Configuration Reference

All settings live under Settings → Entra Login in the WordPress admin and are stored in a single option, dowo_wpentra_settings.

Connection#

Enable Entra SSO#

enabled — master switch. When on, the Sign in with Microsoft button appears on the login screen. The button only shows when the plugin is fully configured (tenant ID, client ID, and client secret all present), regardless of this toggle.

Directory (tenant) ID#

tenant_id — the tenant GUID from your Entra app registration's Overview page. Used to build the authority URL https://login.microsoftonline.com/{tenant}.

Application (client) ID#

client_id — the application GUID from the Overview page. Also validated as the ID token aud (audience) claim.

Client secret#

client_secret — the secret Value (not the Secret ID) from Certificates & secrets. Stored in the options table. Leave the field blank when saving to keep the previously stored value. Rotate it before it expires in Entra.

User mapping#

Users are matched to WordPress accounts by email address: the email claim from the Entra ID token is compared against the WordPress user's email. If no matching user is found, the account is either provisioned (if enabled) or rejected.

The email is read from the email claim, falling back to preferred_username when that is itself an email address. If Entra returns no email, sign-in is refused with a clear message.

Auto-provision users#

auto_provision — when on, a WordPress user is created automatically on first successful Entra sign-in. When off, the user must already exist or sign-in is refused with a clear message.

Default role for new users#

default_role — the role assigned to auto-provisioned users. Only used when auto-provisioning. Defaults to subscriber. Choose the least privilege that fits your site.

Allowed email domains#

allowed_domains — optional comma- or newline-separated list of domains (e.g. dowodigital.com). When set, only identities whose email domain is on the list may sign in via Entra. Leave blank to allow any account from your tenant. This is enforced in addition to any Entra-side user assignment.

Appearance#

Sign-in button label#

button_label — the text on the Microsoft button. Defaults to "Sign in with Microsoft".

Local login#

Hide local login form#

hide_local_login — when on, the standard username/password form is hidden on the default login screen. It remains reachable at the hidden local login URL. Has no effect on password reset, registration, or other login actions.

Restrict local login#

restrict_local_login — when on (default), only accounts marked Allow local login may authenticate with a username and password. All other users must use the Microsoft button. This is a genuine access control, unlike "Hide local login form" which is only cosmetic.

• Enforcement only kicks in once SSO is enabled and configured, so you can't be locked out during setup.
• On activation, office@dowo.digital is granted Allow local login automatically if that account exists.
• Grant the flag to other accounts on their Users → Edit profile screen, under DOWO Entra Login → Local login.
• If the restriction is active but no account is allowed, every admin screen shows a lockout warning.

The per-account flag is stored as the dowo_wpentra_allow_local user meta. See LOCAL-LOGIN.md.

Hidden local login key#

local_login_key — the query argument that reveals the local form. With a value of dowo, the URL is wp-login.php?dowo=1. Use a non-obvious value if you want extra obscurity. See LOCAL-LOGIN.md.

Redirect#

Redirect after login#

redirect_after_login — optional URL to send users to after a successful Entra sign-in. If a redirect_to was present on the login request (e.g. a deep link to a protected page), that takes precedence. Otherwise this value is used, and if it's blank the admin dashboard is used. The final value is passed through wp_safe_redirect(), so off-site URLs are blocked.

Defaults#