Add excluded Entra groups for the Microsoft sign-in

Browse source

New "Excluded Entra groups" card on the Security tab. Members of these
groups (nested memberships count) can never sign in with Microsoft, even
if they are in an allowed group.

A hit in the ID token's groups claim refuses immediately. Otherwise the
plugin always asks Microsoft Graph (checkMemberGroups), because a groups
claim can be filtered in the app registration and cannot prove
non-membership. Graph errors refuse the sign-in (fail closed).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

...

This commit is contained in:

Friederich Loheide 2026-09-23 16:43:10 +00:00

parent 5c9b19399a

commit 791f43a80b

12 changed files with 372 additions and 196 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

BIN

languages/m365-login-de_DE.mo

View file

Binary file not shown.