=== WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) ===
Contributors: wpo365
Tags: Microsoft, SSO, PowerBI, Sharepoint, Email
Requires at least: 5.0
Tested up to: 6.8
Stable tag: 37.2
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

WordPress + Microsoft Entra | Ext. ID | B2C | M365 Integration for your Digital Workplace. For SSO, Mail, Roles, Access, Profiles, SharePoint, PowerBI ...

== Description ==

WordPress + Microsoft Entra | Ext. ID | B2C | M365 Integration for your Digital Workplace. For SSO, Mail, Roles, Access, Profiles, SharePoint, PowerBI ...

= SINGLE SIGN-ON (SSO) =

- Enable Microsoft based Single Sign-on [more](https://www.wpo365.com/feature/single-sign-on/)
- Supported Identity Providers (IdPs): **Azure Active Directory**, **Azure AD B2C**, **Entra External ID (Azure AD for Customers)** [more](https://docs.wpo365.com/article/158-select-identity-provider-idp)
- Supported SSO protocols: **OpenID Connect** and **SAML 2.0** [more](https://docs.wpo365.com/article/159-select-sso-protocol)
- Supported OpenID Connect User Flows: Authorization Code User Flow (recommended) and Hybrid User Flow [more](https://docs.wpo365.com/article/156-why-the-authorization-code-user-flow-is-now-recommended)

= NEW USERS =

- New users that sign in with Microsoft automatically become WordPress users [more](https://www.wpo365.com/feature/single-sign-on/)

= INTRANET =

- Configure the **intranet** authentication mode to restrict access to all front-end posts and pages [more](https://www.wpo365.com/article/building-a-wordpress-based-intranet-restrict-access/)
- Hide the  **WordPress Admin Bar** for specific roles [more](https://docs.wpo365.com/article/150-hide-wp-admin-bar-for-roles)

= MAIL =

- **Send emails using Microsoft Graph** instead of SMTP from your WordPress website [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)
- Choose between a Microsoft 365 account or a personal Microsoft account, like Hotmail.com or Outlook.com, to send WordPress emails
- Send as **HTML**
- Save to the **Sent Items** folder
- Support for **file attachments**

= SCIM =

- Entra **User Provisioning** (SCIM) [more](https://www.wpo365.com/feature/azure-ad-user-provisioning-scim/)
- **Create** new WP Users

= MICROSOFT TEAMS =

- Support for (seamless) integration of your WordPress website into a **Microsoft Teams** Tabs and Apps [more](https://www.wpo365.com/feature/microsoft-teams/)

= POWER BI =

- Embed Microsoft **Power BI** content (user owns data) [more](https://www.wpo365.com/feature/power-bi-embed/)

= SHAREPOINT =

- Embed a **SharePoint Online** library [more](https://www.wpo365.com/feature/sharepoint-onedrive-library/)
- Embed a **SharePoint Online** list [more](https://www.wpo365.com/feature/sharepoint-list/)
- Embed an **Outlook / Exchange** calendar [more](https://www.wpo365.com/feature/outlook-exchange-calendar/)
- Embed a **SharePoint Online** search [more](https://www.wpo365.com/feature/sharepoint-search/)

= EMPLOYEE DIRECTORY =

- Embed an intuitve Azure AD / Microsoft Graph based **Employee Directory** into a front-end post or page [more](https://www.wpo365.com/feature/employee-directory/)

= WORDPRESS MULTISITE =

- Support for **WordPress Multisite** [more](https://www.wpo365.com/feature/wordpress-multisite/)

= REST API ENDPOINT PROTECTION =

- Protect your **WordPress REST API** endpoints with a combination of a WordPress cookie and a nonce for delegated access [more](https://docs.wpo365.com/article/151-wordpress-cookies-based-protection-for-the-wordpress-rest-api)

= DEVELOPERS =

- Developers can now connect to a RESTful API for Microsoft Graph in their favorite programming language and without the hassle of authentication and authorization [more](https://docs.wpo365.com/article/129-a-restful-proxy-to-microsoft-graph-inside-wordpress)
- *PHP hooks* for developers to build custom Microsoft Graph / Office 365 integrations [more](https://docs.wpo365.com/article/82-developer-hooks)

https://youtu.be/S9tiASl1nH0

**ADD FUNCTIONALITY WITH PREMIUM EXTENSIONS**

The features below can be unlocked with [premium addOns and bundles](https://www.wpo365.com/pricing/).

= SYNC =

- Full **User Sync** using MS Graph from Entra to WordPress [more](https://www.wpo365.com/feature/user-synchronization/)
- **Create** new WP Users
- **Update** existing WP Users
- (Soft) **Delete** existing WP Users

*WP User Roles, Profiles and Avatars will be updated and other rules e.g. LearnDash Enrollments will be applied*

= SCIM =

- Integrate with Entra **User Provisioning** (SCIM) [more](https://www.wpo365.com/feature/azure-ad-user-provisioning-scim/)
- **Create** new WP Users
- **Update** existing WP Users
- (Soft) **Delete** existing WP Users
- **Map User Attributes** beyond name and email and store as WordPress user meta

*WP User Roles, Profiles and Avatars will be updated and other rules e.g. LearnDash Enrollments will be applied*

= ROLES + ACCESS =

- Assign WordPress roles by Entra Groups, Entra User Attributes, Domains and / or App Roles [more](https://www.wpo365.com/feature/roles-access/)
- Restrict access to site / pages by Entra Groups, Domains and / or WPO365 Audiences [more](https://www.wpo365.com/feature/roles-access/)
- Redirect after login by Entra Groups and / or Domains [more](https://www.wpo365.com/feature/roles-access/)

= LEARNDASH =

- Auto-Enroll WP Users in LearnDash Courses and Groups by Entra Groups, Domains and / or Defaults [more](https://www.wpo365.com/feature/learndash/)

= CUSTOM USER FIELDS =
- Enhance WordPress / BuddyPress User Profiles with **Entra User Attributes** [more](https://www.wpo365.com/feature/custom-user-fields/)

= MAIL =

- Auto-retry to deliver emails that failed to send [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)
- Send attachments larger than 3MB  [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)
- Send as / On behalf [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)
- Send from a Shared Mailbox [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)
- Enable Staging Mode [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)
- Mail Throttle [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)
- Send as BCC [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)
- Default Reply-To [more](https://www.wpo365.com/feature/send-mail-using-ms-graph/)

= MICROSOFT 365 APPS =

- Power BI [more](https://www.wpo365.com/feature/power-bi-embed/)
- SharePoint Library [more](https://www.wpo365.com/feature/sharepoint-onedrive-library/)
- SharePoint List [more](https://www.wpo365.com/feature/sharepoint-list/)
- SharePoint Search [more](https://www.wpo365.com/feature/sharepoint-search/)
- Exchange Calendar [more](https://www.wpo365.com/feature/outlook-exchange-calendar/)
- Viva Engage [more](https://www.wpo365.com/feature/yammer-for-wordpress/)
- Employee Directory [more](https://www.wpo365.com/feature/employee-directory/)

= ADVANCED LOGIN OPTIONS =

- Support for Multitenancy [more](https://www.wpo365.com/feature/advanced-login-options/)
- Support for multiple IdPs [more](https://www.wpo365.com/feature/multiple-identity-providers/)
- Force SSO [more](https://www.wpo365.com/feature/advanced-login-options/)
- Dual Login [more](https://www.wpo365.com/feature/advanced-login-options/)
- Intercept manual login [more](https://www.wpo365.com/feature/advanced-login-options/)
- Prevent pwd. / email change [more](https://www.wpo365.com/feature/advanced-login-options/)
- Single Sign-out [more](https://www.wpo365.com/feature/advanced-login-options/)
- Sign out of M365 [more](https://www.wpo365.com/feature/advanced-login-options/)
- Custom login URL [more](https://www.wpo365.com/feature/advanced-login-options/)
- Custom loading template [more](https://www.wpo365.com/feature/advanced-login-options/)
- B2C custom domain [more](https://www.wpo365.com/feature/advanced-login-options/)
- Embedded B2C login [more](https://www.wpo365.com/feature/advanced-login-options/)
- Custom new User email [more](https://www.wpo365.com/feature/advanced-login-options/)

= AVATAR =

- M365 Profile Picture as WordPress / BuddyPress Avatar [more](https://www.wpo365.com/feature/avatar/)

= REST API ENDPOINT PROTECTION =

- Enable **Azure AD** based protection for your **WordPress REST API** endpoints [more](https://docs.wpo365.com/article/147-azure-ad-based-protection-for-the-wordpress-rest-api)

= CONFIGURATION =

- Save multiple configurations
- Directly edit (the JSON representation of) a configuration

== Prerequisites ==

- Make sure that you have disabled caching for your Website, especially when you configure a WordPress based intranet and access to WP Admin and all pubished pages and posts requires authentication. With caching enabled, the plugin may not work as expected
- We have tested our plugin with Wordpress >= 5 and PHP >= 7.4
- You need to Entra ID Tenant Administrator to configure both Azure Active Directory and the plugin
- When configuring a WordPress based intranet, you should consider restricting access to the otherwise publicly available wp-content directory [more](https://docs.wpo365.com/article/36-authentication-scenario)

== Support ==

We will go to great length trying to support you if the plugin doesn't work as expected. Go to our [Support Page](https://www.wpo365.com/how-to-get-support/) to get in touch with us. We haven't been able to test our plugin in all endless possible Wordpress configurations and versions so we are keen to hear from you and happy to learn!

== Feedback ==

We are keen to hear from you so share your feedback with us and contact us using the [contact form](https://www.wpo365.com/contact/) on our website!

== Open Source ==

When you’re a developer and interested in the code you should have a look at our repo over at [WordPress](http://plugins.svn.wordpress.org/wpo365-login/).

== Installation ==

Please check out [our Getting Started page](https://docs.wpo365.com/category/21-getting-started) for detailed installation and configuration instructions.

== Frequently Asked Questions ==

Please check out [our online FAQs](https://docs.wpo365.com/category/26-support) for answers to commonly asked questions.

== Screenshots ==
1. Microsoft / Azure AD based Single Sign-on
2. Embedded Power BI for WordPress
3. Embedded SharePoint Online Documents for WordPress
4. Embedded SharePoint Online Search for WordPress
5. Employee Directory
6. Support for Azure AD B2B and Azure AD B2C
7. Sending WordPress email using Microsoft Graph
8. Synchronizing users from Azure AD to WordPress
9. Embed WordPress in a Teams Tab or App
10. Assign WordPress roles / Deny access based on Azure AD groups

== Upgrade Notice ==

Please check the [online change log](https://www.wpo365.com/change-log/) for upgrade notices.

== Changelog ==

Also available [online](https://www.wpo365.com/change-log/).

= v37.2 =
* Fix: WPO365 will avoid using "wp_print_inline_script_tag" and instead create a <script> tag itself, if the active WordPress theme does not declare support for the 'html5' and 'script' features. [ALL]

= v37.1 =
* Improvement: The built-in WordPress Mailer for Microsoft Graph now supports [RBAC for Exchange Online](https://learn.microsoft.com/en-us/Exchange/permissions-exo/application-rbac). As a result, administrators should now explicitely configure the desired authorization scenario, as explained in a [new lesson in the tutorial](https://tutorials.wpo365.com/courses/email-configure-microsoft-graph-mailer/lessons/select-authorization-scenario/). [LOGIN, MICROSOFT GRAPH MAILER]
* Improvement: All scripts now are created using either wp_print_script_tag or wp_print_inline_script_tag. As a result, developers can add your own nonce attribute using the wp_script_attributes and wp_inline_script_attributes filters e.g. to enable a Content-Security-Policy (or CSP). [LOGIN, MICROSOFT GRAPH MAILER]
* Fix: For premium plugins, WPO365 would check the license status with every admin request, which could slow down your site unnecessarily. [ALL PREMIUM]
* Fix: Some features were not included in the Plugin Self-Test for the CUSTOMERS premium plugin. [CUSTOMERS]

= v37.0 =
* Improvement: As of version 37.0, creating new users through the SCIM-based integration with the Microsoft Entra ID Application/User Provisioning service is now available as a free feature. [Get started today!](https://tutorials.wpo365.com/courses/sync-entra-user-provisioning-scim/) [LOGIN]
* Improvement: Beginning with version 37.0, WPO365 | LOGIN - available at no cost - can now also populate a new WordPress user's name and email profile attributes, a capability that previously required the PROFILE+ add-on. [LOGIN]
* Improvement: It is now possible to schedule WPO365 User Synchronization without the need to rely on WP Cron by triggering both the start of a new user-sync job and the processing of each batch using an external task scheduler. See the [updated tutorial](https://tutorials.wpo365.com/courses/synchronize-users-from-azure-ad-to-wordpress/lessons/choose-your-user-synchronization-trigger/) for details. [INTEGRATE (SYNC, INTRANET)]
* Improvement: A new filter has been added that allows developers to filter the custom Error Page URL. Consult the [updated documenations](https://docs.wpo365.com/article/82-developer-hooks) for details. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Improvement: Administrators experiencing issues with WPO365 User Synchronization or the SCIM-based integration with the Microsoft Entra ID Application/User Provisioning service, can now enable a custom logging function that helps collect more data in a separate server log. [SCIM, INTEGRATE, CUSTOMERS (SYNC, INTRANET)]
* Fix: An issue - previously causing a critical error when creating a new WordPress Network Subsite for a new user without a valid email address - has been resolved. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Fix: A bug has been fixed that prevented WPO365 from detecting whether or not a user should be considered a user that signed in with Microsoft and preventing users from changing their email address or password. [LOGIN]
* Fix: A few issues related to saving an (updated) WPO365 configuration (as JSON) on the plugin's "Import / Export" page have been addressed.
* Fix: The sub headers of the wizard now will support rtl-direction.

= v36.2 =
* Fix: Functionality for forcing SSO for the (default / custom) login page has been restored. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]

= v36.1 =
* Improvement: Confirms support for WordPress 6.8. [ALL]
* Improvement: An administrator can define a (list of) referrer(s) that are allowed to send credentials to the login page when SSO is forced for the login page. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Improvement: Configuring a "GCC (High)" tenant using wp-config.php is now supported for both single and multiple IdP scenarios. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Fix: The function of the "Public Homepage" setting has been restored. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Fix: Support for the plugin [User Switching](https://wordpress.org/plugins/user-switching/) has been restored when SSO is forced for the login page. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Fix: When an administrator configures WPO365 for WPMU to allow partial independence for each subsite, WPO365 will now always require users to re-authenticate when navigating between subsites. [ALL]
* Fix: When "WPO365 User Synchronization" fails because its next-link has expired, it will now correctly send a "failure" notification. [INTEGRATE (SYNC, INTRANET)]

= v36.0 =
* Breaking Change: A previous update that redirected users without privileges for the site they requested to their dashboard URL or primary site in a WordPress Multisite Network has been rolled back. Now, WPO365 will display an access-denied splash screen instead, notifying the user of the denied access. If the user has already authenticated successfully, the screen will also show a list of sites where they have do privileges. [LOGIN]
* Breaking Change: WPO365 will no longer redirect a user back to the login page of the site they requested in a WordPress Multisite Network when they do not have privileges to access that site. Instead WPO365 will display an access-denied splash screen, notifying the user of the denied access. If the user has already authenticated successfully, the screen will also show a list of sites where they have do privileges. [LOGIN]
* Improvement: The Calendar app (to embed an Exchange / Outlook Calendar in WordPress) can now be configured to show the personal calendar of the logged-in user. The [tutorial](https://tutorials.wpo365.com/courses/embed-an-exchange-calendar-in-wordpress/) has been updated accordingly. [APPS, INTEGRATE (INTRANET)]
* Improvement: The plugin can now also secure the WordPress REST API using App Roles / application-level access tokens (obtained using the client-credentials flow). The [documentation](https://docs.wpo365.com/article/147-azure-ad-based-protection-for-the-wordpress-rest-api) has been updated support for this scenario. [ESSENTIALS, PROFESSIONAL, INTEGRATE (LOGIN+, SYNC, INTRANET)]
* Improvement: Users that are able to bypass SSO for the login page - by adding the secret key to the URL - are now also able to request a password-reset link and reset their password accordingly. [ESSENTIALS, PROFESSIONAL, CUSTOMERS, INTEGRATE (LOGIN+, SYNC, INTRANET)]
* Improvement: Administrators can now configure WPO365 to use a user's email username as the domain for a new (WordPress Multisite) network subsite (instead of the user's stringified WP User ID). [ESSENTIALS, PROFESSIONAL, CUSTOMERS, INTEGRATE (LOGIN+, SYNC, INTEGRATE)]
* Fix: The favicon.ico file will now automatically be added to the list of pages freed from authentication, since - on WordPress Multisite - a user may request this file from the main site where the user does not have any privileges. [LOGIN]
* Fix: The plugin will now also redirect users attempting to access the login page when the administrator has enabled SSO for the login page and the user is already logged in. [ESSENTIALS, PROFESSIONAL, CUSTOMERS, INTEGRATE (LOGIN+, SYNC, INTRANET)]
* Fix: WPO365 now will remove any duplicate slashes from the current request URI, to prevent attackers to bypass - for example - SSO when it's forced for the login page. [LOGIN]
* Fix: The powerbi-client package has been updated to its latest version. [LOGIN, APPS, INTEGRATE (INTRANET)]
* Fix: Fixed a string-format error that caused a critical error when the option to "Create new users in WordPress" would have been unchecked. [ALL PREMIUM]
* Fix: The TLD "lan" has been added to the license-checker list of exceptions. [LOGIN, MSGRAPHMAILER]
* Fix: "WPO365 Audiences" checkboxes on the Users, Posts and Pages screens in WP Admin now again are being displayed correctly. [ROLES + ACCESS, PROFESSIONAL, INTEGRATE (SYNC , INTRANET)]
* Fix: An issue causing - under specific circumstances - an "array-to-string conversion" warning in the Url_Helpers class has been resolved. [LOGIN, MSGRAPHMAILER]

= v35.0 =
* Feature: Create a new (WordPress Network / Multisite) blog for a user when they sign in with Microsoft for the first time. Consult the [online documentation](https://docs.wpo365.com/article/226-create-a-new-wpmu-blog-upon-first-login) for details. [ESSENTIALS, PRO, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Improvement: A WordPress Network Multisite super admin can now switch between "shared" and "dedicated" mode when they go to My Sites > Network Admin > WPO365 > User Registration. The entry in wp-config.php will also still be honoured. See the [updated documentation](https://docs.wpo365.com/article/29-support-for-wordpress-multisite-wpmu) [LOGIN]
* Improvement: All source-code is now constantly reviewed for violations of coding standards (using phpcs) and if possible corrected to adhere to the WordPress Coding Standards.
* Improvment: An administrator of a blog that is a subsite of a WordPress Network / Multisite can now also administer the WPO365 configuration. [LOGIN]
* Improvement: Support for the (Entra ID) App Roles SAML 2.0 claim "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" has been added. [ROLES + ACCESS, PRO, INTEGRATE (SYNC, INTRANET)] 
* Fix: Functionality to save the state before the user is sent to Microsoft to authenticate and to read that state when the user returns has been refactored, to ensure redirection back to the "intended" location before WPO365 sent the user to Microsoft is working as expected. [LOGIN]
* Fix: Improved matching algorithm so that WPO365 correctly identifies Entra ID users with an apostrophe in their username. [LOGIN]
* Fix: Show a warning on the "Login / Logout" configuration pages, when the "Custom login URL" and the "Logged out / Error page" are the same. [ESSENTIALS, PRO, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Fix: Recycle SAML certificate cache when WPO365 | LOGIN plugin is deactivated. [LOGIN]
* Fix: WPO365 will no longer show a "doing_it_wrong" warning when installed for the very first time. [LOGIN]
* Fix: License keys (for premium plugins) as now included in the JSON export (when you navigate to WP Admin > WPO365 > ... > Import / Export). [ESSENTIALS, PRO, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Fix: WPO365 tries to prevent updating an email address when the only difference is in capitalization. [ESSENTIALS, PRO, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Fix: During the previous release, premium plugins were not zipped correctly, causing issues with folder-naming when installing. [ALL PREMIUM]

= v34.2 =
* Fix: (Composer) Dependencies have been updated to remove the requirement for PHP >= 8.0.0.

= v34.1 =
* Improvement: You can now choose between a Microsoft 365 account or a personal Microsoft account, like Hotmail.com or Outlook.com, to send WordPress emails. See the [updated tutorial](https://tutorials.wpo365.com/courses/email-configure-microsoft-graph-mailer/lessons/send-email-from-a-personal-microsoft-account-e-g-hotmail-com/) for details. [LOGIN, MICROSOFT GRAPH MAILER]
* Fix: Plugin no longer (falsely) reports an error when enabling the auto-retry mail-send functionality fails. Instead, it generates a warning with a more verbose description. [MAIL, PROFESSIONAL, INTEGRATE (SYNC, INTRANET)]
* Fix: Allowlisting domains does now correctly denies access to domains not in the list. [ROLES + ACCESS, PROFESSIONAL, INTEGRATE (SYNC, INTRANET)]
* Fix: Detection of the redirect_to parameter - for example added to the (default) login URL by other solutions - has been improved. [LOGIN]
* Fix: The plugin now properly URL encodes a user's UPN when checking for existing users in AAD B2C / Entra Ext. ID. [CUSTOMERS]
* Fix: The plugin now properly URL encodes a user's UPN when trying to submit email messages to Microsoft Graph. [LOGIN, MICROSOFT GRAPH MAILER]

= v34.0 =
* Breaking Change: Excluding a WP role from "WPO365 Audiences" (e.g. to ensure that the role in question sees all content without "WPO365 Audiences"-based restrictions) now takes the post type as an extra configuration parameter (so that - for example - a user with custom WP role "Wiki-Editor" can see all posts of custom post type "Wiki" but for all other post types configured restrictions will apply). The setting can only be changed if the version of the premium plugin providing the "WPO365 Audiences" logic is equal or higher than 34.0. Without updating the configuration, WPO365 will assume that the role-exclusion applies to all post types. Refer to the [new tutorial](https://tutorials.wpo365.com/courses/ra-use-wpo365-audiences-to-restrict-gate-access-to-content/) for further details. [ROLES + ACCESS, PRO, INTEGRATE (SYNC, INTRANET)]
* Change: The PHPSECLIB v3 library has been updated to the latest version 3.0.43 and any customizations have been abandonned. [LOGIN, MICROSOFT GRAPH MAILER]
* Change: The "WPO365 Audiences" Block Editor has been withdrawn and the only option to configure "WPO365 Audiences" at page-level is the Metabox, which is now always enabled. See [updated documentation](https://tutorials.wpo365.com/courses/ra-use-wpo365-audiences-to-restrict-gate-access-to-content/lessons/removed-wpo365-audiences-gutenberg-block/) for guidance. [ROLES + ACCESS, PRO, INTEGRATE (SYNC, INTRANET)]
* Improvement: You can now define a splash screen image URL as part of your Power BI Embed configuration and if defined, the app will show the image when Power BI is loading, effectively providing a white label experience. See the [updated documentation](https://docs.wpo365.com/article/84-microsoft-power-bi-for-wordpress) for details. [M365 APPS, INTEGRATE (INTRANET)]
* Improvement: A user's primary blog is set (to the contextual subsite) when WPO365 creates a new user when WordPress Multisite is enabled. [LOGIN]
* Improvement: Developers can now use the hook 'wpo365/oidc/params' to filter the parameters used to build the authorization URL. See the [updated documentation](https://docs.wpo365.com/article/82-developer-hooks) for details. [LOGIN, MICROSOFT GRAPH MAILER]
* Fix: The auto-retry functionality has been reworked to prevent emails from being sent twice. [MAIL, PRO, INTEGRATE (SYNC, INTEGRATE)]
* Fix: WPO365 will no longer send an out-of-the-box "new user email notification" if a new user is created by WPO365 during WPO365 User Synchronization. [INTEGRATE (SYNC, INTRANET)]
* Fix: Sending a test email from the "Mail" configuration page will no longer delete all cached (user) access tokens. [LOGIN, MICROSOFT GRAPH MAILER]
* Fix: The "Default role" setting is now also unlocked when the WPO365 | MAIL premium plugin is detected. [MAIL]
* Fix: Various issues when using SharePoint Online Search to search for employees have been fixed. [M365 APPS, INTEGRATE (INTRANET)]
* Fix: WPO365 now requires Microsoft Graph > Delegated Permissions > Calendar.Read permissions to test the configuration to embed an Exchange / Outlook calendar in WordPress (instead of Users.Read.All). [LOGIN, M365 APPS, INTEGRATE (INTRANET)]
* Fix: When using a complex query to retrieve - for example - a user's manager's Display Name from Microsoft Graph as follows "::graph:manager.displayName", WPO365 no longer incorrectly populates it with the current user's display name if the current user does not have a manager defined. [INTEGRATE (SYNC, INTRANET)]

= v33.3 =
* Fix: After updating to WordPress 6.7 an error "Notice: Function _load_textdomain_just_in_time was called incorrectly" would be thrown. [LOGIN, MICROSOFT GRAPH MAILER]
* Fix: A CSS "button" selector affected the global styling of button elements. [LOGIN, APPS, INTEGRATE (INTRANET)]
* Improvement: Developers can now use the hook 'wpo365/aad/params' to filter the parameters used to build the token request URL. See the [updated documentation](https://docs.wpo365.com/article/82-developer-hooks) for details. [LOGIN, MICROSOFT GRAPH MAILER]

= v33.2 =
* Improvement: A new filter "wpo365/user/user_login" to customize a user's WP username has been added to allow developers to apply their custom logic. Consult the updated [online documentation](https://docs.wpo365.com/article/82-developer-hooks). [LOGIN]
* Fix: Token expiration in Power BI has been improved and - among other things - in the instance of an "TokenExpired" client error, WPO365 will reload the window. [LOGIN]
* Fix: WPO365 is now better able to handle a situation where multiple apps to embed various Microsoft 365 services - e.g. a SharePoint Library, a Viva Engage Feed and an Exchnage Calendar - have been placed on the same page. [APPS, INTEGRATE (INTRANET)]
* Fix: When the calendar does not detect the start date column it will render an error message. [APPS, INTEGRATE (INTRANET)]
* Fix: For new installations, WPO365 will audiences will automatically enable the use of metaboxes (as opposed to using a Gutenberg Block). [ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (SYNC, INTRANET)]
* Fix: The version number of the SCIM addon (plugin) has been fixed. [SCIM]
* Fix: When a new user is created by any other solution than WPO365, the default WordPress email(s) to the user and the administrator will not be blocked. [LOGIN]
* Fix: When a WPO365 User Synchronization Job has fisnished, it will show a green "stopped" badge to indicate success. [INTEGRATE (SYNC)]
* Fix: Copying a shortcode to embed "Power BI" content in the free version WPO365 | LOGIN has been fixed. [LOGIN]
* Fix: The WPO365 | DOCUMENTS Gutenberg block is now backward compatible with older configurations that do not specify the "Name" column as sortable. [DOCUMENTS, APPS, INTEGRATE (INTRANET)]

= v33.1 =
* Fix: WPO365 will now consistently redirect users (again) to their final destination URL, preventing them from being sent back to the login page. [LOGIN]
* Fix: WPO365 now checks (again) whether the user's final destination URL matches the scheme of the registered application's Redirect URI in Entra and if needed corrects this. [LOGIN]

= v33.0 =
* Breaking Change: Previously users (of a WordPress Multisite / WPO365 "Shared" WPMU Mode) attempting to access a (sub) site that they are not a member of, would be denied access. Starting with this version, those users will either be sent to their "primary" site instead, or - if a primary site cannot be determined - to their global user dashboard URL. [LOGIN]
* Breaking Change: Starting with version 33.0, WPO365 | LOGIN can redirect users to Microsoft faster (using a server-side redirect). This is generally recommended to avoid issues with server-side / external caching services. The JavaScript file "pintra-redirect.js" will therefore no longer be automatically enqueued on every page request. To mitigate the impact of this change on existing configurations, administators must manually update the WPO365 configuration and uncheck the option "Use client-side redirect" on the plugin's "Login / Logout" configuration page, unless the WordPress site is integrated in Microsoft Teams, uses a custom "Sign in with Microsoft" login button or the administrator wishes to briefly display a "loading" icon when the user is redirected. See the [online documentation](https://docs.wpo365.com/article/223-use-client-side-redirect) for details. [LOGIN]
* New Feature: The "Sign in with Microsoft" button that is displayed on the (default) WordPress login page can now be customized on the plugin's "Login / Logout" configuration page. That same button can also be placed on any WordPress post or page using the new shortcode "wpo365-sso-button". See the [online documentation](https://docs.wpo365.com/article/224-add-single-sign-on-button-anywhere-shortcode) for instructions. [LOGIN, ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
* Improvement: WPO365 now uses built-in WordPress logic to help ensure that the URL where users are being redirected to - after they successfully signed in with Microsoft - is safe. [LOGIN]
* Fix: Fixed an issue whereby WPO365 would require a user to sign in with Microsoft when that user attempted to access a password-protected page when the administrator enforced SSO for the default / custom login page. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]

= v32.0 =
* Breaking Change: This version of WPO365 adds support for WordPress' built-in "login_redirect" filter. This means that the URL where users are redirected after they successfully sign in to your WordPress website, can be set by a third-party plugin e.g. "LoginWP". Please note that rules defined in WPO365 to redirect a user (e.g. "Welcome page for first-time users", "Always send user to default / custom landing page" and "Azure AD group-based redirect after successful login") will be applied after the "login_redirect" has been applied and therefore overrule the filtered result. [LOGIN]
* Breaking Change: If an administrator activated the option to "Force SSO for the default / custom login page", WPO365 will now redirect all requests to Microsoft for authentication, unless a unique cookie is presented. This cookie will be set by WPO365 when a user requests the default / custom landing page with the correct "Secret key to bypass SSO" added to the URL. Brute-force password-guessing bots should now be blocked from submitting login attempts to your website’s login endpoint. [ESSENTIALS, PROFESSIONAL, INTEGRATE (LOGIN+, SYNC, INTRANET)]
* Improvement: The built-in license and update manager has been greatly simplified and algined with WordPress' plugin managent. [ALL PREMIUM]
* Fix: WPO365's shutdown routine will now run at the very last possible moment to ensure that the built-in Microsoft Graph Mailer can still access its configuration and send emails, e.g. third-party plugins such as "WP Job Manager" sending out alerts. [MAIL, PROFESSIONAL, INTEGRATE (SYNC, INTRANET)]
* Fix: Administrators can now still change a user's local WordPress password, even if the option "User cannot change password" (on the plugin's "User Registration" configuration page) has been activated. [ESSENTIALS, PROFESSIONAL, INTEGRATE (LOGIN+, SYNC INTRANET)]
* Fix: The "Plugin self-test" no longer fails when an administrator has configured multiple SAML 2.0 Identity Providers. [ALL PREMIUM]
* Fix: WPO365 has restored the ability to save user attributes from a user's manager e.g. the manager's email address as WordPress metadata for the user in question. [PROFESSIONAL, INTEGRATE (SYNC, INTRANET)]
* Fix: The ability to define a default sorting of a column (ascending or descending) of an embedded SharePoint Library or List has been restored. [DOCUMENTS, APPS, INTEGRATE (INTRANET)]
* Fix: Direct reports of users listed in the Employee Directory app are filtered to ensure that disabled users are not selected. [APPS, INTEGRATE (INTRANET)]

= v31.1 =

* Improvement: The SCIM messages sent by Entra's User Provisioning Service are now logged and can be viewed via WP Admin > WPO365 > Dashboard > Insights > Users. See the [new tutorial step](https://tutorials.wpo365.com/courses/sync-entra-user-provisioning-scim/lessons/view-scim-messages-received-from-entra/) for details. [SCIM, INTEGRATE]
* Fix: Undefined variable $custom_field_not_found [ALL PREMIUM]

= v31.0 =

* Breaking Change: WPO365 is now able to save user attributes from any source (claims in an ID token and SAML 2.0 response, properties received from Microsoft Graph and Entra Provisioning (SCIM)) but the administrator needs to update the corresponding mappings with a prefix, or else WPO365 will not update the WP user meta record when the attribute is updated with an empty value. Refer to the [updated online documentation](https://docs.wpo365.com/article/98-synchronize-microsoft-365-azure-ad-profile-fields) for details. [CUSTOM USER FIELDS, PROFESSIONAL, INTEGRATE (LOGIN+, SYNC, INTRANET)]
* Improvement: WPO365 is now able to process the SAML 2.0 groups claim and apply all ROLES + ACCESS functionality e.g. WPO365 Audiences, restrict access, dynamically assign WordPress roles based on Entra Group Memberships. [ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (SYNC, INTRANET)]
* Improvement: WPO365 will now also check if it needs to update a user's WP role(s) based on user attributes it receives from Entra's SCIM based User Provisioning Service. [ROLES + ACCESS, PROFESSIONAL, INTEGRATE (SYNC, INTRANET)]
* Improvement: An administrator can now configure WPO365 to redirect the user the website's backend when initiating the "Sign in with Microsoft" flow. See [online documentation](https://docs.wpo365.com/article/219-use-admin-url-to-initiate-authentication) for details. [LOGIN]
* Improvement: Once Entra (User) Provisioning via SCIM is enabled, administrators can specify a SCIM attribute for WPO365 to use as the WordPress username for new users. [SCIM, INTEGRATE (INTRANET)]
* Improvement: An administrator can specify one or more IP addresses that WPO365 should bypass for authentication. [ROLES + ACCESS, SCIM, ESSENTIALS, PROFESSIONAL, CUSTOMERS, INTEGRATE (LOGIN+, SYNC, INTRANET)]
* Fix: WPO365 will not try to retrieve a user's Entra Group Memberships if this information has already been included in the ID token or SAML response. [ROLES + ACCESS, PROFESSIONAL, CUSTOMERS, INTEGRATE (SYNC, INTRANET)]
* Fix: Added a "Close" button to the config-test apps when embedding a SharePoint list / library or Outlook / Exchange calendar in WordPress. [LOGIN]
* Fix: The "Recent documents" view stopped working after column-sorting had been implemented for the apps that embed a SharePoint Library and List. [LOGIN, APPS, INTEGRATE (INTRANET)]
* Fix: "Logout from Microsoft" is able to deal with multiple Identity Providers of different tenant types. [ALL PREMIUM]
* Fix: Column definition for apps that embed a SharePoint Library and List now require "isSortable" (instead of "sortable") set as true (following the documentation). [APPS, INTEGRATE (INTRANET)]
* Fix: Features unlocked by the CUSTOMERS bundle now include ROLES + ACCESS and AVATAR. [CUSTOMERS]
* Fix: Features unlocked by the PROFESSIONAL bundle now include AVATAR. [PROFESSIONAL]
* Fix: Special characters - for example ö and é - in SAML claim values are no longer encoded as HTML entities (e.g. &ouml;). [LOGIN]
* Fix: The option to skip authentication for REST API requests when a BASIC auth header is present has been removed. Instead an administrator should add REST API's endpoint to the "List of pages freed from authentication" on the plugin's "Single Sign-on" page. [ESSENTIALS, LOGIN+, PROFESSIONAL, CUSTOMERS, INTEGRATE, (SYNC, INTRANET)]
* Fix: A warning is shown when the secret key to bypass SSO contains non-alphnumeric characters. [ESSENTIALS, PROFESSIONAL, CUSTOMERS, INTEGRATE (LOGIN+, SYNC, INTRANET)]
* Fix: WPO365 is now be able to handle a site relative URL for the redirect_to parameter upon login. [LOGIN]

= v30.2 =

* Fix: When the SAML 2.0 certificate is invalid or expired, the plugin will now attempt to read the X.509 certificate from the "IDPSSODescriptor" XML node (provided that the administrator has entered a valid "App Metadata Federation" URL). [LOGIN]

= v30.1 =

* Fix: The login_hint parameter for the URL created by WPO365 to send a user to Microsoft to authenticate in case of (Entra) External ID and Azure AD B2C will now be correctly set. [LOGIN]
* Fix: A regression that caused WPO365 to send a user always to the custom error page (instead of the default one) - even if that option was not configuration - has now been fixed. [ESSENTIALS, ALL BUNDLES]

= v30.0 =

* BREAKING CHANGE: It is now possible to configure support for multiple Identity Providers for different tenant types (regular Entra ID, Azure AD B2C and Entra External ID). (read more)[https://www.wpo365.com/news/breaking-change-affecting-wp-config-php-based-identity-provider-idp-configurations/] and (more)[https://docs.wpo365.com/article/137-use-wp-config-for-aad-secrets] [ALL PREMIUM]
* Improvement: An SharePoint Library or List that is embedded in WordPress can now be sorted beforehand or when the user clicks on the column header. [DOCUMENTS, M365 APPS, INTEGRATE (INTRANET)]
* Improvement: The HelpScout beacon on the plugin's configuration pages would be blocked from loading - for example when using Microsoft Edge - and has therefore been replaced with a new help button that opens the WPO365 Contact Form instead. [LOGIN, MICROSOFT GRAPH MAILER]
* Fix: The new bundles PROFESSIONAL and INTEGRATE no longer cause a critical error if WPO365 | LOGIN has not been installed / activated prior to activation. [PROFESSIONAL, INTEGRATE]
* Fix: The default value for the redirect URL now again corresponds to the site's home URL. [LOGIN, MICROSOFT GRAPH MAILER]
* Fix: Some WP Cron Jobs that rely on a custom cron schedule "wpo-every-minute" e.g. Auto-Retry for sending emails and User Sync Monitor to ensure user synchronization keeps running, should no longer be removed when the custom schedule is not found. [MAIL, PROFESSIONAL, INTEGRATE (SYNC, INTRANET)]
* Fix: Mail Log Viewer will show no results if a filter e.g. Errors returns no results. [MAIL, PROFESSIONAL, CUSTOMERS, INTEGRATE (SYNC, INTRANET)]
* Fix: Changed the log level of a number of avatar related issues e.g. when a profile picture for a user was not found from warning to debug. [PROFESSIONAL, INTEGRATE (SYNC, INTRANET)]
* Fix: The login-message shortcode and the login-button shortcode are now correctly initialized for the new PROFESSIONAL and INTEGRATE bundles. [PROFESSIONAL, INTEGRATE]
* Fix: If the administrator has configured a custom error / logged-out page then WPO365 will also ensure user is redirected to that page when they sign out of WordPress using the default sign-out option(s). [PROFESSIONAL, INTEGRATE (LOGIN+, SYNC, INTRANET)]

= Older versions =

Please check the [online change log](https://www.wpo365.com/change-log/) for previous changelogs.
