How do I map Azure AD roles to WordPress roles?

In the Azure AD SAML configuration, you can send group memberships as claims. Most SSO plugins, like MiniOrange or WPO365, let you map an Azure AD group (e.g., 'WordPress Editors') to a native WordPress role (e.g., 'Editor'). This mapping is done in the plugin settings, where you specify the attribute name (e.g., 'group') and assign the role for each group. Users not in any mapped group become Subscribers by default.

Will this work with WordPress multisite?

Yes, Azure AD login can be configured for WordPress multisite, but you'll need to verify that your chosen plugin supports it explicitly. Multisite changes the reply URL and how roles are mapped across subsites. Some plugins like WPO365 offer advanced network configuration. We recommend setting up a test subsite first to ensure that login redirects, role assignments, and user provisioning behave correctly.

Is Azure AD login GDPR compliant?

Azure AD itself is GDPR compliant, and Microsoft provides extensive documentation and contractual commitments under the Data Processing Addendum. However, GDPR compliance also depends on how you configure WordPress and your plugin. You must update your privacy policy to mention Azure AD, whether you enable additional tracking, and how long you keep logs. Also, ensure you provide data export and deletion mechanisms, as required by UK GDPR.

Can I use Azure AD B2C for customer-facing WordPress sites?

Yes, Azure AD B2C is designed for external customer identities and can be integrated with WordPress using plugins that support OpenID Connect. This is ideal for UK businesses with customer portals or member areas. It allows customers to sign in with social accounts or email/password, and you can enforce localised policies (e.g., UK GDPR consent). Be aware that B2C is billed separately from your internal Azure AD, so estimate costs first.

WordPress Azure AD Login (Anmeldung) for UK Organisations

17 August 2026

Learn how to configure Azure AD single sign-on for WordPress in the UK. Step-by-step setup, security tips, and UK-specific compliance.

Read this page in: Deutsch

Why UK Organisations Need Azure AD SSO for WordPress

If your UK organisation uses Microsoft 365, you likely already manage user identities in Azure AD (now Microsoft Entra ID). Integrating WordPress with Azure AD allows your staff, partners, and even customers to sign in using their existing Microsoft credentials—no separate passwords to remember. This reduces IT support tickets, improves user experience, and enforces centralised security policies. For UK-based schools, charities, and public sector bodies, this also aligns with the Government Digital Service (GDS) design principles, where single sign-on is the expected norm. More importantly, it ensures that when someone leaves the organisation, their WordPress access is revoked automatically when their Azure AD account is disabled, closing a common security gap faced by many UK administrators.

Pre-requisites for the Integration

Before you start, ensure you have the right access and configuration in place. You'll need an Azure AD tenant—this is almost certainly already included with your Microsoft 365 subscription. You'll also need a user account with Global Administrator or Application Administrator privileges to register a new enterprise application. On the WordPress side, your site must be running on HTTPS; Azure AD won't accept insecure endpoints. We recommend a hosted WordPress plan or a VPS where you can install plugins. Also, decide whether you will use the SAML 2.0 or OpenID Connect protocol. SAML works with most WordPress SSO plugins, but OpenID Connect is lighter and better suited for modern APIs. For UK public sector, you may need to confirm your Azure tenant is in the UK data region to comply with data residency requirements.

Step-by-Step Configuration in the Azure Portal

Start by logging into the Azure Portal (portal.azure.com) and navigating to 'Microsoft Entra ID'. Under 'Manage', select 'Enterprise applications', then click 'New application' > 'Create your own application'. Give it a name like 'WordPress - UK Staff Login'. Next, choose 'Integrate any other application you don't find in the gallery' and set the 'Single Sign-on' method to 'SAML'. You'll need the 'Identifier (Entity ID)' and 'Reply URL' from your WordPress plugin—often these are yourdomain.com/wp-login.php or a custom SAML endpoint. Paste those values into the Azure configuration. Add users or groups from your directory who should have access to WordPress. After saving, note the 'Login URL' and 'Logout URL'—you'll use these in the WordPress plugin. Finally, download the SAML signing certificate (Base64) for the encryption handshake.

Installing and Configuring the WordPress Plugin

In your WordPress admin dashboard, go to 'Plugins' > 'Add New' and search for 'Azure AD SSO' or 'SAML Single Sign On'—popular choices include 'MiniOrange SAML' and 'WPO365'. We advise testing with a staging site first. Install and activate the plugin, then locate its settings under a new 'Azure AD' or 'SAML SSO' menu. You'll need to enter the Azure AD Login URL, Logout URL, and the certificate you downloaded earlier. Also specify the attribute that corresponds to the WordPress username (usually 'UserPrincipalName' or 'email'). Map Azure AD groups to WordPress roles so that, for example, all members of the 'Staff' group become Subscribers, while 'Editors' map to the Editor role. Finally, enable a 'force login' option if you want to restrict entire site access, and test with a test user before rolling out to everyone.

Security and Compliance Considerations for UK Organisations

Under the UK GDPR and the Data Protection Act 2018, you need to ensure that personal data processed via SSO is handled lawfully. Azure AD allows Multi-Factor Authentication (MFA) which is a strong measure we recommend enabling for all WordPress admin users. Be aware that when users authenticate via Azure AD, you're sharing IP addresses and login timestamps with Microsoft—these are covered by the Microsoft Data Processing Addendum. For UK public bodies, use the 'Azure AD UK' data residency and ensure you understand where your data flows. Also, set up Azure AD diagnostic logs to review sign-ins, and configure conditional access policies to restrict logins to UK IP ranges or trusted devices. Finally, keep your WordPress plugin updated; SSO plugins are high-value targets for attackers.

FAQ

There isn't one 'best' plugin for every UK organisation, but widely recommended options are WPO365 and MiniOrange SAML SSO. WPO365 is excellent for deeply integrated Microsoft 365 features, while MiniOrange is lightweight and flexible. Both support Azure AD SAML and OpenID Connect. Trial them on a staging site and choose based on your specific needs, such as multisite support or enforcement of MFA.

azure ad wordpress single sign on uk wordpress saml authentication azure ad azure ad login wordpress plugin uk

Latest guides

Csrf protection wordpress — Best Options in the UK (2026)Fastest wordpress hosting uk — Best Options in the UK (2026)Oauth2 wordpress login — Best Options in the UK (2026)Uk wordpress hosting reviews — Best Options in the UK (2026)Wordpress hosting uk — Best Options in the UK (2026)Wordpress security — Best Options in the UK (2026)