When checked, the plugin will intercept any login attempt and check whether the user name entered in the login form is a valid Office 365 Azure AD user name. If yes, the plugin will forward the login request to Microsoft instead.

The plugin will skip session validation for pages (without host or path) entered here. For example, the wp-login.php entry in this list makes it possible that you can still navigate to the default WordPress login page and logon using a WordPress-only account.

An absolute URL where Office 365 users, who attempted to sign in manually, will be redirected to after successfully signing in with Microsoft.

When checked, the plugin won’t allow users that are not administrators to change their passwords.

When checked, the plugin will intercept any attempt by the user to change his/her email address and prevent it.

Optionally, the plugin retrieves additional Office 365 user fields and a user’s profile phoot by calling the Microsoft Graph. To be able to do so, you will need to create an App Key for your registered app in the Azure Portal.

Select ‘Intranet’ to secure both WordPress front- and backend and ‘Internet’ to secure only the backend with WPO365-login.

When checked, the plugin will retrieve additional fields e.g. Job Title, Office Location, Mobile Phone and Business Phone Numbers from Microsoft Graph and adds these to a new “Office 365 Profile Information” user profile section.

A nonce is a “number used once” and is used to test the integrity of requests sent by the plugin to Microsoft.