Microsoft Entra ID to enhance security against script injection attacks

Microsoft is implementing enhanced security measures for its Entra ID authentication system to protect against external script injection attacks. These new defenses will begin rolling out next month and are expected to be fully enforced by late October 2026, based on information published by Bleeping Computer.

Starting mid-October 2026, Microsoft will enforce stricter Content Security Policy (CSP) defenses within Entra ID sign-ins. This update will only permit scripts from trusted Microsoft content delivery network (CDN) domains, effectively blocking unauthorized or externally injected code. This measure aims to mitigate risks such as cross-site scripting (XSS) attacks, which are often used to steal user credentials. Enterprise customers are advised to cease using browser extensions and tools that inject scripts into sign-in pages before the enforcement begins. They should also test their sign-in processes to identify and resolve any dependencies on such tools.

This enhancement is part of Microsoft's broader Secure Future Initiative, launched in response to past security breaches. The CSP enforcement applies only to browser-based sign-in experiences using login.microsoftonline.com and does not require tenant configuration.

Source: Bleeping Computer