Restrict WordPress Access by Microsoft Entra ID (Azure AD) Group Membership

Each Microsoft Entra ID group is identified by a permanent Object ID, which the plugin can use to enforce access rules. Because these Object IDs never change, restrictions remain accurate even if a group is renamed or updated.

When a user attempts to sign in through Entra ID (Azure AD) Single Sign On (SSO), the plugin checks their group membership at that moment. It first reads the Object IDs from the login token issued by Entra ID. If Microsoft Graph API integration is enabled, the plugin can also retrieve the user’s current group memberships directly from Microsoft Graph.

These Object IDs are then compared against the list of groups you have authorized for WordPress access. If a match is found, login is allowed; if no match exists, the attempt is blocked.

Suppose your WordPress site is available only to members of the LegalTeam security group. Anyone inside that group can sign in automatically, while users from other departments will be denied. If a lawyer transfers out of the team and is removed from the group, their WordPress access ends immediately at the next login.

Key Benefits

Restricting WordPress access to Azure AD groups provides strong control over who can access your site.

• Protect sensitive content by ensuring only members of designated groups are allowed to perform Single Sign On (SSO).
• Stay synchronized automatically as group membership changes in Microsoft Entra ID are detected at login and immediately reflected in WordPress.
• Align access with organizational needs by applying rules for individual project teams, entire departments, or large business units.
• Block unauthorized accounts completely by denying sign‑in for anyone outside of the approved groups, preventing them from creating a session or accessing the sensitive content.

Requirements

Before you enable Azure AD group‑based restrictions, check that your environment is prepared:

• The All‑in‑One Microsoft Office 365 Apps Plugin is installed and active on your WordPress site with Single Sign On (SSO) configured.
• You have Global Administrator or equivalent rights in Entra ID to enable group claims.
• You have WordPress Administrator privileges to configure access restriction rules.
• Optional: Microsoft Graph API integration is enabled if group checks must extend beyond the login token claims.