Microsoft to block Entra ID script injection attacks starting October
Source Bleeping Computer
Description
Microsoft will enhance the security of its Entra ID authentication system starting mid-October 2026 by enforcing a Content Security Policy (CSP) that blocks external script injection attacks. This CSP will restrict scripts to only those hosted on trusted Microsoft CDN domains during browser-based sign-ins, mitigating risks such as cross-site scripting (XSS). The change is enabled by default and does not require tenant configuration. Microsoft advises customers to stop using browser extensions or tools that inject scripts into sign-in pages before the enforcement begins and to test sign-in flows for compatibility. API-based authentication flows and Microsoft Authentication Library (MSAL) are not affected by this change. This update is part of Microsoft's Secure Future Initiative, which aims to improve security following previous breaches.