Configuration Reference

All settings live under Settings → Entra Login in the WordPress admin and are stored in a single option, dowo_wpentra_settings.

Connection#

Enable Entra SSO#

enabled — master switch. When on, the Sign in with Microsoft button appears on the login screen. The button only shows when the plugin is fully configured (tenant ID, client ID, and client secret all present), regardless of this toggle.

Directory (tenant) ID#

tenant_id — the tenant GUID from your Entra app registration's Overview page. Used to build the authority URL https://login.microsoftonline.com/{tenant}. It must be a GUID: the multi-tenant authorities common, organizations and consumers are rejected, and every ID token's tid claim must match it.

Application (client) ID#

client_id — the application GUID from the Overview page. Also validated as the ID token aud (audience) claim.

Client secret#

client_secret — the secret Value (not the Secret ID) from Certificates & secrets. Stored in the options table unless defined as a wp-config.php constant (see HOOKS.md), in which case it is never written to the database. Leave the field blank when saving to keep the previously stored value. Rotate it before it expires in Entra.

User mapping#

Users are matched to WordPress accounts by Entra object ID first, then by email address. On a user's first sign-in the email claim is compared against WordPress user emails and the matched (or newly provisioned) account is bound to the token's oid in user meta (dowo_wpentra_oid, plus dowo_wpentra_tid). From then on that account only accepts sign-ins carrying the same oid – a changed or spoofed email claim cannot reach it – and the user is found by oid even if their email has since changed. If no account matches, it is either provisioned (if enabled) or rejected.

The email is read from the email claim, falling back to preferred_username when that is itself an email address. If Entra returns no email or no oid, sign-in is refused with a clear message. To re-link an account to a different Microsoft identity, an administrator deletes its dowo_wpentra_oid user meta.

Auto-provision users#

auto_provision — when on, a WordPress user is created automatically on first successful Entra sign-in. When off, the user must already exist or sign-in is refused with a clear message.

Default role for new users#

default_role — the role assigned to auto-provisioned users. Only used when auto-provisioning. Defaults to subscriber. Choose the least privilege that fits your site.

Allowed email domains#

allowed_domains — optional comma- or newline-separated list of domains (e.g. dowodigital.com). When set, only identities whose email domain is on the list may sign in via Entra. Leave blank to allow any account from your tenant. This is enforced in addition to any Entra-side user assignment.

Appearance#

Sign-in button label#

button_label — the text on the Microsoft button. Defaults to "Sign in with Microsoft".

Local login#

Hide local login form#

hide_local_login — when on, the standard username/password form is hidden on the default login screen. It remains reachable at the hidden local login URL. Has no effect on password reset, registration, or other login actions.

Restrict local login#

restrict_local_login — when on (default), only accounts marked Allow local login may authenticate with a username and password. All other users must use the Microsoft button. This is a genuine access control, unlike "Hide local login form" which is only cosmetic.

• Enforcement only kicks in once SSO is enabled and configured, so you can't be locked out during setup.
• On activation, office@dowo.digital is granted Allow local login automatically if that account exists.
• Grant the flag to other accounts on their Users → Edit profile screen, under DOWO Entra Login → Local login.
• If the restriction is active but no account is allowed, every admin screen shows a lockout warning.

The per-account flag is stored as the dowo_wpentra_allow_local user meta. See LOCAL-LOGIN.md.

Hidden local login key#

local_login_key — the query argument that reveals the local form. With a value of dowo, the URL is wp-login.php?dowo=1. Use a non-obvious value if you want extra obscurity. See LOCAL-LOGIN.md.

Redirect#

Redirect after login#

redirect_after_login — optional URL to send users to after a successful Entra sign-in. If a redirect_to was present on the login request (e.g. a deep link to a protected page), that takes precedence. Otherwise this value is used, and if it's blank the admin dashboard is used. The final value is passed through wp_safe_redirect(), so off-site URLs are blocked.

Defaults#