Microsoft is set to strengthen Entra ID’s security by enforcing a stricter Content Security Policy to prevent external script injection during user sign-ins starting in October 2026. This update aims to mitigate risks like cross-site scripting attacks, safeguarding organizational authentication processes. #EntraID #ContentSecurityPolicy
Keypoints
- Microsoft will implement a stricter Content Security Policy for login.microsoftonline.com in October 2026.
- The new policy restricts script downloads and inline scripts to trusted Microsoft domains only.
- It aims to protect users from cross-site scripting and code injection attacks during sign-in.
- Organizations are advised to test their sign-in flows and review script dependencies before the implementation.
- Microsoft recommends disabling browser extensions that inject scripts into sign-in pages to ensure compatibility.