Microsoft Entra ID · login.microsoftonline.com
Your staff keep signing in. Here is how to see whether Microsoft Entra's script blocking has reached your sign-in page, and how to fix a branded page that lost its layout. Check the header, then the CSS.
Microsoft scheduled two October changes to the page where browser sign-ins to Microsoft 365 begin. The first, a Content Security Policy that lets only Microsoft's own scripts run on the sign-in page, was scheduled to roll out from mid-October and finish by late October 2026. When ABT checked on October 31, 2026, the page was still sending that policy in report-only mode, so the reliable answer for your institution is one response header on your own sign-in page. The second change began October 26: custom CSS layout and positioning properties in company branding stopped being honored, and a branded page that used them shows Microsoft's default layout until the CSS is fixed.
- Mid to late October 2026: Microsoft's schedule for blocking injected scripts on the sign-in page (Message Center MC1481309)
- October 31, 2026: ABT's check of login.microsoftonline.com found the policy in report-only mode in 10 of 10 responses
- From October 26, 2026: retired custom CSS properties stop being honored, with the rollout expected to complete by late November (MC1435782)
Enforcement status
Is Microsoft Entra blocking injected scripts on the sign-in page yet?
Microsoft scheduled enforcement to begin in mid-October 2026 and complete by late October 2026, and Message Center post MC1481309 still carried that schedule on October 31. When ABT checked the same day, the sign-in page at login.microsoftonline.com was sending the policy in report-only mode, which reports a script that breaks the policy and lets it run. Treat enforcement as close, and read the header on your own sign-in page with the steps below.
The answer in brief
- What
- Two changes to the Microsoft Entra sign-in page: a Content Security Policy that blocks scripts other tools inject, and the retirement of custom CSS layout and positioning properties in company branding.
- Scripts
- Scheduled for mid to late October 2026 (MC1481309). On October 31, 2026, ABT found the policy in report-only mode. One response header shows the mode on your own page.
- CSS
- The retired properties stopped being honored from October 26, 2026, and Microsoft expects the rollout to complete by late November 2026 (MC1435782).
- Staff
- Microsoft says users continue to be able to sign in. Once the policy is enforced, a tool that injected code may stop working, and a branded page that used the retired properties shows the default layout.
- Next
- Full custom CSS retirement later in 2027, with advance notice (MC1458474).
Script blocking announced
The Microsoft Entra blog and Message Center post MC1191924 announce the policy for the sign-in page, with rollout beginning in mid-October 2026.
Script blocking scheduled
MC1481309: enforcement beginning in mid-October and expected to complete by late October. ABT's October 31 check still found report-only mode.
CSS layout properties retire
MC1435782: the affected positioning properties "will no longer be honored and will stop functioning." The rollout is expected to complete by late November 2026.
Full custom CSS retirement
MC1458474: Microsoft Entra "plans to move towards full custom CSS retirement, with advance notice provided."
"Users will continue to be able to sign in even if unsupported script injection tools no longer function."
Microsoft 365 Message Center post MC1481309, Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection, plan for change, published September 28, 2026A Content Security Policy is a header a website sends to the browser listing where scripts may come from, and it arrives in one of two forms. MDN describes the enforcing header, Content-Security-Policy, as one that "allows website administrators to control resources the user agent is allowed to load for a given page." The report-only form, Content-Security-Policy-Report-Only, "helps to monitor Content Security Policy (CSP) violations and their effects without enforcing the security policies." In report-only mode a script that breaks the policy still runs, and the browser reports the violation.
Microsoft's notice describes what the enforced policy does on the Entra sign-in page: "Scripts will be permitted only from trusted Microsoft content delivery network (CDN) domains," and "Inline script execution will be restricted to trusted Microsoft-authorized sources." Microsoft delivers it as part of the service: the change "is enabled by default as part of the service update and does not require tenant configuration." The scope is the browser. MC1481309 says Microsoft Authentication Library (MSAL) and API-based authentication flows sit outside it, "because CSP enforcement applies only to browser-based sign-in experiences using login.microsoftonline.com." Microsoft Entra External ID tenants sit outside it too.
The difference between the two forms matters for planning. Microsoft Learn says enforcement "will start globally in mid-to-late October 2026." ABT checked the sign-in page ten times on October 31, 2026, from three Microsoft regions, and every response carried the report-only header and no enforcing header. Microsoft's schedule is a window of dates, so the reliable answer for your institution comes from your own sign-in page on the day you check, and the console test works the same way in either mode.
The second change is narrower and already in effect. It applies to organizations whose custom CSS uses the retired properties, the ones that, in Microsoft Learn's words, "can move, overlap, resize, or hide page content." Microsoft's stated reason sits close to the first change: "reducing opportunities for deceptive or misleading sign-in experiences."
Side by side
What does each change mean for your staff, your tools, and your branding now?
The script-blocking change touches tools that add code to the sign-in page, and the CSS change touches branded layouts that relied on the retired properties. Each has its own status, its own owner, and its own fix.
| Question | Script blocking (MC1481309) | Custom CSS retirement (MC1435782, MC1458474) |
|---|---|---|
| Status on October 31, 2026 | Scheduled for mid to late October 2026. ABT's check found report-only mode: violations are reported and the scripts still run. | In effect from October 26, 2026. Microsoft expects the rollout to complete by late November 2026. |
| Where | Browser-based sign-in at login.microsoftonline.com. | Branded sign-in pages built with company branding or branding themes. |
| Who has to act | Organizations using browser extensions, monitoring tools, customization tools, or other solutions that inject scripts into the sign-in experience. | Organizations whose custom CSS uses the retired layout and positioning properties. |
| What staff see | Microsoft: users continue to be able to sign in. Once enforced, a tool that injected code into the page may stop working. | Microsoft: logos, images, and text remain visible and may revert to their default placement and appearance. |
| How to tell | One response header: Content-Security-Policy means enforced, with scripts limited to the sources its script-src directive allows; Content-Security-Policy-Report-Only on its own means monitoring. The Console names each violation. |
Download your custom CSS and compare it with Microsoft Learn's retired list (49 entries), or run the tenant branding inspector tool. |
| Tenant setting | Microsoft: "enabled by default as part of the service update and does not require tenant configuration." | Your fix is in your CSS file: remove the retired properties and upload it again. |
| Outside the change | MSAL and API-based authentication flows; Microsoft Entra External ID tenants. | Organizations that were not using custom CSS as of July 21, 2026; Microsoft Entra External ID tenants. |
| The fix | Switch to tools that do their work without injecting code, or have the vendor update the tool. Microsoft Learn: work directly with the vendor. | Redesign the layout with the properties that remain. MC1435782: "There is no supported migration path or replacement for the retired positioning properties." |
| What comes next | Enforcement on Microsoft's schedule. | MC1458474: full custom CSS retirement is planned later in 2027, "with advance notice provided." |
The short version for a busy week
Microsoft's notices ask for action from organizations with a tool that injects scripts into the sign-in page, or custom CSS that used the retired properties. MC1481309 puts the first half plainly: "If your organization does not use tools or extensions that inject code into Microsoft Entra ID sign-in pages, no action is required." The checks below confirm which side you are on, and they work in report-only mode and after enforcement.
Check your sign-in page before enforcement reaches it
ABT runs the header check and Microsoft's sign-in test with your administrators across the paths your teams use, checks your company branding for the retired CSS properties, and lists the vendors who owe you an answer, as part of a free security assessment.
Request the free assessmentThe tools
Which tools inject scripts into the Microsoft Entra sign-in page?
Microsoft names four kinds: browser extensions, monitoring tools, customization tools, and other solutions that inject scripts into the sign-in experience. Microsoft Learn adds what its own analysis found: "most violations come from external browser extensions or injected scripts linked to third-party tools."
Browser extensions
Start with the extensions your device management policies install for everyone, then the ones staff added themselves. A violation from an extension appears only for the people who run it, so test with the browsers your teams actually use.
If you license Microsoft Defender Vulnerability Management (standalone, or the add-on for Microsoft Defender for Endpoint Plan 2), its browser extensions assessment lists the extensions installed on Windows devices in Microsoft Edge, Chrome, and Firefox, with the permissions each one requests.
Monitoring tools
Products that watch sign-in activity by adding their own code to the page. Ask the vendor two things in writing: does the product inject code into login.microsoftonline.com, and how does it work once Microsoft's policy is enforced?
Microsoft Learn's guidance is direct: customers using tools that rely on injected scripts "should work directly with their vendors to identify and implement fixes that comply with CSP requirements."
Customization tools
Anything that changes how the sign-in page looks or what it says by adding code, such as a banner or a notice. Company branding in the Microsoft Entra admin center is the customization path Microsoft documents, and its sign-in page text holds a help desk number or a legal statement.
See what changed for custom CSS on October 26 before moving a design into branding.
Other solutions
Microsoft's notice ends its list with "other solutions that inject scripts into the sign-in experience." The console test decides what is in scope: whatever shows up as a violation on the paths you test counts, whoever built it.
Test where each team signs in
Microsoft Learn: "If a specific team or person caused the violation, it appears only in their flows." An extension installed only on the lending team's laptops shows up only when someone tests on those laptops. Test the sign-in paths of each team, on the devices they use: the inventory covers exactly the paths you tested.
The check
How do you tell whether script blocking has reached your sign-in page?
Read one response header, then run Microsoft's console test. The header tells you the mode on the day you check. The console tells you which tools on your sign-in paths break the policy, and it reports them in either mode.
List the sign-in paths your teams use
Browsers, devices, and the apps people open from the sign-in page: a teller workstation, a loan officer's laptop, a shared device in a branch, a remote worker's managed PC. Microsoft recommends assessing "different sign-in scenarios within your organization," because a violation only appears where its tool runs.
Open developer tools and start a sign-in
In Microsoft Edge or Chrome, press F12 and open the Network tab, then go to a Microsoft 365 sign-in so the browser loads login.microsoftonline.com.
Read the page's response headers
Select the first document request to login.microsoftonline.com and look at its response headers. A Content-Security-Policy header means the browser is enforcing the policy. Its script-src directive lists the script sources the page allows, and Microsoft Learn says enforcement works by "allow-listing only trusted script nonces and origins and blocking everything else by default," so a script injected from anywhere else is blocked. A Content-Security-Policy-Report-Only header on its own means the page is still monitoring: violations are reported and the scripts still run. On October 31, 2026, ABT saw the report-only header alone in every response it checked.
Switch to the Console and read what it reports
Microsoft Learn, step 1: "Go through a sign-in flow with the dev console open to identify any violations." Step 2: "Review the information about the violation displayed in red." A violation names the source that broke the policy, which is where you start tracing the extension or product behind it.
Record each violation, then take it to the vendor
Write down the team, the device, the browser, the source named in the violation, and the tool's owner. MC1481309 asks organizations to "Replace or update any solutions that depend on script injection into Microsoft Entra sign-in pages," and the list is what your vendors answer against.
Tell the help desk and update the documents
The last two actions on Microsoft's list: "Communicate potential impacts to help desk and identity administration teams," and "Update internal documentation if it references affected authentication customizations." A help desk that knows the symptom can answer the first call on the spot.
Your branding
Why did our branded sign-in page change layout, and how do we restore it?
If your company branding uses custom CSS with properties Microsoft retired, those properties stopped being honored from October 26, 2026, and Microsoft expects the rollout to complete by late November. Logos, images, and text stay on the page in Microsoft's default placement. The fix is a cleaner CSS file built from the properties that remain.
Find the retired properties
- Download the file. In the Microsoft Entra admin center, open Custom branding, select Edit, and on the Layout tab, under Custom CSS, select Download.
- Check every locale. Export your branding localizations from Microsoft Graph and paste them into the tenant branding inspector tool Microsoft Learn links; Microsoft Learn says "The tool lists each locale and the deprecated properties that it uses." The check needs a Global Administrator or Branding Administrator account.
- Look for the families. Position and its offsets (top, right, bottom, left, z-index), margin, transform, opacity, overflow, filter, display, visibility, scale, rotate, inset, zoom, grid placement, and masks, among others. Microsoft Learn's list, 49 entries and 58 property names once the offsets under position and the margin longhands are counted, is the one to check against.
Repair the page, then plan for 2027
- Remove and upload. Edit the downloaded file, remove the retired properties, and upload it to company branding. Microsoft Learn: "apply the changes in a test tenant first" to see the visual effect.
- Redesign within the rules. MC1435782: "There is no supported migration path or replacement for the retired positioning properties." The layout you keep is the one the remaining properties can produce.
- Expect more. MC1458474: "Later in 2027: Microsoft Entra plans to move towards full custom CSS retirement, with advance notice provided." Microsoft Learn says recommended migration paths come before that retirement.
Where should a legal notice or a help desk number go?
In the sign-in page text of company branding. Microsoft Learn: "You can use this text to communicate additional information, such as the phone number to your help desk or a legal statement." It takes up to 1,024 characters of Unicode text. The page is public, so Microsoft also asks you to keep sensitive information out of it. Microsoft Learn lists the licenses that include company branding: Microsoft Entra ID P1 or P2, Microsoft 365 Business Standard, or SharePoint (Plan 1). The Organizational Branding Administrator role is the minimum role that can change it.
If an institution added an "authorized use only" banner or a support notice with a script or with positioned CSS, this is where that text moves. Company branding is built from images, text, and CSS you configure in the admin center, and that is the customization path Microsoft documents for the page.
For financial institutions
Why does a sign-in page change matter at a credit union, bank, or mortgage company?
Because staff reach Microsoft 365 through this page all day. A tool that quietly stops working there turns into help desk calls and stalled work, while Microsoft is closing a route attackers use to steal credentials and sessions.
Keep the work moving. Browser sign-ins to Microsoft 365 start at login.microsoftonline.com. When a monitoring or customization tool stops working there, the staff who rely on it notice, and the help desk hears about it. Checking before enforcement reaches your page turns that surprise into a scheduled change with an owner and a date. A branded page that suddenly looks different also draws questions from staff trained to look twice at sign-in pages, so tell them what changed.
Protect the credentials. Microsoft Learn lists what injected scripts can do on a sign-in page: "Attackers can steal sensitive information such as credentials or tokens," and "Injected scripts can take control of active sessions." The policy also covers the case Microsoft calls out by name, a script that gets in "such as through a user-installed malicious browser extension or a zero-day vulnerability." Cross-site scripting, the attack class Microsoft names for this change, made up 15% of all important or critical cases the Microsoft Security Response Center handled across Microsoft services from July 2024 to July 2025, and MSRC notes that a flaw on login.microsoftonline.com "may initially be rated Critical due to the domain's sensitivity."
Close it with a record. The header reading, the test results, the vendor answers, and the CSS change make a short, dated file: what you checked, what you found, who owns each tool, and what changed. A security or monitoring product that stops working on the sign-in page is also a vendor question with a date attached, so ask it in writing and keep the answer with that vendor's file.
These two changes sit beside other Microsoft Entra sign-in changes this fall. Our page on finding the users Microsoft's SMS and voice MFA retirement affects covers the count that decides that one. Institutions that run third-party MFA through Conditional Access custom controls have their own timeline, covered in Conditional Access custom controls after the freeze.
Why does Microsoft guard the sign-in page this closely?
Because the sign-in page is where credentials are typed. Microsoft Learn puts that first in its list of what an injected script can do there: "Attackers can steal sensitive information such as credentials or tokens." The Short from our channel is about the same target, credential theft.
Microsoft Learn describes the policy as a second layer for exactly that moment: where a script gets onto the page despite the browser's first defenses, "CSP prevents that script from executing." Your part is to make sure the tools you rely on are ready when the page moves from reporting to enforcing.
How ABT helps
A free security assessment
ABT is a Tier 1 Microsoft Cloud Solution Provider serving more than 750 financial institutions, and the sign-in page check is part of this assessment.
We check which mode your sign-in page is in, run Microsoft's sign-in test with your administrators, check your branding for the retired CSS properties, and list what needs a vendor answer
The assessment is free and ends with written findings you keep. We work through the tests and settings with an administrator on your team, and your team decides what changes in the tenant and who makes each change.
- The header and sign-in test. The policy mode your sign-in page is in, and Microsoft's console test on the sign-in paths, devices, and browsers we agree with your team, with every reported violation recorded against the tool behind it.
- The extension picture. The browser extensions your device management policies install, plus the Defender Vulnerability Management browser extensions inventory where you license it.
- The branding check. Your company branding localizations checked for custom CSS and the retired layout and positioning properties, with the changes that bring it back within the supported properties.
- The vendor list. Each tool that needs an answer from its vendor before enforcement reaches your page, with the question to ask.
- The record. A dated summary of the findings and the changes your team decides to make, ready for your change-management file.
ABT also operates M365 Guardian, its managed security service for credit unions, banks, and mortgage companies. Learn about M365 Guardian
Related reading
If this opened a bigger question
These three cover other ways attackers go after Microsoft 365 sign-ins, each with its own controls: proxying the real page, faking a familiar one, and stealing the session that follows.
Knight Office AiTM Kit: Persistence Past Password Reset
How an adversary-in-the-middle kit captures a Microsoft 365 sign-in, and what a password reset leaves behind.
Read the article
AI Brands as Bait: How Fake ChatGPT and Copilot Pages Steal Financial Institutions' Microsoft 365 Logins
Fake AI-brand pages built to collect Microsoft 365 logins, and how institutions stop them.
Read the article
Hotel Wi-Fi Is Stealing Microsoft 365 Sessions
What a stolen Microsoft 365 session token gives an attacker, and the controls that limit it.
Read the articleAnswered
Microsoft Entra sign-in page changes, answered
Verify it yourself
Where the facts on this page come from
Every Microsoft date, scope line, step, and quotation above was read from the sources listed here. The page was first published from the same sources on October 5, 2026.
- ABT's check of the Microsoft Entra sign-in page, October 31, 2026: ten requests to login.microsoftonline.com, answered from three Microsoft regions, each returning a
Content-Security-Policy-Report-Onlyheader and noContent-Security-Policyheader. Anyone can repeat it with the browser's developer tools, as described in the steps above. ABT first saw the report-only header on October 5, 2026. - Microsoft 365 Message Center post MC1481309, Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection, plan for change, published September 28, 2026; Message Center listed October 19, 2026 as its act-by date. Source for the mid-October to late-October schedule, who is affected, the policy's behavior, the sign-in statement, the default-on delivery, the MSAL and API scope, the External ID scope, and Microsoft's action list. Visible to administrators in your own Microsoft 365 admin center; a public archive copy is at mc.merill.net/message/MC1481309.
- Microsoft 365 Message Center post MC1191924, the first announcement of the same change, published December 3, 2025. Public archive copy: mc.merill.net/message/MC1191924.
- Microsoft Learn, Content Security Policy overview for Microsoft Entra ID. Source for "mid-to-late October 2026", the browser-only scope, the risks of script injection, Microsoft's analysis of where violations come from, the vendor guidance, and the console test.
- Microsoft Entra blog, Enhance protection of Microsoft Entra ID authentication by blocking external script injection, November 25, 2025.
- Microsoft 365 Message Center post MC1435782, Microsoft Entra ID: Retirement of custom CSS positioning properties in custom branding, published July 21, 2026. Source for the October 26, 2026 date, the late-November 2026 completion, the default-placement behavior, and the absence of a migration path for the retired properties. Public archive copy: mc.merill.net/message/MC1435782.
- Microsoft 365 Message Center post MC1458474, Microsoft Entra ID: Retirement of custom CSS layout and positioning properties in company branding, published August 21, 2026. Source for the additional retired properties, the download steps, the July 21, 2026 and 2027 milestones, and the External ID scope. Public archive copy: mc.merill.net/message/MC1458474.
- Microsoft Entra blog, Microsoft Entra ID enhances security of branded sign-ins, July 21, 2026.
- Microsoft Learn, CSS template reference guide for company branding. Source for the retired list (49 entries, 58 property names), the steps to download and inspect your CSS, the tenant branding inspector tool, the test-tenant advice, and the eventual full retirement.
- Microsoft Learn, Add company branding to your organization's sign-in page. Source for the license and role requirements and the sign-in page text.
- Microsoft Learn, Browser extensions assessment in Microsoft Defender Vulnerability Management. Source for the licensing, the Windows-only scope, and the browsers covered.
- Microsoft Security Response Center, Why XSS still matters: MSRC's perspective on a 25-year-old threat, September 4, 2025. Source for the 970+ cases and the 15% share.
- MDN Web Docs, Content-Security-Policy header and Content-Security-Policy-Report-Only header. Source for what each header does.
Microsoft Entra is moving its sign-in page from reporting injected scripts to blocking them.
Know what touches yours first.
The work starts with the header check and Microsoft's console test across the sign-in paths your teams use, and a look at your company branding. When it is done, you know which mode your sign-in page is in, which tools showed up on the paths you tested, which vendors owe you an answer, and whether your custom CSS uses the retired properties.
Tell us a little about your environment and we will come back with what we would check first.
What should we look at? Optional.
Encrypted. Private.
Thank you. That is with us.
An ABT specialist will be in touch shortly. If a tool has already stopped working on your sign-in page, or your branded page changed layout, say so in your reply and we will start there.
