Microsoft starts locking down Entra ID sign

Feeds.4Sysops •IT News • September 30, 2026

Microsoft will begin enforcing tighter Content Security Policy checks on Entra ID sign-ins in mid-October 2026, blocking externally injected scripts and limiting logon pages to trusted Microsoft CDN content. The change rolls out automatically, needs no tenant configuration, and is meant to reduce exposure to cross-site scripting and other sign-in attacks. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Enhances Entra ID Security Against Script Injection Attacks Starting mid-October 2026, Microsoft will enforce stricter Content Security Policy (CSP) checks on Entra ID sign-ins to block external script injections. This initiative aims to protect users from cross-site scripting (XSS) and other sign-in attacks by allowing only scripts from trusted Microsoft CDN domains. The changes are part of Microsoft's Secure Future Initiative, which was announced following a significant breach in 2023. Enterprise customers are advised to discontinue the use of browser extensions that inject scripts into sign-in pages before the CSP enforcement takes effect. IT administrators should test their sign-in scenarios to identify potential issues with code-injection tools. The rollout is automatic and requires no tenant configuration, ensuring all users are protected without additional setup. Microsoft emphasized that users can still sign in even if unsupported tools are disabled. 2 sources 31

Microsoft starts locking down Entra ID sign

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)