Microsoft to block Entra ID script injection attacks starting October
Microsoft will enforce Entra ID Content Security Policy in October 2026 to block external script injection during sign-in.
Microsoft will enforce a Content Security Policy on Entra ID browser sign-ins starting mid-October 2026, with the rollout expected to finish by late October. The policy allows scripts only from trusted Microsoft CDN domains and blocks externally injected code, including cross-site scripting, on login.microsoftonline.com. Extensions and tools that inject scripts into sign-in pages may stop working, but users can still sign in, and MSAL and API flows are unaffected. No tenant configuration is required; the change is part of the Secure Future Initiative.
- CSP enforcement on Entra sign-ins begins mid-October 2026.
- Only scripts from trusted Microsoft CDN domains will run.
- Browser tools that inject sign-in scripts may stop working.
- MSAL and API authentication flows are not affected.
From the original article
2 min read at bleepingcomputer.com
Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.