Microsoft to enforce script injection protections in Entra ID

Starting mid-October, Microsoft will block external scripts from running on Entra ID login pages, limiting scripts to those hosted by Microsoft. This is meant to reduce risks like cross-site scripting attacks that steal user credentials. Enterprise customers using browser extensions or tools that inject scripts into the sign-in flow will need to stop before the change. Enforcement is automatic and doesn’t require any setup.

• Microsoft enforcing Content Security Policy for Entra ID logins
• Only Microsoft-hosted scripts allowed on sign-in pages
• Change rolls out automatically mid-October, no admin action required
• Sign-in flows that depend on script injection tools may break
• APIs and Microsoft Authentication Library not affected