Microsoft to Block External Scripts  in Entra ID Logins to Enhance Protections

Microsoft announced, as part of its Secure Future Initiative, that starting mid-to-late October 2026 it will enforce a stricter Content Security Policy on login.microsoftonline.com to block all non-Microsoft scripts during browser-based sign-ins, mitigating cross-site scripting (XSS) risks; organizations should discontinue extensions or tools that inject code into the Entra ID sign-in page, test sign-in flows ahead of enforcement, and check browser console errors, noting that External ID is unaffected.