Microsoft Entra ID: Retirement of custom CSS positioning properties in custom branding

🚨 The Signal: Microsoft Entra ID will retire custom CSS positioning in sign-in branding by October 2026. This enhances phishing resistance by preventing deceptive page layouts, aligning with Microsoft's Secure Future Initiative.

The Impact

Microsoft Entra administrators using custom CSS for branding are affected, reducing the risk of phishing attacks via manipulated sign-in pages.

• Entra ID administrators: Must review and update custom branding CSS.
• Users: Benefit from a more consistent and phishing-resistant sign-in experience.
• Security teams: Reduced risk of sign-in page manipulation attacks.

The Action

1. Identify if your Microsoft Entra ID custom branding uses CSS positioning properties.
2. Review existing custom CSS for sign-in pages in the Microsoft Entra admin center.
3. Plan to remove or refactor custom CSS positioning properties before October 2026.
4. Test updated branding configurations to ensure desired visual consistency without deprecated CSS.

Domain: Entra · Impact: medium · Workload: Entra ID · Essential Eight: Multi-Factor Authentication · ISM: ISM-0109, ISM-0123, ISM-0140, ISM-0974, ISM-1173, ISM-1228, ISM-1401, ISM-1504, ISM-1505, ISM-1679, ISM-1680, ISM-1681, ISM-1682, ISM-1683, ISM-1815, ISM-1819, ISM-1872, ISM-1873, ISM-1874, ISM-1892, ISM-1893, ISM-1894, ISM-1906, ISM-1907