Microsoft Entra ID Will Block Injected Scripts at Sign-In

Microsoft will begin enforcing a Content Security Policy on Entra ID sign-ins in mid-October 2026. The policy is designed to block externally injected scripts on the login page.

The Brief

• Entra ID sign-in pages will allow only trusted Microsoft-hosted scripts to run during authentication, with enforcement starting in mid-October, per Microsoft.
• The rollout should end by late October 2026. Microsoft says it is on by default and needs no tenant setup.
• Sign-ins in a browser are in scope. Microsoft Authentication Library (MSAL) and API-based authentication flows are not affected, Microsoft says.
• Enterprise customers should stop using browser extensions and tools that inject code or scripts into sign-in pages, according to Microsoft.

Entra ID sign-ins will accept only Microsoft-hosted scripts

Microsoft first revealed plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement, according to BleepingComputer. The enforcement step…