Microsoft announced that starting mid-October 2026, Entra ID will enforce a stricter Content Security Policy during browser-based sign-ins to block external script injection attacks, including cross-site scripting. The CSP will allow only scripts from trusted Microsoft-hosted CDN domains, preventing unauthorized or malicious code execution during authentication. This enforcement applies only to browser sign-ins via login.microsoftonline.com and does not impact API-based authentication or MSAL. Enterprises are advised to discontinue use of any browser extensions or tools that inject scripts into sign-in pages and to test their sign-in scenarios for potential issues. The rollout is expected to complete by late October 2026. This measure is part of Microsoft's broader Secure Future Initiative, which includes other security enhancements following prior cyberattacks.

The enforcement of the CSP will block external script injection attacks during Entra ID browser-based sign-ins, reducing the risk of credential theft and other security threats related to cross-site scripting. Users will still be able to sign in even if unsupported script injection tools stop functioning. API-based authentication flows remain unaffected. The update improves the overall security posture of Entra ID sign-ins by limiting script execution to trusted Microsoft sources.

Microsoft has enabled this CSP enforcement by default as part of a service update; no tenant configuration is required. Customers should stop using browser extensions or tools that inject scripts into Entra ID sign-in pages before mid-October 2026 and test their sign-in flows using the browser developer console to identify any blocked scripts or violations. Since the change is already enabled by default, no additional action is required to receive the protection once the rollout completes.