[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0f2z4x_V92PEmAbCi7awIVEukQQcI8BqEnhy2qjaFKk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"12605441-e715-454a-b1f9-506ac5b0d0c3","microsoft-enforces-csp-to-block-entra-id-script-injection-attacks","4ba83c0c-8517-4bbb-925c-662fa00b219e","Microsoft Enforces CSP to Block Entra ID Script Injection Attacks","Microsoft is proactively enforcing Content Security Policy (CSP) on Entra ID sign-in pages to eliminate the risk of cross-site scripting (XSS) attacks, which can allow attackers to steal credentials or hijack authentication sessions. The root issue is that browser extensions and third-party scripts injected into authentication pages create an uncontrolled execution environment, bypassing identity security controls. This matters because authentication pages are high-value targets — a compromised sign-in flow can expose entire enterprise environments. Organizations that have customized sign-in experiences with external scripts or browser extensions must act before mid-October 2026 or risk breaking their own authentication workflows.","**Immediate Actions:**\n- Audit all browser extensions deployed across the organization to identify any that inject scripts into Microsoft Entra ID or other identity provider sign-in pages.\n- Test existing sign-in workflows in a staging environment against the new CSP policy before the October 2026 deadline.\n- Remove or replace any non-compliant browser extensions that modify authentication page behavior.\n\n**Long-Term Improvements:**\n- Establish a policy that prohibits unapproved browser extensions on devices used to access sensitive enterprise applications.\n- Maintain an approved software and extension inventory, reviewed quarterly, to ensure only vetted tools interact with identity systems.\n- Adopt a zero-trust posture for authentication flows by restricting client-side script execution to explicitly trusted sources.\n\n**Detection Measures:**\n- Implement endpoint monitoring to detect unauthorized browser extensions installed on managed devices.\n- Enable Entra ID sign-in diagnostic logs and alert on authentication failures that may indicate CSP policy violations post-enforcement.",[12,13,14,15,16,17,18,19,20],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 9 – Email and Web Browser Protections","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-18 – Mobile Code","NIST SP 800-53 AC-3 – Access Enforcement","NIST CSF PR.IP-1 – Baseline Configuration","OWASP Top 10 A03:2021 – Injection (XSS)","GDPR Article 32 – Security of Processing",{},"published","2026-09-30T14:20:22.10485+00:00","2026-09-30T14:20:21.826+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-to-block-entra-id-script-injection-attacks-starting-october\u002F","microsoft-to-block-entra-id-script-injection-attacks-starting-october-29c032","Microsoft to block Entra ID script injection attacks starting October",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":37,"name":38,"slug":39,"description":40,"color":41},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[44,48],{"slug":45,"name":46,"problem":47},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":49,"name":50,"problem":51},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]