GoKawiilMicrosoft to enforce stricter script policy on Entra ID sign-ins from mid-October 2026
Microsoft confirmed it will begin enforcing a Content Security Policy on Entra ID sign-in pages starting mid-October 2026, allowing only scripts hosted on trusted Microsoft CDN domains to run during authentication. The rollout, first announced in November 2025, is expected to complete by late October 2026 and applies automatically without tenant configuration.
GoKawiil's interpretation of the reporting above, not reported fact.
By blocking externally injected scripts, the change aims to close off a common vector for cross-site scripting attacks used to steal credentials during login. Enterprises relying on browser extensions or third-party tools that inject code into sign-in pages could see those tools stop working, so Microsoft's advice to test sign-in flows beforehand suggests it anticipates some disruption for IT teams.
- Enforcement begins mid-October 2026 and completes by late October 2026.
- Only scripts from trusted Microsoft CDN domains will be allowed during Entra ID sign-ins.
- Enterprises should test sign-in flows now to catch tools that may break under the new policy.
Source: bleepingcomputer.com, 2026-09-30
Published there as: “Microsoft to block Entra ID script injection attacks starting October”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.