Skip to content
Microsoft Enforces CSP to Block Third-Party Scripts on Sign-In Pages

Microsoft Enforces CSP to Block Third-Party Scripts on Sign-In Pages

First seen 17 Oct 2026, 22:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 22:38 UTC
  • •CSP enforcement starts mid-to-late October 2026, blocking untrusted scripts.
  • •Affected users include those using browser extensions that inject JavaScript.
  • •Organizations must transition to non-injecting alternatives to maintain functionality.

Starting mid-to-late October 2026, Microsoft will enforce Content Security Policy (CSP) on its sign-in pages at login.microsoftonline.com. This measure blocks all scripts not originating from trusted Microsoft domains, affecting browser extensions that inject JavaScript, including password managers and accessibility tools. The enforcement aims to mitigate risks such as cross-site scripting (XSS) and credential theft. However, it does not impact Microsoft Entra External ID customers using custom domains or non-browser authentication flows. Users can still sign in normally, but organizations relying on injected scripts must transition to non-injecting alternatives. This move is part of a broader initiative to harden authentication processes following recent vulnerabilities. Administrators can check for CSP violation reports in the browser console during sign-in.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6d ago How this analysis works

Timeline

2026-10-17
CSP enforcement announced
Microsoft confirmed the global rollout of CSP on sign-in pages to block unauthorized scripts.
Forkast.News
2026-10-17
CSP enforcement details published
Microsoft outlined the specifics of CSP enforcement and its implications for users and organizations.
learn.microsoft.com

More articles in this cluster (3)

Extracted Entities (3)

1 / 3

Common questions

What is the scope of CSP enforcement?
CSP enforcement applies only to browser-based sign-in at login.microsoftonline.com.
What should organizations do to prepare?
Organizations should transition to non-injecting alternatives for tools that currently inject scripts.
Will users still be able to sign in?
Yes, users can still complete standard sign-in, but injected script functionalities will be disabled.