microsoft SSO. Also a nice touch that you can just hide the old login, to avoid confusion and defer hackers even more. Great job@ qlcvea / Marco and thank you! ![](https://secure.gravatar.com/avatar/7c09924d9b0bb7b6df5b55772ce26d756df945977b729b064272f618ea423625? s=60&d=retro&r=g) ### 󠀁[It just works](https://wordpress.org/support/topic/it-just-works-791/)󠁿 [Chouffy](https://profiles.wordpress.org/chouffy/) October 11, 2023 A really cool plugin that helped me, thanks for developing this in the open! ![](https://secure.gravatar.com/avatar/2478492175ab1063d41569431164a579abdc6569cf8e514e3c3de01fc4bbb8a5? s=60&d=retro&r=g) ### 󠀁[Great plugin](https://wordpress.org/support/topic/great-plugin-32208/)󠁿 [Angelos Chouvardas](https://profiles.wordpress.org/achouvardas/) September 26, 2021 It is working as it should! thank you [ Read all 5 reviews ](https://wordpress.org/support/plugin/sso-for-azure-ad/reviews/) ## Contributors & Developers “SSO for Entra ID” is open source software. The following people have contributed to this plugin. Contributors * [ Marco ](https://profiles.wordpress.org/qlcvea/) [Translate “SSO for Entra ID” into your language.](https://translate.wordpress.org/projects/wp-plugins/sso-for-azure-ad) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/sso-for-azure-ad/), check out the [SVN repository](https://plugins.svn.wordpress.org/sso-for-azure-ad/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/sso-for-azure-ad/) by [RSS](https://plugins.trac.wordpress.org/log/sso-for-azure-ad/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 First release #### 1.1.0 * Added support for URL rewrites * The plugin now receives less data from Microsoft APIs (only the user’s email address) * The plugin source now contains internationalization comments #### 2.0.0 * **Breaking change**: The plugin now matches users based on email address and not UPN * “Scope” setting has been removed (the plugin now uses the Microsoft Graph API exclusively) * Account creation can now automatically fill the user’s name from their Azure AD profile * Account creation can now create usernames without the email domain * Other minor changes #### 2.1.0 * The plugin will now automatically convert callback URLs to HTTPS regardless of the site’s URL scheme, except if the hostname is “localhost” or “127.0.0.1”. #### 2.2.0 * The login start endpoint now uses POST requests (GET requests will be redirected to POST with a self-submitting form) * The button on the login page will redirect to the login start endpoint with a POST request (only if JavaScript is enabled) * Added support for receiving login callbacks with POST requests (enable in plugin settings -> “OAuth options” -> “Use POST callbacks”) #### 2.3.0 * The SSO login button can now be hidden ([!5](https://gitlab.com/qlcvea/wp-sso-for-azure-ad/-/merge_requests/5)) #### 2.4.0 * Added the ability to set a different role for users created by this plugin ([!6](https://gitlab.com/qlcvea/wp-sso-for-azure-ad/-/merge_requests/6)) #### 2.5.0 * The requirement for login start requests to use POST is now configurable with an option (enabled by default, disable in plugin settings -> “Endpoints” -> “ Require POST to Start URL”) * The button on the login page will only redirect to the login start endpoint with a POST request if the above option is enabled #### 2.5.1 * Fixed a warning that may occur when logging in directly without a redirect URL * Fixed the login redirect page being in Quirks Mode ([#5](https://gitlab.com/qlcvea/wp-sso-for-azure-ad/-/issues/5)) #### 2.5.2 * Pages managed by this plugin no longer show site content ([Contributed on the plugin forum](https://wordpress.org/support/topic/requests-to-urls-like-sso_for_azure_ad-asdasdfasdf-always-show-site-content/)) #### 2.6.0 * Renamed plugin to “SSO for Entra ID” ([Recommended on the plugin forum](https://wordpress.org/support/topic/azure-ad-is-now-entra-id/)) _The plugin still uses the old name in non-user-facing locations (such as IDs and URLs) to avoid breakage. This is not a breaking change._ * Changed default login button text to “Log in with Entra ID” #### 3.0.0 * **Breaking change**: The plugin’s user matching behavior has changed. The plugin now matches users based on email address and not UPN, which it was supposed to do but didn’t * General code cleanup * The OAuth state is now stored in the database and checked with a custom cookie instead of using WordPress nonces * The login flow now uses PKCE for improved security Changes in this release were [suggested in a merge request](https://gitlab.com/qlcvea/wp-sso-for-azure-ad/-/merge_requests/7). ## Meta * Version **3.0.0** * Last updated **3 months ago** * Active installations **600+** * WordPress version ** 4.7.0 or higher ** * Tested up to **7.0.7** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/sso-for-azure-ad/) * Tags * [Azure AD](https://syr.wordpress.org/plugins/tags/azure-ad/)[entra-id](https://syr.wordpress.org/plugins/tags/entra-id/) [oauth](https://syr.wordpress.org/plugins/tags/oauth/)[sso](https://syr.wordpress.org/plugins/tags/sso/) * [Advanced View](https://syr.wordpress.org/plugins/sso-for-azure-ad/advanced/) ## Ratings 5 out of 5 stars. * [ 5 5-star reviews ](https://wordpress.org/support/plugin/sso-for-azure-ad/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/sso-for-azure-ad/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/sso-for-azure-ad/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/sso-for-azure-ad/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/sso-for-azure-ad/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/sso-for-azure-ad/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/sso-for-azure-ad/reviews/) ## Contributors * [ Marco ](https://profiles.wordpress.org/qlcvea/) ## Support Issues resolved in last two months: 0 out of 1 [View support forum](https://wordpress.org/support/plugin/sso-for-azure-ad/)