Add option to remove expired role memberships from Entra ID during sync

[Copilot]

This PR implements a new synchronization feature that automatically removes users from Entra ID groups when their corresponding DNN role memberships have expired.

Problem

Currently, when DNN roles have expiry dates and expire, users lose access locally in DNN but remain in the corresponding Entra ID groups. This creates a security gap where users retain permissions in Azure/Microsoft 365 services even after their role access has expired in DNN.

Solution

Added a new configuration option "Remove Expired Role Memberships from Entra ID" that:

1. Identifies expired memberships during the sync process
2. Removes users from corresponding Entra ID groups using Graph API
3. Allows natural cleanup of DNN role memberships on next user login

Key Features

Backend Implementation

• New RemoveExpiredRoleMembershipsEnabled setting in AzureConfig
• RemoveExpiredRoleMemberships() method in sync scheduler
• Enhanced user lookup logic to map DNN users to Entra ID users
• Comprehensive error handling and logging

Frontend Implementation

• Toggle switch in Advanced Settings → Sync Settings panel
• Localized labels and help text
• Integrated with existing settings save/load flow

Security & Compatibility

• Only processes roles imported from Entra ID (IdentitySource=Azure)
• Respects existing role mappings and group name prefixes
• Uses existing Graph API permissions
• Disabled by default, opt-in feature
• No impact on existing functionality when disabled

Example Workflow

1. User has "Marketing Team" role with expiry date 2024-01-01
2. Current date: 2024-06-16 (role has expired)
3. Sync process runs with new feature enabled
4. User is removed from "Marketing-Group" in Entra ID
5. On next login, DNN automatically cleans up the local role membership

Technical Details

• Configuration: Added to AzureConfig with proper persistence
• API Integration: Enhanced AzureADProviderSettings for frontend support
• User Lookup: Uses AuthenticationController.GetUserAuthentications() to map DNN users to Entra ID
• Graph API: Leverages existing RemoveGroupMember() functionality
• Error Handling: Individual failures don't stop the entire sync process
• Logging: Detailed success/error reporting with statistics

Testing

• Validated configuration persistence and API integration
• Verified frontend component state management
• Confirmed proper error handling for edge cases
• Ensured backward compatibility with existing sync functionality

Fixes #119.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.