Moodle SSO with Microsoft Entra ID, Google, SAML2, OIDC or LDAP

Short answer (updated October 21, 2026): SSO (SAML / OIDC) implementation is included in every Cubite managed Moodle tier, from $690 a month. Moodle itself signs users in with Google, Microsoft or any OpenID Connect provider through its built-in OAuth 2 services, and against a directory through its LDAP server plugin; the SAML2 Single sign on plugin adds any SAML2 identity provider, and the OpenID Connect plugin is a second route to OpenID Connect providers such as Microsoft Entra ID.

Cubite runs managed Moodle and publishes this guide. The steps come from Moodle 5.3's own code and from each plugin's documentation, read on October 21, 2026; menu names can differ slightly in older versions.

Which sign-in method fits

Check plugin support before you upgrade. On October 21, 2026, the Moodle plugin directory lists SAML2 Single sign on for Moodle 2.7 to 5.1 and OpenID Connect for Moodle 3.9 to 5.2, and neither yet lists Moodle 5.3; SAML2 Single sign on does not list 5.2 either. The core OAuth 2 and LDAP methods ship with Moodle itself. Since Moodle 5.1, Moodle's code, plugins included, sits under a public folder.

Google or Microsoft sign-in with Moodle's OAuth 2 services

1. In Google Cloud or the Microsoft Entra admin center, create an OAuth client for a web application and add the redirect URI https://your-moodle-site/admin/oauth2callback.php.
2. In Moodle, go to Site administration, Server, OAuth 2 services, and create a new Google or Microsoft service, then paste the client ID and secret. The Microsoft template's Service base URL is Microsoft's common endpoint, https://login.microsoftonline.com/common/v2.0, which Microsoft refuses for an app registered for a single tenant: register the app as multitenant, or replace common with your tenant ID before you save. Either way, restrict who can sign in with the service's Login domains setting, a comma-separated list of your email domains.
3. Check that This service will be used is set to Login page and internal services, the default for the Google and Microsoft templates, or to Login page only.
4. In Site administration, Plugins, Authentication, Manage authentication, enable OAuth 2.
5. Sign out and check the login page: below the OR divider it now shows a Log in with Google or Log in with Microsoft button. A new account must confirm its email address before its first sign-in unless you clear the service's Require email verification setting.

For any other OpenID Connect provider, create a Custom service on the same page instead, with the provider's issuer URL as the Service base URL; Moodle reads the rest from the provider's discovery document. A Custom service starts as Internal services only, so set This service will be used to a login option.

Microsoft Entra ID with the OpenID Connect plugin

1. Install the OpenID Connect plugin from the plugin directory, or unpack it into public/auth/oidc (auth/oidc before Moodle 5.1), and complete the upgrade. It is part of the suite of Microsoft 365 plugins for Moodle; the plugin directory lists Enovation as its maintainer.
2. Register an app in Microsoft Entra ID with the redirect URI https://your-moodle-site/auth/oidc/.
3. In Site administration, Plugins, Authentication, Manage authentication, enable OpenID Connect and open its settings.
4. Under IdP and authentication, choose the Identity Provider (IdP) Type: Microsoft Entra ID (v1.0), Microsoft identity platform (v2.0), or Other for a provider that is not Microsoft. Enter the Application ID, which is the client ID, keep Secret as the client authentication method and enter the client secret, then set the Authorization Endpoint and Token Endpoint to match the IdP type: the defaults are Entra ID v1.0 endpoints.

Any SAML2 identity provider with the SAML2 plugin

1. Install SAML2 Single sign on from the plugin directory, or clone the branch of its repository that matches your Moodle version into public/auth/saml2 (auth/saml2 on Moodle 5.0 and earlier), and run the Moodle upgrade.
2. Paste your identity provider's metadata URL into the plugin's settings, or its XML if it has no public URL.
3. Give your identity provider Moodle's service provider metadata, from the download link on the settings page; Moodle serves it at /auth/saml2/sp/metadata.php, and it carries the assertion consumer service URL the provider needs.
4. Enable SAML2 in Manage authentication, then set Auto create users and Dual login. With Dual login off, administrators can still reach the manual login form at /login/index.php?saml=off.

Active Directory or LDAP with the LDAP server plugin

1. In Site administration, Plugins, Authentication, Manage authentication, enable LDAP server and open its settings.
2. Set the Host URL, as ldap:// or ldaps://, with several servers separated by semicolons for failover; the bind Distinguished name and its password; the User type, MS ActiveDirectory for Active Directory; the Contexts where users live; and the User attribute.
3. If Moodle should create and update accounts from the directory in bulk, turn on the LDAP users sync job in Site administration, Server, Tasks, Scheduled tasks; it is off by default.

LDAP gives learners the same username and password as your directory, and by default they type them into Moodle's login form. For sign-in without that prompt, the LDAP server plugin has an NTLM SSO option for computers on your NTLM domain; it needs NTLM or Kerberos authentication set up on the web server first.

SSO on Cubite's managed Moodle

SSO (SAML / OIDC) implementation is included in every Cubite managed Moodle tier, from $690 a month. Cubite's managed Moodle costs $690 a month (Standard, up to 500 concurrent learners), $1,190 a month (Growth, up to 1,500) or from $2,200 a month (Scale, elastic, with cloud billed at cost). Cubite sets up SSO and the connection to your identity provider; every tier also includes version upgrades with same-day CVE patching, and plugin maintenance. See managed Moodle hosting.

Cubite LMS, Cubite's own platform, works differently: its Growth plan at $290 a month includes SSO with Google, GitHub and Facebook sign-in, and SAML SSO and SCIM are part of the Enterprise plan. Cubite also implements SSO for Open edX, and the LMS SSO and SAML guide covers what to require from any LMS.