In this step, you will update wp-config.php with sensitive Entra ID options and add the parseable array of variables that you exported before, as a named constant to your WordPress website’s wp-config.php file.
To update your site’s wp-config.php, proceeds as follows.
- Retrieve a copy of your site’s wp-config.php, for example with your favorite FTP client or open it in edit-mode with a file manager of your choice.
- Locate the line that reads /* That’s all, stop editing! Happy publishing. */.
- Add a new line to define the new named constant WPO_AAD_1 as follows.

The name of constant is by default WPO_AAD_1. The number (in this case “1”) refers to the blog ID of the current site. If you don’t run WordPress Multisite and if you haven’t configured BLOG_ID_CURRENT_SITE then the blog ID of the current site defaults to 1.
define('WPO_AAD_1', array (
'app_only_application_id' => '',
'app_only_application_secret' => '',
'application_id' => 'e737dc1f-0949-4587-911a-------------',
'application_secret' => 'ySh...',
'b2c_allow_multiple_policies' => false,
'b2c_custom_domain' => '',
'b2c_domain_name' => '',
'b2c_enable_signup' => false,
'b2c_policy_name' => '',
'b2c_signup_policy' => '',
'default' => false,
'id' => '65eed664caef6',
'login_hide_form_secret' => '',
'mail_application_id' => 'e737dc1f-0949-4587-911a-------------',
'mail_application_secret' => 'ySh...',
'mail_redirect_url' => 'https://www.wpo365connect.com/',
'mail_tenant_id' => '9be34e84-6f85-4365-9a48-------------',
'mail_tld' => '.com',
'oidc_flow' => 'code',
'oidc_response_mode' => 'form_post',
'redirect_on_login_secret' => 'aSD...',
'redirect_url' => 'https://www.wpo365connect.com/',
'redirect_url_strict' => true,
'saml_base_url' => 'https://www.wpo365connect.com/',
'saml_idp_entity_id' => '',
'saml_idp_meta_data_url' => '',
'saml_idp_sls_binding' => '',
'saml_idp_sls_url' => '',
'saml_idp_ssos_binding' => '',
'saml_idp_ssos_url' => '',
'saml_sp_acs_binding' => '',
'saml_sp_acs_url' => '',
'saml_sp_entity_id' => '',
'saml_sp_sls_binding' => '',
'saml_sp_sls_url' => '',
'saml_x509_cert' => '',
'tenant_id' => '9be34e84-6f85-4365-9a48-------------',
'tenant_type' => 'workforce',
'title' => 'Title for IdP 65eed664caef6',
'tld' => '.com',
'type' => 'oidc',
'use_app_only_token' => false,
'wp_rest_aad_application_id' => '',
'wp_rest_aad_application_id_uri' => '',
));

Please note If options are defined in wp-config.php but are not deleted from the database, then the wp-config.php defined options will prevail and changes made using the configuration pages are silently ignored.
- To check whether the plugin has detected the defined constant WPO_AAD_<blog id> you can refresh the WPO365 configuration pages and check if a yellow message bar at the top of the page informs you that Entra ID options and secrets defined in WP-config.php will be used instead. See online documentation for details.

- Also note that those options that are now defined in your site’s wp-config.php can no longer be edited using the WPO365 configuration pages- as shown below.
