Microsoft to block Entra ID script injection attacks starting October
Microsoft Entra ID to block external script injection attacks starting October 2026.
Microsoft will enhance Entra ID sign-in security by enforcing Content Security Policy (CSP) to block external script injection attacks starting mid-October 2026. This change aims to protect users from threats like cross-site scripting (XSS) by only allowing trusted Microsoft-hosted scripts during authentication. Enterprise customers are advised to stop using browser extensions that inject code into sign-in pages and test their sign-in scenarios before the deadline.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMicrosoft is proactively enforcing Content Security Policy (CSP) on Entra ID sign-in pages to eliminate the risk of cross-site scripting (XSS) attacks, which can allow attackers to steal credentials or hijack authentication sessions. The root issue is that browser extensions and third-party scripts injected into authentication pages create an uncontrolled execution environment, bypassing identity security controls. This matters because authentication pages are high-value targets — a compromised sign-in flow can expose entire enterprise environments. Organizations that have customized sign-in experiences with external scripts or browser extensions must act before mid-October 2026 or risk breaking their own authentication workflows.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.