How does Azure AD integrate with WordPress?

Azure AD (now Microsoft Entra ID) integrates with WordPress using the SAML 2.0 protocol. You create a custom enterprise application in Azure AD, configure it with the WordPress site's SAML endpoint, and then install a WordPress SAML plugin. The plugin handles the SAML handshake: when a user visits the WordPress login page, they are redirected to Azure AD, authenticate there, and are then sent back with a SAML assertion that WordPress trusts. This ensures that only users with valid Azure AD accounts can log in.

Which WordPress SAML plugin works best with Azure AD?

Several plugins work well with Azure AD. Popular choices include miniOrange SAML SSO, SAML Single Sign On by OneLogin, and WP SAML Auth. Each supports SAML 2.0 and offers features like role mapping and user auto-provisioning. For UK organisations, consider the plugin's data residency policy and GDPR compliance. MiniOrange offers a free version and is widely used, while OneLogin's plugin is solid if you already use their identity platform. Test a couple to see which handles Azure AD's attribute mappings most smoothly for your specific setup.

Is SAML better than OAuth for WordPress?

SAML and OAuth serve different purposes. SAML is designed for enterprise SSO and supports server-to-server authentication, making it ideal for WordPress admin and member sites where you need to control access centrally. OAuth, on the other hand, is often used for delegated API access, such as allowing a plugin to access Google Workspace. For logging users into WordPress with Azure AD, SAML is the standard choice because it provides a robust, secure way to pass identity attributes. OAuth is more suitable for integrating external apps without exposing credentials, but SAML is typically easier for full SSO with Azure AD.

Does Azure AD SAML cost extra?

No, SAML SSO is a standard feature of all Azure AD (Entra ID) plans, including the free tier. The free tier supports unlimited SAML applications, so you can integrate WordPress without paying extra for Azure AD. However, you may need a premium plan if you want advanced features like conditional access policies, MFA, or self-service password reset, which are often essential for UK businesses with strict security requirements. The WordPress SAML plugin itself may have a premium version, but many offer free tiers sufficient for basic SSO setup.

WordPress SAML Authentication with Azure AD: The 2026 UK Guide

17 August 2026

Learn how to set up WordPress SAML authentication with Azure AD (Entra ID) in the UK. Step-by-step guide, GDPR tips, and plugin options.

Read this page in: Deutsch

Why Use SAML for WordPress in the UK?

SAML (Security Assertion Markup Language) is the gold standard for enterprise single sign-on. For UK organisations, using SAML with WordPress means your staff and members can log in with their existing Azure AD credentials, eliminating the need to remember separate passwords. This not only improves user experience but also strengthens security by centralising access control. With the UK's growing focus on cyber resilience, especially after NCSC guidance, SAML provides a robust way to enforce multi-factor authentication and conditional access policies. It also simplifies user provisioning and deprovisioning, ensuring that when someone leaves your organisation, their WordPress access is revoked automatically. For charities, universities, and public sector bodies, SAML is often a compliance requirement.

Azure AD vs Microsoft Entra ID: What UK Businesses Need to Know

In 2023, Microsoft rebranded Azure Active Directory to Microsoft Entra ID, but the underlying service remains the same. Many UK businesses still search for 'Azure AD', so you'll find that term used widely. If your organisation uses Microsoft 365, you already have Entra ID. It supports SAML 2.0 federation, which means you can connect it to WordPress easily. For UK organisations, it's important to understand that Entra ID allows you to control data residency. You can choose to keep your user directory data within the UK or EU, which is crucial for GDPR compliance. When configuring WordPress SAML, you'll still see Azure AD references in the Azure portal, but you're actually working with Entra ID. Both names refer to the same identity service.

Setting Up SAML in WordPress with Azure AD: A Step-by-Step Overview

To connect WordPress to Azure AD via SAML, you'll need a SAML plugin and a custom enterprise application in Azure. First, install and activate a reliable SAML plugin like 'SAML Single Sign On' or 'miniOrange'. Then, in the Azure portal, register a new enterprise application and configure SAML SSO. You'll need to provide the WordPress ACS URL and Entity ID, which the plugin generates. Next, download the certificate and metadata from Azure and upload them to your WordPress plugin. After mapping user attributes like email and first name, you can test the login flow. Once successful, you can enforce SAML-only authentication to lock out default WordPress logins. This process typically takes under an hour, but it's essential to have both Azure admin and WordPress admin access ready.

Choosing the Right WordPress SAML Plugin for Azure AD

The plugin market for WordPress SAML is crowded, but not all are created equal. For Azure AD, look for a plugin that supports SAML 2.0, automatic user provisioning, and role mapping. Popular options include miniOrange SAML, SAML Single Sign On (from OneLogin), and WP SAML Auth. In the UK, you may also want a plugin that offers GDPR-friendly data handling and no external data sharing. Free versions often limit you to basic SSO, while premium versions add features like group-based access and multi-tenant support. Before committing, check that the plugin is actively maintained and compatible with the latest WordPress version. Read UK-specific reviews to see how well the plugin handles issues like user email matching and session timeouts, which can affect daily productivity.

GDPR and Data Residency Considerations for UK Organisations

When implementing SAML authentication, UK organisations must ensure that user data processed during login complies with GDPR and the UK Data Protection Act. Azure AD gives you control over where your data is stored, with UK South and UK West data centres available. By default, Microsoft may process authentication logs in other regions, so you should configure data residency to keep everything within the UK if that's your preference. Also, consider what data the WordPress plugin stores locally. Most SAML plugins store user attributes such as email and name in your WordPress database. You need to document this in your privacy policy and ensure you have lawful bases for processing. For public sector bodies, the UK Government's 'Cloud First' policy and NCSC guidance make Azure AD a strong choice, but you should always conduct a Data Protection Impact Assessment (DPIA).

FAQ

SAML (Security Assertion Markup Language) is an open standard for exchanging authentication and authorisation data. For WordPress, SAML authentication allows users to sign in using an external identity provider, such as Azure AD, instead of entering a WordPress-specific username and password. This enables single sign-on (SSO), meaning users have to authenticate once to access both their Microsoft 365 account and WordPress. It centralises security, making it easier to enforce multi-factor authentication and manage user access from one place.

Microsoft Entra ID WordPress SSO WordPress SSO UK GDPR Azure AD WordPress plugin

Latest guides

Study schedule app for students — Best Options in the UK (2026)A level study planner printable — Best Options in the UK (2026)User access control cyber essentials — Best Options in the UK (2026)Javascript null checking — Best Options in the UK (2026)Javascript nullish coalescing — Best Options in the UK (2026)Headless cms vs traditional cms for seo — Best Options in the UK (2026)