Microsoft Enhancing Entra ID Authentication

 

Microsoft is enhancing Entra ID authentication security by enforcing a stricter Content Security Policy (CSP) that blocks external script injection starting in mid-to-late October 2026. This change will prevent unauthorized scripts from executing during browser-based sign-ins.

What’s Changing in Entra ID Authentication

As part of Microsoft’s Secure Future Initiative, Entra ID will implement a hardened Content Security Policy (CSP) for sign-in pages hosted at login.microsoftonline.com. This update will:

• Block external script injection, including inline scripts from untrusted sources.
• Allow only scripts from Microsoft-trusted domains (e.g., Microsoft CDN).
• Mitigate cross-site scripting (XSS) and other injection-based attacks during authentication.

This change does not affect Microsoft Entra External ID or non-browser-based sign-in experiences.

What Admins Should Do

To prepare for the rollout:

• Stop using browser extensions or tools that inject scripts into the Entra sign-in page. These will be blocked.
• Test sign-in flows using browser developer tools:
• Open the dev console during sign-in.
• Look for CSP violations in red — these indicate scripts that will break post-enforcement.
• Review dependencies on injected scripts or custom login flows and migrate to supported alternatives.

Why It Matters

This proactive measure adds a critical layer of defense against modern threats like:

• Credential theft via injected JavaScript
• Session hijacking
• UI manipulation during login

By locking down script execution, Microsoft ensures that only trusted code runs during authentication, reducing attack surface and improving organizational resilience.

Timeline

• Global rollout begins: Mid-to-late October 2026
• Periodic reminders: Microsoft will notify tenants ahead of enforcement
• Impact scope: Only browser-based sign-ins at login.microsoftonline.com

*Tested in the wild - 11-26-2025

Staff Notification Template

Staff Advisory: Entra ID Authentication Security Update

Effective October 2026, Microsoft will enhance the security of Entra ID (formerly Azure AD) authentication by enforcing a stricter Content Security Policy (CSP). This change will block external script injection during browser-based sign-ins to prevent unauthorized code execution.

What’s Changing

• Only scripts from Microsoft-trusted domains will be allowed during sign-in.
• Inline or third-party scripts (including browser extensions that inject code) will be blocked.
• This applies to sign-ins at login.microsoftonline.com.

Why It Matters

This update protects users from:

• Credential theft via injected JavaScript
• UI manipulation during login
• Session hijacking and phishing attempts

What You Need to Do

• Stop using browser extensions that modify or inject scripts into the Entra sign-in page.
• Test your sign-in flows using browser developer tools:
• Open the console during login and check for CSP violations.
• Report any issues with login flows to IT before October 2026.

What’s Not Affected

• Non-browser-based sign-ins (e.g., mobile apps, desktop clients)
• Microsoft Entra External ID

This is part of Microsoft’s Secure Future Initiative. Our IT team is monitoring the rollout and will provide updates as needed. If you have questions or encounter issues, please contact the Help Desk.