Microsoft will begin blocking unauthorized external scripts on Entra ID browser sign-in pages in mid-October 2026. The Entra ID security update aims to reduce script injection risks during authentication, including cross-site scripting attacks.
The rollout should finish by late October. Meanwhile, organizations should check whether their sign-in processes rely on tools that inject scripts into these pages.
New Policy Restricts Scripts During Sign-In
Microsoft will enforce a stricter Content Security Policy, or CSP, for browser-based authentication through login.microsoftonline.com. Under this policy, sign-in pages will only allow scripts from trusted Microsoft content delivery network domains.
This restriction helps prevent unauthorized code from running during authentication. For example, attackers can use cross-site scripting to inject malicious code into vulnerable pages and attempt to steal credentials.
Microsoft first announced plans for these protections in November 2025. It has now reminded customers to prepare before enforcement begins.
Businesses Should Review Extensions and Sign-In Tools
Before the rollout, Microsoft advises organizations to stop using browser extensions and tools that inject scripts into sign-in pages.
Although these tools may support existing workflows, the new policy could prevent their injected code from running. Consequently, businesses should test their authentication processes and address any dependencies before enforcement starts.
IT administrators can inspect browser developer consoles during sign-in to identify potential problems. CSP violations appear as red error messages with details about the scripts that the policy blocks.
These checks can therefore help teams identify affected tools and adjust their workflows ahead of the change.
Standard Sign-Ins Will Continue Working
Microsoft says users will still be able to sign in if unsupported script injection tools stop functioning. However, features that depend on those tools may no longer work.
The Entra ID security change will take effect automatically through a service update. As a result, administrators do not need to configure their tenants to enable it.
Microsoft also says Microsoft Authentication Library, or MSAL, and API-based authentication flows remain unaffected. The enforcement applies specifically to browser-based sign-in experiences using login.microsoftonline.com.
Update Extends Microsoft’s Security Initiative
The rollout forms part of Microsoft’s Secure Future Initiative, which aims to strengthen protection across its products and services.
Microsoft launched that initiative after Chinese hackers accessed Exchange Online mailboxes belonging to organizations and individuals in 2023.
Separately, the company has disabled ActiveX controls by default in Windows versions of Microsoft 365 and Office 2024. It has also tightened Microsoft 365 defaults to restrict file access through legacy authentication protocols.
0 responses to “Entra ID Security Update Will Block External Sign-In Scripts in October”