MC1191924 – M365 Change Digest

One-line summary

Microsoft Entra ID sign-in will enforce a stricter Content Security Policy, blocking non-Microsoft scripts and injected code, starting rollout in October 2026 to enhance security against XSS threats.

Similar updates

Details

Summary

Microsoft Entra ID will enhance authentication security by enforcing a Content Security Policy that blocks external script injection, allowing only trusted Microsoft scripts. This rollout begins mid-October 2026, affecting browser-based sign-ins on login.microsoftonline.com, with no impact on Entra External ID tenants.

Body (from Message Center)

Introduction

As part of Microsoft’s Secure Future Initiative, we’re updating our Content Security Policy for the Microsoft Entra ID sign-in experience. This change adds an extra layer of protection by allowing only scripts from trusted Microsoft domains to run during authentication, blocking unauthorized or injected external code. This proactive measure helps safeguard users against threats like cross-site scripting (XSS), further strengthening security for your organization.

When this will happen

General Availability (Production/Worldwide only):

Rollout begins mid-October 2026
Expected completion by late October 2026

Periodic communications will be sent closer to release.

How this affects your organization

Who is affected:

Organizations using browser-based sign-in experiences on URLs starting with login.microsoftonline.com.
No impact to Microsoft Entra External ID tenants.

What will happen:

A new Content Security Policy header will be added to Microsoft Entra sign-in pages.
Scripts will only be allowed from Microsoft trusted CDN domains.
Inline script execution will only be allowed from trusted Microsoft sources.
Browser extensions or tools that inject code into the sign-in page will stop working, though users can still sign in.

What you can do to prepare

If you do not use tools or extensions that inject code into the sign-in experience, no action is required.
If you do use such tools, switch to alternatives that don’t inject code.
Test your sign-in flows thoroughly before rollout to identify and resolve any issues early. Testing instructions can be found on our CSP Guide for Microsoft Entra ID.

Learn more:

Compliance considerations

No compliance considerations identified; review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-10-15T00:00:00Z",
    "ai_actions": [
      "Test sign-in flows for compatibility",
      "Replace tools/extensions that inject code into sign-in pages"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Microsoft Entra ID sign-in will enforce a stricter Content Security Policy, blocking non-Microsoft scripts and injected code, starting rollout in October 2026 to enhance security against XSS threats.",
    "ai_topics": [
      "Entra"
    ],
    "category": "stayInformed",
    "details_map": {
      "Summary": "Microsoft Entra ID will enhance authentication security by enforcing a Content Security Policy that blocks external script injection, allowing only trusted Microsoft scripts. This rollout begins mid-October 2026, affecting browser-based sign-ins on login.microsoftonline.com, with no impact on Entra External ID tenants."
    },
    "id": "MC1191924",
    "importance": 0,
    "is_major_change": false,
    "last_modified": "2025-12-03T21:44:55Z",
    "ms_products": [
      "Entra"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Entra"
    ],
    "severity": "normal",
    "tags": [
      "Feature update",
      "User impact",
      "Admin impact"
    ],
    "title": "Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection"
  }
}