Microsoft 365

Note: OAuth 2 authentication (enabling users to log in to Moodle with their Microsoft account) and the OneDrive repository are included in standard Moodle and require no additional plugins. The Microsoft 365 plugin suite provides a much wider integration on top of this.

Introduction

The Microsoft 365 plugin suite connects Moodle to Microsoft 365 services, providing richer collaboration, identity, and content experiences for teachers and students.

What this suite provides beyond Moodle core

Moodle core includes basic Microsoft 365 login (OAuth 2) and a simple OneDrive repository. The plugin suite extends this substantially:

• Automated user provisioning and sync from Microsoft Entra ID to Moodle
• Automatic and manual matching of existing Moodle users with Entra ID accounts
• Integration between Moodle courses and Microsoft Teams — automatic Team creation, membership sync, and Teams Classes LTI support
• Bidirectional course enrolment synchronisation between Teams and Moodle
• Cohort membership driven by Microsoft 365 group membership
• Calendar synchronisation with Outlook
• OneNote assignment submission and feedback
• Integration with School Data Sync (SDS)
• Teams meeting creation directly from the Moodle content editor

Plugins

Core plugins

Plugin	Component	Description
Microsoft 365 Local Plugin	local_office365	A shell plugin whose only purpose is to declare dependencies on all other core plugins. Installing this plugin ensures you have the correct version of every other core plugin.
OpenID Connect Authentication	auth_oidc	A standards-compliant OpenID Connect authentication plugin. Works with any OIDC-compatible identity provider, not just Microsoft Entra ID. When used with Microsoft Entra ID and local_o365, additional capabilities such as Teams SSO and Graph API profile field mapping become available.
Microsoft 365 Integration	local_o365	The core back-end plugin. Handles Microsoft Graph API communication and drives user sync, course/Teams sync, calendar sync, cohort sync, SDS integration, and the Microsoft 365 administration tools.
Microsoft Block	block_microsoft	A user-facing block providing links to account connection, calendar sync preferences, Teams, and OneNote.
OneDrive for Business Repository	repository_office365	Allows users to browse, download, and upload files from their personal OneDrive for Business and from Moodle course SharePoint document libraries.
Microsoft 365 Teams Theme	theme_boost_o365teams	A Boost-based theme optimised for display when Moodle is opened inside a Microsoft Teams tab.
Teams Meeting	tiny_teamsmeeting	A TinyMCE editor plugin that adds a toolbar button to create a Microsoft Teams online meeting and insert its link into Moodle content.

Optional plugins

These three plugins add OneNote support for assignments.

Plugin	Component	Description
OneNote support plugin	local_onenote	Shared code library for the two assignment plugins below. Has no user interface of its own.
OneNote Assignment Submission	assignsubmission_onenote	Lets students submit assignments as OneNote notebooks.
OneNote Assignment Feedback	assignfeedback_onenote	Lets teachers give assignment feedback inside OneNote notebooks.

Features

Authentication and Single Sign-On

The auth_oidc plugin is a standards-compliant OpenID Connect authentication plugin. It adds an identity provider sign-in button to the Moodle login page; users click it, authenticate at the configured identity provider, and are returned to Moodle logged in (authorization code flow). It works with any OIDC-compatible identity provider — not only Microsoft Entra ID.

The identity provider sign-in button on the Moodle login page.

When used with any OIDC identity provider, the plugin provides:

• Single Sign-On via the authorization code flow
• Automatic Moodle account creation on first login
• User profile field mapping from standard ID token claims
• Configurable provider name and icon on the login page
• Optional force-redirect to skip the Moodle login page
• Silent login mode (if the identity provider supports session-based silent authentication)
• User restrictions by username pattern
• Single sign-off (if the identity provider supports a logout endpoint)

When configured with Microsoft Entra ID and the local_o365 plugin, the following additional capabilities become available:

• Teams SSO — silent login from a Moodle tab inside Microsoft Teams using the user's active Teams session
• Additional profile fields from the Microsoft Graph API available for field mapping (beyond what is in the ID token)
• SDS teacher/student profile fields available for field mapping (when SDS sync is configured)

User sync from Entra ID

The user sync feature (part of local_o365) keeps Moodle user accounts in step with Microsoft Entra ID. It runs as a scheduled task and can:

• Create Moodle accounts for Entra ID users who don't have one yet
• Update Moodle user details (including profile photos and Outlook timezone) when they change in Entra ID
• Suspend or delete Moodle accounts when users are disabled or removed in Entra ID
• Match and link existing Moodle accounts to Entra ID users (by username or email)

Course and Teams integration

Moodle courses can be connected to Microsoft Teams. When enabled, a Group and Team are created for each configured course and kept in sync with Moodle enrolments. Teachers become Team owners; students become Team members.

In tenants with an education licence, class Teams are created. This enables the Teams Classes LTI feature, which allows the Team to be embedded directly in the Moodle course page as an external tool (mod_lti activity).

A Moodle tab inside a Microsoft Teams course Team.

Bidirectional sync

By default, enrolments flow from Moodle to Teams. The integration also supports:

• Teams → Moodle: Changes in Team owners/members update Moodle enrolments.
• Both directions: Changes in either system are reflected in the other.

Course request from Teams

Users with the course-request capability can use a Request Course from Teams page (accessible via the Microsoft block) to request a new Moodle course that is pre-populated with the owners and members of a chosen Team.

Cohort synchronisation with Microsoft 365 Groups

System cohort membership in Moodle can be driven automatically by membership in Microsoft 365 groups. Administrators map Moodle cohorts to Microsoft 365 groups, and a scheduled task keeps the cohorts aligned.

Calendar synchronisation

Users can sync Moodle events (site events, course events, assignment due dates, and personal calendar entries) to their Outlook calendar and vice versa.

OneDrive for Business

The repository_office365 plugin allows users to access their personal OneDrive for Business and course SharePoint document libraries from the Moodle file picker. Files can be imported into Moodle or uploaded to OneDrive.

OneNote assignment integration

Students can submit assignments as OneNote notebooks, and teachers can provide in-notebook feedback. This requires the three optional OneNote plugins.

Teams meeting in the content editor

The tiny_teamsmeeting plugin adds a Teams Meeting button to the TinyMCE editor toolbar. Users create a new Teams online meeting from within the editor and insert its link into any Moodle content — course pages, forum posts, assignment descriptions, and so on.

The Teams Meeting button in the TinyMCE toolbar.

School Data Sync (SDS)

Moodle courses can be created from classes defined in Microsoft School Data Sync, with enrolments synced from SDS rosters. Bidirectional sync is also available so that Moodle enrolment changes are reflected back in SDS.

Multi-tenant support

Additional Microsoft 365 tenants can be added, allowing users from partner organisations to log in using their own Microsoft 365 accounts and access integration features.

Microsoft block

The Microsoft block on the Moodle dashboard.

The block_microsoft plugin provides a user-facing menu with links to:

• Connect / manage the Microsoft 365 account link
• Calendar sync preferences
• OneNote notebooks
• Teams
• The Microsoft 365 / Moodle control panel

Requirements

• A Microsoft 365 subscription.
• An Azure subscription (to register the application in Microsoft Entra ID).
• Moodle 4.1 or above.

Setup

Note: These steps describe a complete fresh installation. If upgrading an existing installation, refer to the release notes for any migration steps required.

Plugin installation

The plugins are available from:

• The Microsoft 365 Plugin Set in the Moodle Plugins directory — installing local_office365 pulls in all core plugins.
• GitHub

See Installing plugins for general installation instructions.

After installation you will be prompted to save plugin settings. Save without configuring anything for now; you will complete configuration in the steps below.

Azure application registration

The integration uses the Microsoft Graph API and requires an application registered in your Azure tenant.

Option A: PowerShell script (recommended)

1. Go to Site Administration > Plugins > Local plugins > Microsoft 365 Integration and open the Setup tab.
2. Click Download PowerShell Script.
3. Follow the instructions in local/o365/scripts/README.md in your Moodle installation (or on GitHub).

Note: The PowerShell script requires PowerShell 7.5 or later. It runs on Windows, macOS, and Linux.

Option B: Manual registration

Register the application

1. Sign in to the Microsoft Azure Management Portal.
2. Go to App Registrations and click New registration.
3. Enter a name (e.g. "Moodle Integration").
4. Choose the Supported account types appropriate for your organisation.
5. Under Redirect URI, select type Web and enter the redirect URI shown in Site Administration > Plugins > Authentication > OpenID Connect > Other options. It takes the form https://your.moodle.url/auth/oidc/. The trailing slash is required.
6. Click Register.
7. Note the Application (client) ID shown on the overview page — you will need it later.

Configure the application

Enable implicit grant:

1. In the left menu go to Authentication.
2. Under Implicit grant and hybrid flows, check both Access tokens and ID tokens.
3. Save changes.

Create a client secret:

1. Go to Certificates & secrets and click New client secret.
2. Enter a description and choose an expiry period, then click Add.
3. Copy the value shown under Value immediately — it is only displayed once.

Expose an API (required only for Teams sync):

1. Go to Expose an API and click Add next to Application ID URI.
2. Set the URI to api://your.moodle.url/{ApplicationID} (replace your.moodle.url with your Moodle wwwroot and {ApplicationID} with the Application ID).
3. Click Add a scope and fill in:
   • Scope name: access_as_user
   • Who can consent?: Admins and users
   • Admin consent display name: Teams can access the user's profile
   • Admin consent description: Allows Teams to call the app's web APIs as the current user
   • User consent display name: Teams can access the user profile and make requests on the user's behalf
   • User consent description: Enable Teams to call this app's APIs with the same rights as the user
   • State: Enabled
4. Click Add scope to save.
5. Under Authorized client applications, add each of the following client IDs and select the scope above:
   • 1fec8e78-bce4-4aaf-ab1b-5451cc387264 (Teams mobile/desktop)
   • 5e3ce6c0-2b1f-4285-8d4b-75ee78787346 (Teams web)

Add API permissions:

1. Go to API permissions and click Add a permission > Microsoft Graph.
2. Add the permissions listed in the table below.
3. Click Grant admin consent for [your organisation].

API permissions

The following permissions enable full functionality. The PowerShell script adds these automatically. Advanced administrators may omit permissions for features they do not use.

Type	Permission	Display name	Purpose
Application	AppCatalog.Read.All	Read all app catalogs	Find the uploaded Moodle Teams app to install in connected Teams.
	AppRoleAssignment.ReadWrite.All	Manage app permission grants and app role assignments	Assign users to the Azure app during user sync.
	Calendars.ReadWrite	Read and write calendars in all mailboxes	Calendar event sync.
	Channel.ReadBasic.All	Read the names and descriptions of all channels	Find the General channel to install the Moodle tab.
	Directory.ReadWrite.All	Read and write directory data	Integration configuration, user sync, and course sync.
	Directory.Read.All	Read directory data	Integration configuration, user sync, and course sync.
	EduRoster.ReadWrite.All	Read and write the organization's roster	SDS sync and course sync in education tenants.
	Files.ReadWrite.All	Read and write files in all site collections	OneDrive file access and upload.
	Group.ReadWrite.All	Read and write all groups	Course/Teams integration.
	MailboxSettings.Read	Read all user mailbox settings	Sync users' Outlook default timezone.
	Member.Read.Hidden	Read all hidden memberships	Read school class members in SDS sync.
	Notes.ReadWrite.All	Read and write all OneNote notebooks	OneNote assignment integration.
	Sites.Read.All	Read items in all site collections	Detect the OneDrive for Business URL.
	Team.Create	Create teams	Create Teams for Moodle courses.
	TeamMember.ReadWrite.All	Add and remove members from all teams	Sync Moodle course enrolments to Teams membership.
	TeamsAppInstallation.ReadWriteForTeam.All	Manage Teams apps for all teams	Install the Moodle app in connected Teams.
	TeamSettings.ReadWrite.All	Read and change all teams' settings	Course/Teams integration.
	TeamsTab.Create	Create tabs in Microsoft Teams	Create a Moodle tab in connected Teams.
	User.Read.All	Read all users' full profiles	SSO and user information sync.
Delegated	Calendars.ReadWrite	Have full access to user calendars	Calendar event sync.
	Files.ReadWrite.All	Have full access to all files user can access	OneDrive file access and upload.
	Group.ReadWrite.All	Read and write all groups	Course group integration.
	Notes.ReadWrite.All	Read and write all OneNote notebooks that user can access	OneNote assignment integration.
	User.Read.All	Read all users' full profiles	SSO and user information sync.
	Domain.Read.All	Read domains	Multi-tenant configuration.
	openid	Sign users in	Teams SSO.
	offline_access	Maintain access to data you have given it access to	Teams SSO.
	email	View users' email address	Teams SSO.
	profile	View users' basic profile	Teams SSO.

Configure auth_oidc

1. Go to Site Administration > Plugins > Authentication and enable the OpenID Connect plugin.
2. Go to Site Administration > Plugins > Authentication > OpenID Connect > IdP and authentication.
3. Check the endpoints. The defaults work for most configurations:
   • Authorization endpoint: https://login.microsoftonline.com/common/oauth2/authorize
   • Token endpoint: https://login.microsoftonline.com/common/oauth2/token

   Replace common with your tenant name or GUID to show a customised Microsoft login page. Leave common if you are using the multi-tenant feature.

4. Go to the Other options tab and note the Redirect URI. Requirements for this URI:
   • Must use HTTPS.
   • Must be a fully qualified domain name (not an IP address).
   • Must be reachable by your users (does not need to be publicly internet-accessible).
5. Enter the Application ID from Azure into the Application ID field.
6. Enter the client secret Value from Azure into the Key field.
7. Save changes.y

Configure local_o365

1. Go to Site Administration > Plugins > Local plugins > Microsoft 365 Integration and open the Setup tab.
2. Work through each step in order:
   1. Connection method: Select Application access (the only supported method).
   2. Admin consent: Click Provide admin consent and sign in as a Microsoft 365 administrator to grant the application permissions.
   3. Microsoft Entra Tenant: Enter your tenant domain (e.g. contoso.onmicrosoft.com), or click Detect.
   4. OneDrive for Business URL: Enter your OneDrive domain (e.g. contoso-my.sharepoint.com — domain only, no protocol or slashes), or click Detect.
   5. Verify setup: Click Update to confirm all required permissions are in place. Resolve any issues reported before continuing.

Connecting users to Microsoft 365

To use Microsoft 365 features, a Moodle user must be connected to a Microsoft 365 account. There are two approaches.

Switch to Microsoft 365 login (changes authentication method)

The user logs in to Moodle using Microsoft 365 credentials. Their previous login method will stop working.

• New users without a Moodle account: they click the identity provider link on the login page and a Moodle account is created automatically.
• Existing users:
  1. Ensure the Microsoft block is visible (e.g. on the dashboard).
  2. Log in as the user and click Connect to Microsoft 365 in the block.
  3. In the control panel, click Microsoft 365 Login then follow the prompts.
  4. After completing the flow, Microsoft 365 login is active for this user.

Link without changing login method

The user keeps their existing Moodle login and also gains access to Microsoft 365 features.

• 1. Ensure the Microsoft block is visible.
  2. Log in as the user and click Connect to Microsoft 365 in the block.
  3. Click Click here to connect in the Connection Status box.
  4. Sign in with the Microsoft 365 account to link.
  5. On return, the Connection Status reads Active. The user's login method is unchanged.

OpenID Connect Authentication

The auth_oidc plugin is not restricted to Microsoft Entra ID. It can authenticate Moodle users against any identity provider that implements the OpenID Connect standard — for example Google, Azure AD B2C, Keycloak, or any other OIDC-compliant IdP.

The setup steps in the Setup section above cover the Microsoft Entra ID configuration specifically. For other identity providers, substitute the appropriate authorization endpoint, token endpoint, application ID, and client secret from your IdP, and skip the Azure-specific steps.

Settings

All settings are at Site Administration > Plugins > Authentication > OpenID Connect.

• Force redirect — skip the Moodle login page and go directly to the identity provider. Bypass with ?noredirect=1.
• Silent login mode — attempt silent login using an existing active session at the identity provider.
• Domain hint — pass a domain_hint parameter to the Microsoft login page to suggest a specific tenant. This is a Microsoft-specific parameter and has no effect with other identity providers.
• User restrictions — restrict login to users matching one or more regular expression patterns on their username.
• Single sign-off / Logout endpoint — when a Moodle user logs out, trigger a logout request to the configured endpoint. Supports an optional post_logout_redirect_uri parameter. Works with any IdP that exposes a logout endpoint; the URL must also be added to the Azure app's redirect URI list when using Microsoft Entra ID.
• Provider name — the label used for the identity provider link on the Moodle login page.
• Custom icon — choose a predefined icon or upload your own (recommended size: 35×35 px).
• Record debug messages — log authentication errors for troubleshooting (Site Administration > Reports > Logs, filter by "Site errors").

Login flow

The plugin uses the authorization code flow:

1. User clicks the identity provider link on the Moodle login page.
2. Browser redirects to the identity provider for authentication.
3. On success, browser is redirected back to Moodle and the user is logged in.

User restrictions

1. Enter one regular expression pattern per line.
2. A user is allowed if they match any one pattern.
3. Escape / as \/.
4. If no patterns are entered, all users who can authenticate are accepted.

Microsoft 365 Integration Configuration

All settings below are at Site Administration > Plugins > Local plugins > Microsoft 365 Integration. Each sub-section below notes the specific page within the plugin's navigation.

User sync

User Sync page (Site Administration > Plugins > Local plugins > Microsoft 365 Integration > User Sync).

The Sync users with Microsoft Entra ID scheduled task runs once per day by default. Adjust frequency via Scheduled tasks.

Options:

• Create accounts in Moodle for users in Microsoft Entra ID — creates new Moodle accounts for Entra ID users who don't have one. New accounts use OpenID Connect authentication.
• Update all accounts in Moodle for users in Microsoft Entra ID — keeps existing account details current.
• Suspend previously synced accounts in Moodle when they are deleted from Microsoft Entra ID — suspends the Moodle account when the linked Entra ID account is deleted.
• Delete previously synced accounts in Moodle when they are deleted from Microsoft Entra ID — permanently deletes the Moodle account. Use with caution.
• Re-enable suspended accounts for users in Microsoft Entra ID — unsuspends a Moodle account if the linked Entra ID account is active.
• Sync disabled status — suspends Moodle accounts for Entra ID accounts that are disabled.
• Match preexisting Moodle users with same-named accounts in Microsoft Entra ID — connects existing Moodle accounts to Entra ID accounts by username (case-insensitive, domain-suffix ignored). For example, "BoB.SmiTh" matches "bob.smith@contoso.onmicrosoft.com".
• Switch matched users to Microsoft 365 (OpenID Connect) authentication — when matching is enabled, also switches the matched user's login method to OpenID Connect.
• Assign users to application during sync — ensures matched Entra ID users are assigned to the Azure application.
• Sync Microsoft 365 profile photos to Moodle in cron job — updates Moodle profile photos from Entra ID on each sync run.
• Sync Microsoft 365 profile photos to Moodle on login — updates profile photos at login.
• Sync Outlook timezone to Moodle in cronjob — syncs the user's Outlook timezone preference on each sync run.
• Sync Outlook timezone to Moodle on login — syncs timezone on login.
• Perform a full sync each run — forces a complete resync instead of delta sync.
• Match Microsoft Entra ID usernames to Moodle emails instead of Moodle usernames during the sync — uses email addresses for matching.
• Sync guest users — allows guest users (from other tenants added as guests to the hosting tenant) to use SSO login.

User creation restriction

Limits account creation to Entra ID users matching a required field/value pair. For example, set field "Department" and value "IT" to only sync users in the IT department.

User field mapping

Profile field mapping has been moved to Site Administration > Plugins > Authentication > OpenID Connect > Data mapping. Available source fields depend on configuration:

• Basic token fields — always available.
• Graph API fields — available when local_o365 is configured.
• SDS fields — available when SDS sync is configured.

For each field, configure when it is updated (every login / on account creation / never) and whether to lock it against local editing by non-administrators.

Course and Teams sync

Course Sync page (Site Administration > Plugins > Local plugins > Microsoft 365 Integration > Course Sync).

How it works

The Sync Moodle courses to Microsoft Teams scheduled task (\local_o365\task\coursesync) processes each enabled course and:

1. Creates a Microsoft 365 group if one does not exist.
2. Promotes the group to a Team (class Team in education tenants; standard Team otherwise).
3. Syncs enrolled Moodle users who are connected to Microsoft 365 accounts:
   • Users with the Team owner capability (local/o365:teamowner, held by teachers by default) → added as Team owners.
   • Users with the Team member capability (local/o365:teammember, held by students by default) → added as Team members.
   • Users with neither capability are not synced.
4. Installs the Moodle Teams app and creates a Moodle tab in the General channel (if the app is configured — see Teams Moodle app below).

All subsequent enrolment changes in Moodle are also synced immediately.

Only Moodle users who have a Microsoft 365 connection record are synced. Such records are created when:

• A user is created or matched by the user sync task.
• A user logs in via auth_oidc.
• A user connects manually via the Microsoft block.
• An administrator creates the connection via the Connections or User Matching tools.

Sync direction

The Course user sync behaviour setting controls the direction:

• From Moodle to Teams (default) — Moodle enrolments drive Team membership.
• From Teams to Moodle — Team owner/member changes drive Moodle enrolments. Moodle users without a Microsoft 365 connection are unaffected.
• Update both Teams and Moodle — changes in either system are reflected in the other.

Course sync settings

• Course sync:
  • Disabled — no sync.
  • Customise — select individual courses; optionally enable by default for new courses; optionally allow course-level control by authorised users.
  • All features enabled — sync all courses.
• Sync hidden courses — by default hidden courses are ignored to avoid syncing courses that are being copied or restored. Enable this to force Teams creation for hidden courses.
• Delete Microsoft 365 groups when connected Moodle course is deleted — also deletes the Team when the Moodle course is deleted.
• Delete Microsoft 365 Groups when course sync is disabled — deletes the Team when sync is turned off for a course.
• Courses to sync per task run — limits courses processed per cron run to avoid blocking other tasks. Default is 20.
• Team / group naming — configure a prefix, suffix, and the course field used in the Team/group name (full name / short name / Moodle-generated ID / ID number).
• Update Teams name on course update — keeps the Team name in sync when the Moodle course name changes.

Teams Classes LTI

In tenants with an education licence, course Teams are class Teams. This enables the Teams Classes LTI feature: the Team can be embedded directly in the Moodle course page as an external tool using mod_lti.

Cohort sync

Advanced page (Site Administration > Plugins > Local plugins > Microsoft 365 Integration > Advanced), Cohort sync section.

Setup

Go to the link in Advanced > Cohort sync to manage mappings between Microsoft 365 groups and Moodle system cohorts.

How it works

The Cohort sync scheduled task (\local_o365\task\cohortsync) applies the following rules:

A user is added to the cohort when all of the following are true:

1. The cohort is mapped to a Microsoft 365 group.
2. The user has a connected Microsoft 365 account.
3. The connected account is a member or owner of the group.

A user is removed from the cohort when all of the following are true:

1. The cohort is mapped to a Microsoft 365 group.
2. The user has a connected Microsoft 365 account.
3. The connected account is not a member or owner of the group.

Users without a connected Microsoft 365 account are never affected.

Limitations:

• Sync is one-way (Microsoft 365 groups → Moodle cohorts only).
• Only system-level cohorts are supported (not course category cohorts).
• Dynamic distribution groups are not supported (Graph API limitation).

School Data Sync (SDS)

SDS sync page (Site Administration > Plugins > Local plugins > Microsoft 365 Integration > SDS sync).

Settings

• Create courses — select schools to sync. A course category is created per school; a course per class.
• Teams creation enabled — automatically connect newly created Moodle courses to their SDS class Teams (only effective if Teams are auto-created by SDS).
• Enrol users — enrol SDS class teachers and members in the corresponding Moodle courses.
• Advanced enrolments sync with SDS classes — enable bidirectional sync: SDS role changes flow to Moodle, and Moodle enrolment/role changes flow back to SDS.
• Teacher role / Member role — Moodle roles assigned to SDS class owners and members respectively.
• Sync profile data from school — select an SDS school to make its teacher/student profile fields available for auth_oidc field mapping.

Scheduled tasks

• The Sync with SDS task (\local_o365\feature\sds\task\sync) handles course creation and profile field sync.
• Sync from Moodle back to SDS (enrolment/role changes) is event-driven and near real-time (allow up to ~1 minute delay on the Microsoft side).

Teams settings

Teams Settings tab.

Prerequisites

Before enabling Teams integration:

1. OpenID Connect authentication is enabled and configured.
2. Allow frame embedding is enabled: Site Administration > Security > HTTP security.
3. Web services are enabled: Site Administration > Advanced features.
4. Moodle Microsoft 365 Webservices is enabled: Site Administration > Plugins > Web services > External services.
5. The Authenticated user role has the Create a web service token (moodle/webservice:createtoken) capability: Site Administration > Users > Permissions > Define roles.

Additional redirect URI

If you registered the Azure app manually (not using the PowerShell script), add the following to the app's Authentication > Redirect URIs:

• https://your.moodle.url/local/o365/sso_end.php

Add the Moodle app to Teams

1. On the Teams Settings tab, click Download manifest file to download the Moodle Teams app manifest (.zip).
2. Upload the file to your tenant's Teams app catalogue following the Microsoft upload instructions.
3. Once uploaded, the app is available in any Team in your tenant.

Teams Moodle app

After downloading the manifest, a Teams Moodle app tab appears in the Microsoft 365 Integration settings. Configure the Moodle app ID (auto-detected from the Teams app catalogue once the app is uploaded).

When configured, every new Team created by course sync will automatically:

• Install the Moodle app.
• Create a Moodle tab in the General channel pointing to the connected Moodle course.

Course request from Teams

Advanced page (Site Administration > Plugins > Local plugins > Microsoft 365 Integration > Advanced), Course request section.

Users with the course request capability (moodle/course:request) can access Request Course from Teams via the Microsoft block. This lets them request a new Moodle course pre-populated with the owners and members of a chosen Teams team.

Setup: Configure the Team owner and Team member role mappings in the Course request section of the Advanced page.

How it works:

1. The user selects a Team they own or belong to that is not yet connected to a Moodle course.
2. After the request is approved, an ad-hoc task enrolls the Team's owners and members (those with a connected Microsoft 365 account) into the new course.
3. The new course is automatically connected to the Team, so ongoing course sync applies.

OneDrive for Business Repository

Downloading and linking files

1. Open a file picker anywhere in Moodle and click OneDrive for Business.
2. Choose a folder:
   • My Files — your personal OneDrive for Business.
   • Courses — SharePoint document libraries for Moodle courses you have access to.
3. Navigate to the file and click it.
4. Optionally set a display filename or author (Moodle-side only; not reflected in OneDrive).
5. Click Select this file.

Uploading files

1. Open a OneDrive document library in the file picker.
2. Click Upload new file.
3. Choose a local file and click Upload this file.

Teams Meeting TinyMCE Plugin

The tiny_teamsmeeting plugin adds a Teams Meeting button to the TinyMCE toolbar, allowing users to create a Teams online meeting and insert its link into any Moodle content.

Prerequisites

The user must be connected to a Microsoft 365 account (see Connecting users to Microsoft 365).

Usage

1. Open the TinyMCE editor in any Moodle context (course page, forum post, assignment description, etc.).
2. Click the Teams Meeting button in the toolbar.
3. A dialog opens with the Teams meeting creation interface.
4. Create the meeting in the dialog. Once created, the meeting URL appears in the dialog.
5. Optionally check Open meeting in new window.
6. Click Add link to insert the meeting link into the editor.

The Teams Meeting creation dialog.

Configuration

Settings at Site Administration > Plugins > Text editors > TinyMCE editor > Teams Meeting.

• Meetings App URL — URL of the meeting creation app. The default points to the Microsoft-hosted app. Change this only if you are hosting a custom version.

Permissions

The button is only shown to users with the tiny/teamsmeeting:add capability. By default this is granted to roles with content-editing capability in the context (e.g. teachers, managers).

Advanced Settings

Advanced tab at Site Administration > Plugins > Local plugins > Microsoft 365 Integration.

Administrator tools

• Tenants — add Microsoft 365 tenants to support multi-organisation login.
• Health check — run automated diagnostics on the integration configuration.
• Connections — view and manage individual user ↔ Microsoft 365 account links. Administrators can manually connect or disconnect any user.
• User matching — batch-link Moodle and Microsoft 365 users via CSV upload. Each row: Moodle username, Microsoft 365 username, 1 (enable M365 login) or 0. Processed in batches during cron.
• Manage Team connections — see all Moodle courses and their connected Teams. Use Connect or Update to trigger an immediate sync for a specific course.
• Maintenance tools:
  • Resync users in groups for courses — force a full resync of all course group memberships.
  • Recreate deleted Microsoft 365 groups — recreate any course groups that were manually deleted in Microsoft 365 admin.
  • Generate debug data package — produces a support package of environment and configuration details. Contains no API keys but does reveal configuration detail — share only with trusted parties.
  • Cleanup OpenID Connect tokens — removes stray tokens that can cause login failures. Run during low-traffic periods as it may interrupt in-progress logins.
  • Cleanup user sync delta tokens — forces a full resync on the next user sync run by clearing the stored delta token.

Other settings

• Reset Team name prefix / Reset group name prefix — when a Moodle course is reset, update the connected Team/group name to indicate the potential change in connection status.
• Microsoft 365 for China — enable if using Microsoft 365 operated by 21Vianet (China).
• Record debug messages — log errors for troubleshooting. View via Site Administration > Reports > Logs, filtering by "Site errors".
• Minimum inexact username length to switch to Microsoft 365 — minimum username length for automatic matching. Prevents short generic accounts (e.g. "admin") from being matched accidentally.
• Profile photo refresh time — minimum interval between profile photo sync runs.
• Custom theme — select the theme used when Moodle is accessed from within a Teams tab.

Known Limitations

• If the Moodle site is not publicly internet-accessible (e.g. on an intranet), the Moodle tab in Teams will not function in the Teams desktop and mobile apps. It will work in the Teams web app (browser).
• A Microsoft 365 user who has never previously logged in to Moodle cannot be signed in silently on their first Teams SSO attempt. They will be prompted to click a button to complete login.
• Cohort sync does not support dynamic distribution groups.
• Cohort sync applies only to system-level cohorts.
• Bidirectional course sync only manages roles configured in the Team owner/member role settings. Other roles in the course are unaffected.
• The Request Course from Teams page load time depends on how many Teams the user belongs to, as all eligible Teams are loaded on page initialisation.

Support

• File a bug or feature request: GitHub Issues
• Community discussion: Moodle office tool integrations forum