Microsoft Entra ID SSO Login security updates, in plain English

Microsoft Entra ID SSO Login

211 sites report using it · on drupal.org · 1 security update explained here

This module lets people log into a website using their Microsoft account.

Below is every security update for Microsoft Entra ID SSO Login that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

Microsoft Entra ID SSO Login

Critical · 211 sites report using it · SA-CONTRIB-2026-005 · on drupal.org · Week of 14 January 2026

A visitor without an account could take over any user account on the website. They could log in as a site administrator without needing a password or access to an email address. This would let them see private information and change anything on the site.

Who could do thisAnyone visiting the site. No login needed.
Does it apply to youAny site using this module.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.

Tell your developerUpdate Microsoft Entra ID SSO Login to 1.0.4.

For developers: what the fix changed

The fix is intended to validate API responses from Microsoft (specifically using ID token claims instead of unverified Graph API profile emails) to prevent account takeover, but the actual code changes for this validation (likely in SocialAuthEntraIdController.php) are missing from the provided diff.

The fix is not clearly separable from the other changes in this release, so treat the summary above as a pointer rather than a finding.

Also in this release The release added account type support, updated the settings form with security options to block user 1 and admin roles, added a license to the font-awesome library, and updated documentation.

1.0.3 to 1.0.4 12 commits, 10 files.

.cspell.json +33 −0
README.md +270 −1
config/install/social_auth_entra_id.settings.yml +3 −0
config/schema/social_auth_entra_id.schema.yml +19 −0
social_auth_entra_id.info.yml +1 −1
social_auth_entra_id.libraries.yml +4 −0
social_auth_entra_id.routing.yml +6 −0
src/Controller/SocialAuthEntraIdController.php +0 −0
src/Form/SocialAuthEntraIdSettingsForm.php +164 −23
src/Plugin/Block/EntraIdLoginBlockBlock.php +84 −9

Full diff, 1.0.3 to 1.0.4

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK charities, membership bodies and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Microsoft Entra ID SSO Login

Microsoft Entra ID SSO Login

Send me your Drupal site's address.

Get in touch

Links

Reference