Skip to content
Today
Sections

Security Independently confirmed2 publishers 2 min read Published

Entra ID sign-in pages will run only Microsoft-hosted scripts from mid-October

Microsoft will allow only scripts from its own CDN domains during Entra ID browser sign-ins under a Content Security Policy enforced from mid-October 2026. Browser extensions and tools that inject code into the sign-in page will stop working as the rollout completes in late October.

The Watch · Security desk

Send a correction

Illustration accompanying Entra ID sign-in pages will run only Microsoft-hosted scripts from mid-October
Generated illustration

What happened

  • The policy covers only browser-based sign-in at login.microsoftonline.com, so apps using the Microsoft Authentication Library or API-based flows are unaffected.
  • Enforcement is switched on by default as part of the service update, and Microsoft says tenants need no configuration to receive it.
  • Admins can spot affected tools by walking sign-in flows with the browser developer console open, where blocked scripts show up as red policy violations.
  • Microsoft first announced the plan in November 2025 and repeated the timing in a Monday message center update, according to BleepingComputer.

Why it matters

  • What it limits constraint An attacker who gets script onto the Entra sign-in page through an XSS flaw or an injecting extension loses that route to credentials once enforcement lands.
  • Who's exposed exposure Credential pages on attacker-controlled domains sit outside a policy scoped to login.microsoftonline.com, so lookalike phishing is unaffected by this change.
  • Who has to decide decision Teams that depend on a code-injecting extension must replace it or retire the workflow before mid-October, since the change arrives on by default without any tenant action.

Until enforcement starts, the policy does not block code injected into the Entra ID sign-in page [18]. Microsoft framed the change around cross-site scripting. "This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code," the company said [6]. BleepingComputer lists XSS among the sign-in risks the rollout addresses. It describes that attack as malicious code injected into a website to steal credentials [7].

Microsoft expects browser extensions and tools that inject code or scripts into sign-in pages to break. It told enterprise customers to stop using them before the policy takes effect [8]. BleepingComputer's account of the notice does not mention custom-branded sign-in pages. Breakage stops at the tool [11]. "Users will continue to be able to sign in even if unsupported script injection tools no longer function," Microsoft said [11].

For admins, the work before the deadline is inventory [9]. Microsoft urged customers to test sign-in scenarios before the deadline to find and fix any dependency on code-injection tools [9]. Customers have had about 11 months between the first announcement and the start of enforcement [17]. Monday's message center update, seen by BleepingComputer, reminded them that the protection starts next month [1].

The policy is part of Microsoft's Secure Future Initiative. Microsoft set up that program after Chinese hackers breached Exchange Online mailboxes at dozens of organizations and hundreds of individuals in May and June 2023 [14]. Under the same program, Microsoft disabled all ActiveX controls in Windows versions of Microsoft 365 and Office 2024 apps [15]. It also changed Microsoft 365 security defaults to block access to Office, SharePoint and OneDrive files over legacy authentication protocols [16].

What to watch

  • Whether Microsoft publishes a list of known-affected extensions, or a tenant-level exception, before enforcement starts in mid-October.
  • Compatibility notices from extension and tool vendors whose products write into login.microsoftonline.com as the rollout runs through late October.
  • Any move to apply the same script policy to Microsoft sign-in hosts beyond login.microsoftonline.com.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption
Not scored
Hype gap+10
Incentives30
Confidence70
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    In a Monday message center update seen by BleepingComputer, Microsoft reminded customers that Entra ID will get better protection against external script injection attacks starting next month.

    Reported Supported Source: BleepingComputer, citing a Microsoft message center updateView cited source
  2. [2]

    Microsoft first revealed plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement.

    Reported Supported Source: BleepingComputerView cited source
  3. [3]

    Microsoft will begin enforcing additional Content Security Policy (CSP) defenses that only allow scripts from trusted Microsoft content delivery network (CDN) domains during Entra ID sign-ins.

    Reported Supported Source: BleepingComputer, citing Microsoft message center updateView cited source
  4. [4]

    The rollout should end by late October 2026.

    Reported Supported Source: BleepingComputerView cited source
  5. [5]

    "Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026,"

    Reported Supported Source: Microsoft, quoted by BleepingComputerView cited source
  6. [6]

    "This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code."

    Reported Supported Source: Microsoft, quoted by BleepingComputerView cited source
  7. [7]

    The sign-in security risks addressed include cross-site scripting attacks in which malicious code is injected into websites to steal credentials.

    Reported Supported Source: BleepingComputerView cited source
  8. [8]

    Microsoft advised enterprise customers to stop using browser extensions and tools that inject code or scripts into sign-in pages before the new CSP changes take effect.

    Reported Supported Source: BleepingComputer, reporting Microsoft's adviceView cited source
  9. [9]

    Microsoft urged customers to test sign-in scenarios before the deadline to identify and address any dependency issues on code-injection tools.

    Reported Supported Source: BleepingComputer, reporting Microsoft's adviceView cited source
  10. [10]

    IT administrators can identify potential impact by reviewing sign-in flows in the browser developer console and looking for violations that appear in red text with details about the blocked scripts.

    Reported Supported Source: BleepingComputer, reporting Microsoft guidanceView cited source
  11. [11]

    "Users will continue to be able to sign in even if unsupported script injection tools no longer function."

    Reported Supported Source: Microsoft, quoted by BleepingComputerView cited source
  12. [12]

    "This change is enabled by default as part of the service update and does not require tenant configuration."

    Reported Supported Source: Microsoft, quoted by BleepingComputerView cited source
  13. [13]

    "Microsoft Authentication Library (MSAL) and API-based authentication flows are not affected because CSP enforcement applies only to browser-based sign-in experiences using login.microsoftonline.com."

    Reported Supported Source: Microsoft, quoted by BleepingComputerView cited source
  14. [14]

    The change is part of Microsoft's Secure Future Initiative, announced after Chinese hackers breached the Exchange Online mailboxes of dozens of organizations and hundreds of individuals worldwide in May and June 2023.

    Reported Supported Source: BleepingComputerView cited source
  15. [15]

    As part of the Secure Future Initiative, Microsoft disabled all ActiveX controls in Windows versions of Microsoft 365 and Office 2024 apps.

    Reported Supported Source: BleepingComputerView cited source
  16. [16]

    As part of the Secure Future Initiative, Microsoft updated Microsoft 365 security defaults to block access to Office, SharePoint and OneDrive files via legacy authentication protocols.

    Reported Supported Source: BleepingComputerView cited source
  17. [17]

    About 11 months separate the November 2025 announcement from the mid-October 2026 start of enforcement.

    Derived Supported
  18. [18]

    Before enforcement begins in mid-October 2026, the new policy is not blocking externally injected scripts on the Entra ID sign-in page.

    Derived Supported
  19. [19]

    Because CSP enforcement applies only to browser-based sign-in on login.microsoftonline.com, credential pages served from other domains, such as attacker-controlled lookalikes, fall outside the policy.

    Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · September 30, 2026

    Microsoft to block Entra ID script injection attacks starting October
  2. scworld.com

    1 article · September 30, 2026

    Microsoft Entra ID to enhance security against script injection attacks

Topics and entities

Topics

Entities