diff --git a/local/o365/lang/en/local_o365.php b/local/o365/lang/en/local_o365.php index fe9bd2ce6..c61358903 100644 --- a/local/o365/lang/en/local_o365.php +++ b/local/o365/lang/en/local_o365.php @@ -41,25 +41,25 @@ // Setting sections in the "Setup" tab. $string['settings_setup_step1'] = 'Step 1/2: Register Moodle with Microsoft Entra ID'; -$string['settings_setup_step1_desc'] = 'Register a new Azure App for your Microsoft Entra tenant using Windows PowerShell: +$string['settings_setup_step1_desc'] = 'Register a new Microsoft Entra ID App for Moodle integration using PowerShell: -Download Windows PowerShell Script +Download PowerShell Script -

Click here to read instructions on running the script.

+

Click here to read instructions on running the script.

When prompted, use the following link as the Moodle URL:

{$a}
'; $string['settings_setup_step1clientcreds'] = '
Once the script is successfully executed, copy the Application ID and Secret returned by the script into the OpenID Connect authentication plugin configuration page.'; -$string['settings_setup_step1_credentials_end'] = 'If you are unable to set up the Azure app via PowerShell, click here for manual setup instructions.'; +$string['settings_setup_step1_credentials_end'] = 'If you are unable to set up Microsoft Entra ID app via PowerShell, click here for manual setup instructions.'; $string['settings_setup_step1_continue'] = 'Once you have entered your Application ID and Key, click "Save changes" at the bottom of the page to continue.




'; $string['settings_setup_step1_existing_settings'] = '
Existing settings
'; $string['settings_setup_step2'] = 'Step 2/2: Admin consent & additional information'; -$string['settings_setup_step2_desc'] = 'This last step allows you to give administrator consent to use some Azure permissions, and gathers some additional information about your Microsoft 365 environment.

'; +$string['settings_setup_step2_desc'] = 'This last step allows you to give administrator consent to use some Microsoft Entra ID permissions, and gathers some additional information about your Microsoft 365 environment.

'; $string['settings_setup_step3'] = 'Verify setup'; $string['settings_setup_step3_desc'] = 'Setup is complete. Click the "Update" button below to verify your setup.'; // Settings in "Step 2/2" section of the "Setup" tab. $string['settings_adminconsent'] = 'Admin Consent'; $string['settings_adminconsent_btn'] = 'Provide Admin Consent'; -$string['settings_adminconsent_details'] = 'To allow access to some of the permissions needed, an administrator will need to provide admin consent. Click this button, then log in with an Azure administrator account to provide consent. This will need to be done whenever you change "Admin" permissions in Azure.'; +$string['settings_adminconsent_details'] = 'To allow access to some of the permissions needed, an administrator will need to provide admin consent. Click this button, then log in with a Microsoft Entra ID administrator account to provide consent. This will need to be done whenever you change "Admin" permissions in Entra ID.'; $string['settings_entratenant'] = 'Microsoft Entra tenant'; $string['settings_entratenant_details'] = 'Used to Identify your organization within Microsoft. For example: "contoso.onmicrosoft.com".'; $string['settings_odburl'] = 'OneDrive for Business URL'; @@ -76,8 +76,8 @@ // Settings in "Verify setup" section of the "Setup" tab. $string['settings_verifysetup'] = 'Verify setup'; -$string['settings_verifysetup_appdataheader'] = 'Azure App Registration'; -$string['settings_verifysetup_appdatadesc'] = 'Verifies the correct parameters are set up in Azure app.'; +$string['settings_verifysetup_appdataheader'] = 'Microsoft Entra ID App Registration'; +$string['settings_verifysetup_appdatadesc'] = 'Verifies the correct parameters are set up in Entra ID app.'; $string['settings_verifysetup_appdatareplyurlcorrect'] = 'Reply URL Correct'; $string['settings_verifysetup_appdatareplyurlincorrect'] = 'Reply URL Incorrect'; $string['settings_verifysetup_appdatareplyurlgeneralerror'] = 'Could not check reply url.'; @@ -85,7 +85,7 @@ $string['settings_verifysetup_appdatasignonurlincorrect'] = 'Sign-on URL Incorrect'; $string['settings_verifysetup_appdatasignonurlgeneralerror'] = 'Could not check sign-on url.'; $string['settings_verifysetup_apppermscorrect'] = 'Application Permissions are correct.'; -$string['settings_verifysetup_details'] = 'This tool checks with Azure to make sure everything is set up correctly.
Note: Changes in Azure app can take a moment to appear here. If you have made a change in the Azure app and do not see it reflected here, wait a moment and try again.'; +$string['settings_verifysetup_details'] = 'This tool checks with Microsoft Entra ID to make sure everything is set up correctly.
Note: Changes in Microsoft Entra ID app can take a moment to appear here. If you have made a change in the Microsoft Entra ID app and do not see it reflected here, wait a moment and try again.'; $string['settings_verifysetup_correctval'] = 'Correct Value:'; $string['settings_verifysetup_detectedval'] = 'Detected Value:'; $string['settings_verifysetup_update'] = 'Update'; @@ -94,9 +94,9 @@ $string['settings_verifysetup_missingperms'] = 'Missing Delegated Permissions:'; $string['settings_verifysetup_permscorrect'] = 'Delegated Permissions are correct.'; $string['settings_verifysetup_errorcheck'] = 'An error occurred trying to check setup.'; -$string['settings_verifysetup_noinfo'] = 'We don\'t have any information about your Azure app setup yet. Please click the Update button to check.'; +$string['settings_verifysetup_noinfo'] = 'We don\'t have any information about your Microsoft Entra ID app setup yet. Please click the Update button to check.'; $string['settings_verifysetup_strunifiedpermerror'] = 'There was an error checking Microsoft Graph API permissions.'; -$string['settings_verifysetup_strtenanterror'] = 'Please use the dectect button to set your Microsoft Entra tenant before updating Azure app setup.'; +$string['settings_verifysetup_strtenanterror'] = 'Please use the dectect button to set your Microsoft Entra tenant before updating Microsoft Entra ID app setup.'; $string['settings_verifysetup_unifiedheader'] = 'Microsoft Graph API'; $string['settings_verifysetup_unifieddesc'] = 'The Microsoft Graph API allows communication between Moodle and Microsoft 365.'; $string['settings_verifysetup_unifiederror'] = 'There was an error checking for Microsoft Graph API support.'; @@ -111,16 +111,16 @@ $string['settings_detectoidc_credsinvalid'] = 'Credentials have not been set or are incomplete.'; $string['settings_detectoidc_credsinvalid_link'] = 'Set Credentials'; $string['settings_detectperms'] = 'Application Permissions'; -$string['settings_detectperms_details'] = 'To use the plugin features, correct permissions must be set up in the Azure app.'; +$string['settings_detectperms_details'] = 'To use the plugin features, correct permissions must be set up in the Microsoft Entra ID app.'; $string['settings_detectperms_nocreds'] = 'Application credentials need to be set first. See above setting.'; $string['settings_detectperms_missing'] = 'Missing:'; -$string['settings_detectperms_errorfix'] = 'An error occurred trying to fix permissions. Please fix manually in Azure.'; +$string['settings_detectperms_errorfix'] = 'An error occurred trying to fix permissions. Please fix manually in Microsoft Entra ID.'; $string['settings_detectperms_fixperms'] = 'Fix permissions'; $string['settings_detectperms_nounified'] = 'Microsoft Graph API not present, some new features may not work.'; $string['settings_detectperms_unifiednomissing'] = 'All unified permissions present.'; $string['settings_detectperms_update'] = 'Update'; $string['settings_detectperms_valid'] = 'Permissions have been set up.'; -$string['settings_detectperms_invalid'] = 'Check permissions in Azure'; +$string['settings_detectperms_invalid'] = 'Check permissions in Microsoft Entra ID'; // Settings in "User sync" section of the "Sync settings" tab. $string['settings_options_usersync'] = 'User Sync'; @@ -413,16 +413,16 @@
  • Log in to Moodle as a site administrator user that is not using the OpenID Connect authentication plugin.
  • Ensure the Authorization Endpoint and Token Endpoint settings of the OpenID Connect authentication plugin are using the default non-tenant specific settings.
  • Disable the OpenID Connect authentication plugin in Moodle. (Use the authentication plugins administration page.)
    • -
  • Navigate to Azure portal and find the application you configured for Moodle.
    • -
  • Enable multitenancy in the Azure app and save changes.
    • +
  • Navigate to Microsoft Entra ID and find the application you configured for Moodle.
    • +
  • Enable multitenancy in the Microsoft Entra ID app and save changes.
  • Give at least one of the following Graph Delegated permissions to the app: Directory.Read.All, Domain.Read.All, or Domain.ReadWrite.All. Admin consent for your organisation is not required.
  • If you are already signed in using your Microsoft account from the additional tenant, log out completely and log back in.
  • For each tenant you want to enable, click "Add New Tenant" and log in with an administrator account from the tenant you want to enable.
  • Once you have added all the tenants you want, re-enable the OpenID Connect authentication plugin in Moodle.
  • You\'re done! To add additional tenants in the future, just click the "Add New Tenant" button and log in with an administrator account from that tenant.
    • - Important Note: Enabling multitenancy in Azure app allows all Microsoft Entra tenants to access your application when enabled. Adding the tenants here allows us to restrict Moodle access to tenants you configure. If you remove all the tenants from this list before disabling multitenancy in Azure app, or enable OpenID Connect authentication in Moodle with an empty list, your Moodle site will be open to all Microsoft Entra tenants.'; -$string['acp_tenants_none'] = 'You have not configured any tenants. If you have enabled multitenancy in Azure app, your Moodle site may be open to all Microsoft 365 users.'; + Important Note: Enabling multitenancy in Microsoft Entra ID app allows all Microsoft Entra tenants to access your application when enabled. Adding the tenants here allows us to restrict Moodle access to tenants you configure. If you remove all the tenants from this list before disabling multitenancy in Microsoft Entra ID app, or enable OpenID Connect authentication in Moodle with an empty list, your Moodle site will be open to all Microsoft Entra tenants.'; +$string['acp_tenants_none'] = 'You have not configured any tenants. If you have enabled multitenancy in Microsoft Entra ID app, your Moodle site may be open to all Microsoft 365 users.'; $string['acp_tenants_revokeaccess'] = 'Revoke Access'; $string['acp_tenants_tenant'] = 'Tenant'; $string['acp_tenants_actions'] = 'Actions'; @@ -609,7 +609,7 @@
    The SDS sync feature is capable of synchronising roster data from SDS to Moodle, including courses, teachers and students.

    -In order to use the SDS sync feature, please ensure the Azure app used for the integration has EduRoster.Read.All and Member.Read.Hidden Microsoft Graph application permissions, which are not automatically added by the default set up. Admin consent needs to be granted for them too.
    +In order to use the SDS sync feature, please ensure the Microsoft Entra ID app used for the integration has EduRoster.Read.All and Member.Read.Hidden Microsoft Graph application permissions, which are not automatically added by the default set up. Admin consent needs to be granted for them too.

    By default, the SDS sync process happens daily in the Moodle cron, at 3am server time. To change this schedule, please visit the scheduled tasks management page.

    '; $string['settings_sds_coursecreation'] = 'Course Sync'; @@ -638,7 +638,7 @@ $string['settings_sds_profilesync_header_desc'] = 'Each SDS school may store user profile for teachers and members of the school. The field is school-specific, i.e. different schools may have different values in the same field for the same user.
    If a school is selected in this section, the SDS user profile fields can be configured in user field mapping. '; @@ -646,7 +646,7 @@ $string['settings_sds_profilesync'] = 'Sync profile data from school'; $string['settings_sds_profilesync_desc'] = 'Select the SDS school from which Moodle synchronises SDS specific profile data.'; $string['settings_sds_noschools'] = '
    You do not have any schools available in SDS.
    '; -$string['settings_sds_get_schools_error'] = '
    Failed to get SDS schools. Check the Azure app has required permission.
    '; +$string['settings_sds_get_schools_error'] = '
    Failed to get SDS schools. Check the Microsoft Entra ID app has required permission.
    '; $string['settings_sds_school_disabled_action'] = 'School sync disabled action'; $string['settings_sds_school_disabled_action_desc'] = 'Action to the already connected Moodle courses when sync is disabled on an SDS school.'; $string['settings_sds_school_disabled_action_keep_connected'] = 'Keep the Moodle course connected to the Team'; @@ -885,7 +885,7 @@ $string['task_sds_sync'] = 'Sync with SDS'; $string['task_syncusers'] = 'Sync users from Microsoft Entra ID'; $string['task_processmatchqueue'] = 'Process Match Queue'; -$string['task_notifysecretexpiry'] = 'Notify site admin about Azure app secret expiry'; +$string['task_notifysecretexpiry'] = 'Notify site admin about Microsoft Entra ID app secret expiry'; $string['task_processmatchqueue_err_museralreadymatched'] = 'Moodle user is already matched to a Microsoft 365 user.'; $string['task_processmatchqueue_err_museralreadyo365'] = 'Moodle user is already connected to Microsoft 365.'; $string['task_processmatchqueue_err_nomuser'] = 'No Moodle user found with this username.'; @@ -929,7 +929,7 @@ $string['help_user_matchswitchauth'] = 'Switch Matched Accounts Help'; $string['help_user_matchswitchauth_help'] = 'This requires the "Match preexisting Moodle users" setting above to be enabled. When a user is matched, enabling this setting will switch their authentication method to OpenID Connect. They will then be able to log in to Moodle with their Microsoft 365 credentials. Note: Please ensure that the OpenID Connect authentication plugin is enabled if you want to use this setting.'; $string['help_user_appassign'] = 'Assign Users To Application Help'; -$string['help_user_appassign_help'] = 'This will cause all the Microsoft Entra ID accounts with matching Moodle accounts to be assigned to the Azure app created for this Moodle installation, if not already assigned.'; +$string['help_user_appassign_help'] = 'This will cause all the Microsoft Entra ID accounts with matching Moodle accounts to be assigned to the Microsoft Entra ID app created for this Moodle installation, if not already assigned.'; $string['help_user_photosync'] = 'Sync Microsoft 365 Profile Photos (Cron) Help'; $string['help_user_photosync_help'] = 'This will cause all users\' Moodle profile photos to get synced with their Microsoft 365 profile photos.'; $string['help_user_photosynconlogin'] = 'Sync Microsoft 365 Profile Photos (Login) Help'; @@ -937,7 +937,7 @@ $string['help_user_nodelta'] = 'Perform a full sync help'; $string['help_user_nodelta_help'] = 'By default, user sync will only sync changes from Microsoft Entra ID from the last time the sync is run. Checking this option will force a full user sync each time.'; $string['help_user_emailsync'] = 'Sync Microsoft Entra ID usernames to moodle emails Help'; -$string['help_user_emailsync_help'] = 'Enabling this option will match Microsoft Entra ID usernames to moodle emails, instead of the default behaviour which is azure usernames to moodle usernames.'; +$string['help_user_emailsync_help'] = 'Enabling this option will match Microsoft Entra ID usernames to moodle emails, instead of the default behaviour which is Microsoft Entra ID usernames to moodle usernames.'; $string['help_user_tzsync'] = 'Sync Outlook timezone (Cron) Help'; $string['help_user_tzsync_help'] = 'This will cause all users\' Moodle timezone to get synced with their Outlook timezone preference.'; $string['help_user_tzsynconlogin'] = 'Sync Outlook timezone (Login) Help'; @@ -986,24 +986,24 @@ $string['other_login'] = 'Login manually'; $string['course_selector_label'] = "Select existing course"; -// Notifications to site admin about Azure app secret. -$string['notification_subject_secret_expired'] = 'Action required: Azure app secret expired'; +// Notifications to site admin about Microsoft Entra ID app secret. +$string['notification_subject_secret_expired'] = 'Action required: Microsoft Entra ID app secret expired'; $string['notification_content_secret_expired'] = 'Dear site administrator, -The Azure app secret used in your Moodle and Microsoft 365 integration has expired. -Please create a new secret in Azure portal and update it in the integration configuration in order to restore the integration.'; -$string['notification_subject_secret_almost_expired'] = 'Action required: Azure app secret expiring soon'; +The Microsoft Entra ID app secret used in your Moodle and Microsoft 365 integration has expired. +Please create a new secret in Microsoft Entra ID and update it in the integration configuration in order to restore the integration.'; +$string['notification_subject_secret_almost_expired'] = 'Action required: Microsoft Entra ID app secret expiring soon'; $string['notification_content_secret_almost_expired'] = 'Dear site administrator, -The Azure app secret used in your Moodle and Microsoft 365 integration will expire in {$a}. -Please create a new secret in Azure portal and update it in the integration configuration in order to avoid integration disruption.'; +The Microsoft Entra ID app secret used in your Moodle and Microsoft 365 integration will expire in {$a}. +Please create a new secret in Microsoft Entra ID and update it in the integration configuration in order to avoid integration disruption.'; $string['notification_days_less_than_one_day'] = 'less than 1 day'; $string['notification_days_one_day'] = '1 day'; $string['notification_days_days'] = '{$a} days'; -$string['notification_subject_invalid_secret'] = 'Action required: invalid Azure app secret found'; +$string['notification_subject_invalid_secret'] = 'Action required: invalid Microsoft Entra ID app secret found'; $string['notification_content_invalid_secret'] = 'Dear site administrator, -The Azure app secret used in your Moodle and Microsoft 365 integration seems to be invalid. This can either be caused by the secret expired, or it has been deleted. +The Microsoft Entra ID app secret used in your Moodle and Microsoft 365 integration seems to be invalid. This can either be caused by the secret expired, or it has been deleted. Please review the secret to ensure the integration works as expected.'; // Misc. diff --git a/local/o365/scripts/Moodle-AzureAD-Powershell.zip b/local/o365/scripts/Moodle-AzureAD-Powershell.zip deleted file mode 100644 index fcdcc1c95..000000000 Binary files a/local/o365/scripts/Moodle-AzureAD-Powershell.zip and /dev/null differ diff --git a/local/o365/scripts/Moodle-EntraID-PowerShell.zip b/local/o365/scripts/Moodle-EntraID-PowerShell.zip new file mode 100644 index 000000000..81febc003 Binary files /dev/null and b/local/o365/scripts/Moodle-EntraID-PowerShell.zip differ diff --git a/local/o365/scripts/README.md b/local/o365/scripts/README.md index 5424336df..f44fed5ba 100644 --- a/local/o365/scripts/README.md +++ b/local/o365/scripts/README.md @@ -1,66 +1,72 @@ -# Register Moodle with Azure using Windows PowerShell - -This PowerShell Script provisions a new Azure application for your Microsoft 365 tenant, which will be used by the [Microsoft 365 Moodle Plugin](https://github.com/Microsoft/o365-moodle/). The script will provision the app for your O365 tenant, set up all the required Reply URLs and Permissions for the provisioned app and return the AppID and Key. You can use the generated AppID and Key in your O365 Moodle Plugin Setup Page to configure your Moodle server with Azure AD. - -## Requirements - -* This script requires a Windows 7+ device. MacOS/Linux devices are *NOT* supported. -* This script is only compatible with Windows Powershell 5, which is pre-installed on each Windows 7+ device. Powershell 6+ is *NOT* supported. - -## Step-by-Step Instructions - -### 1. Prepare the PowerShell script from the ZIP file - -* Download and extract the `Moodle-AzureAD-Powershell.zip` file. -* Open the extracted folder. -* Right-click on the `Moodle-AzureAD-Script.ps1` file and select *Properties*. -* Under the *General* tab of the Properties window, check the `Unblock` box next to the *Security* attribute at the bottom. -* Click "OK". -* Copy the directory path of the extracted folder. - -### 2. Run PowerShell as Administrator - -_From CMD_: - -* Launch Command Prompt (cmd). -* Type `powershell -Command "Start-Process PowerShell -Verb RunAs"`. - -_From Start Menu_: - -* Click Start. -* Type PowerShell. -* Right-click Windows PowerShell. -* Click "Run as Administrator". - -### 3. Navigate to the unzipped 'Moodle-AzureAD-Powershell' folder - -* Type in `cd ...\...\Moodle-AzureAD-Powershell`, wherein `...\...` refers to the directory where the unzipped folder is located. - * *Note*: You can paste the directory path copied from Step 1. - -### 4. Execute the PowerShell script - -* Type `Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser`. -* Type `.\Moodle-AzureAD-Script.ps1`. -* Login to your O365 Adminstrator account from the pop-up window. -* Enter the name of the Azure Application (Ex. Moodle/Moodle plugin). -* Enter the URL of your Moodle server. -* Copy the `Application ID` and `Application Key` generated by the script. - -### 5. Paste the App Credentials to the O365 Moodle Plugin Setup page - -* Login to your Moodle server as an adminstratror. -* Go to *Site Administration -> Plugins -> Microsoft 365 Integration*. -* Paste the *Application ID* returned by the script into the `Application ID` field. -* Paste the *Application Key* returned by the script into the `Key` field. -* Click on "Save changes". -* Follow the next steps in the Setup page to successfully configure your Moodle Server with your Microsoft 365 tenant. - -## Code of Conduct - -This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. - -## Copyright - -© Microsoft, Inc. Code for this script is licensed under the GPLv3 license. - +# Moodle Entra ID App Registration Script + +This PowerShell script automates the process of creating and configuring a Microsoft Entra ID application registration for Moodle integration. + +## Prerequisites + +- PowerShell 7.5 or later on any supported platform (Windows, MacOS, Linux) +- Administrator access to your Microsoft Entra ID tenant +- A Moodle server with HTTPS enabled + +## Installation +1. Download and extract the `Moodle-EntraID-PowerShell.zip` file. +2. Open the extracted folder, which contains the script files: + - `Moodle-EntraID-Script.ps1` + - `Json/permissions.json` + - `Json/EntraIDOptionalClaims.json` + - `Assets/moodle-logo.jpg` + +## Usage +1. Open PowerShell 7 +2. Navigate to the directory containing the script +3. Run the script: + ```powershell + ./Moodle-EntraID-Script.ps1 + ``` +4. Follow the prompts: + - Enter a name for your Microsoft Entra ID application + - Enter your Moodle server URL (must start with https://) + - Choose whether to grant admin consent + +5. The script will output your Application (Client) ID and Client Secret. Save these credentials securely as they will be needed for Moodle configuration. + +## What the Script Does + +- Creates a Microsoft Entra ID application registration +- Configures required API permissions +- Sets up authentication URLs +- Configures optional claims +- Adds Teams integration support +- Sets up front-channel logout URL +- Grants admin consent for required permissions +- Generates a client secret +- Sets application logo + +## Troubleshooting + +- If you get permission errors, make sure you have administrator rights in your Microsoft Entra ID tenant +- If the script fails, you can safely run it again +- Make sure all required files are present in their correct locations + +## Security Notes + +- Store the generated client secret securely +- Only run this script while connected to a trusted network +- Use the generated credentials only for your Moodle configuration + +## Support + +For issues with: +- The script: Please report issues to [the repository](https://github.com/microsoft/o365-moodle/issues) +- Microsoft Entra ID: Contact Microsoft Support +- Moodle integration: Refer to [the Moodle documentation](https://docs.moodle.org/405/en/Microsoft_365) + +## Code of Conduct + +This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. + +## Copyright + +© Microsoft, Inc. Code for this script is licensed under the GPLv3 license. + Any Microsoft trademarks and logos included in these plugins are property of Microsoft and should not be reused, redistributed, modified, repurposed, or otherwise altered or used outside of this plugin. \ No newline at end of file