Microsoft is moving forward with plans to strengthen Entra ID's defenses against script injection threats, with enforcement beginning in mid-October 2026. The company had previously outlined this security initiative in November 2025, and a message center update confirms the timeline for deployment across all users by late October 2026.
The protection mechanism relies on Content Security Policy (CSP) rules that will restrict script execution during Entra ID sign-ins to only those originating from Microsoft-controlled content delivery network (CDN) domains. This approach prevents malicious code from being injected into authentication flows to harvest user credentials through cross-site scripting attacks.
Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026. This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code.
Microsoft
Preparation steps for organizations
Organizations should audit their authentication infrastructure before the October deadline. Microsoft recommends discontinuing any browser extensions or third-party tools that inject scripts or code into sign-in pages, as these will no longer function once the CSP rules activate.
IT administrators can proactively identify potential conflicts by examining sign-in flows using browser developer tools and searching for violations displayed in red text. Testing sign-in scenarios ahead of the enforcement date will help teams discover dependencies on code-injection mechanisms and address them before the change takes effect.
Microsoft clarified that users will retain the ability to complete sign-ins even if unsupported script injection tools cease functioning. The CSP enforcement activates automatically as part of the service update and requires no tenant-level configuration changes.
Microsoft Authentication Library (MSAL) and API-based authentication flows are not affected because CSP enforcement applies only to browser-based sign-in experiences using login.microsoftonline.com.
Microsoft
Connection to broader security initiative
This change forms part of Microsoft's Secure Future Initiative (SFI), launched in response to a significant breach in May and June 2023 when Chinese-linked threat actors compromised Exchange Online mailboxes belonging to dozens of organizations and hundreds of individuals worldwide.
Under the same initiative, Microsoft has taken additional hardening measures including removing all ActiveX controls from Windows versions of Microsoft 365 and Office 2024 applications. The company also strengthened Microsoft 365 security defaults to prevent access to Office, SharePoint, and OneDrive content through legacy authentication methods.