Introduction

Microsoft is taking steps to enhance the security of its Entra ID identity and access management (IAM) solution, starting in October. The company announced plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement. This update includes the implementation of additional Content Security Policy (CSP) defenses that will only allow scripts from trusted Microsoft content delivery network (CDN) domains during Entra ID sign-ins. The rollout is expected to end by late October 2026, providing comprehensive protection against various sign-in security risks, including cross-site scripting (XSS) attacks.

Microsoft to block Entra ID script injection attacks starting October

New CSP Defenses

Microsoft will enforce these new CSP defenses starting in October, ensuring that only scripts from trusted Microsoft domains are executed during Entra ID sign-ins. This change is part of the Secure Future Initiative (SFI), announced after a significant security breach involving Chinese hackers in May and June 2023. The initiative aims to enhance security across Microsoft's services and products.

CSP Enforcement Details

This means that any scripts from external sources, including browser extensions and tools, will be blocked. Microsoft advises enterprise customers to stop using browser extensions and tools that inject code or scripts into sign-in pages before the new CSP changes take effect. This will help ensure that users are protected from potential security risks.

Testing and Impact

IT administrators can identify potential impact by reviewing sign-in flows in the browser developer console and looking for violations that appear in red text with details about the blocked scripts. Users will continue to be able to sign in even if unsupported script injection tools no longer function, as this change is enabled by default as part of the service update and does not require tenant configuration. Microsoft Authentication Library (MSAL) and API-based authentication flows are not affected by this change, as CSP enforcement applies only to browser-based sign-in experiences using login. microsoftonline.

Migrating to Passkeys

In addition to the CSP changes, Microsoft is also urging Entra ID admins to migrate users to passkeys. This move aims to further enhance security by providing an additional layer of protection against script injection attacks.

Conclusion

Microsoft's new CSP defenses and the migration to passkeys are part of a broader effort to secure its services and products. By implementing these measures, Microsoft is taking proactive steps to protect its users and maintain the security of its services.

Related Initiatives

As part of the same Secure Future Initiative, Microsoft has also disabled all ActiveX controls in Windows versions of Microsoft 365 and Office 2024 apps, updated Microsoft 365 security defaults to block access to Office, SharePoint, and OneDrive files via legacy authentication protocols, and warned users about potential risks associated with carrier tracking.

Additional Resources

For more information on enhancing Entra ID security and other security measures, readers can explore the following resources:

Keywords

Comments