Microsoft has announced a major security enhancement designed to protect Entra ID authentication flows from external script injection and XSS-style attacks, rolling out mid-to-late October 2026.
🛡️ What’s changing?
Microsoft will enforce a stricter Content Security Policy (CSP) that allows:
- ✔️ Script downloads only from Microsoft-trusted CDN domains
- ✔️ Inline script execution only from Microsoft-approved sources
- ❌ No third-party script injection during authentication
This protects against credential theft, cross-site scripting, malicious extensions, and manipulated login flows.
🌐 What does this impact?
- Applies only to sign-ins using browser-based flows on:
👉https://login.microsoftonline.com/* - Entra External ID is not affected
- Legacy extensions/tools that inject code into sign-in pages will break
🧪 Action required for IT & Security Teams
Microsoft urges organizations to test authentication paths before rollout:
- Open the browser developer console during sign-in
- Look for red CSP violation messages
- Identify tools/extensions that inject scripts
- Update or remove incompatible automation workflows
🚫 Stop using browser extensions that modify sign-in pages — they won’t work after enforcement.
🏗️ Part of Microsoft’s Secure Future Initiative
This update follows major SFI improvements across the ecosystem, including:
- Blocking legacy auth from accessing SharePoint / OneDrive
- Disabling all ActiveX controls in Microsoft 365
- New protections in Teams to block screen capture during meetings
This is a strong step toward eliminating attack surfaces and improving identity security.
🔎 Recommendation:
Review your authentication flows now, before October 2026, to ensure nothing relies on injected JavaScript during login.
