Microsoft Entra ID: Retirement of custom CSS layout and positioning properties in company branding

🚨 The Signal: Microsoft Entra ID will retire custom CSS layout and positioning properties for company branding by October 2026. This enhances security by preventing phishing attempts that manipulate sign-in page appearance, aligning with the Secure Future Initiative.

The Impact

Organizations using custom CSS for Entra ID branding are affected, reducing phishing risk by standardizing sign-in page layouts.

  • Security Teams: Reduced phishing risk from manipulated sign-in pages.
  • Admins: Must review and update custom branding CSS configurations.
  • Users: Experience more consistent and secure sign-in pages, reducing deception risk.

The Action

  1. Identify if your organization uses custom CSS layout/positioning in Entra ID company branding.
  2. Review existing custom CSS configurations for affected properties (layout, positioning).
  3. Plan to remove or refactor custom CSS properties that control layout and positioning by October 2026.
  4. Test updated branding configurations to ensure desired appearance without deprecated CSS.
  5. Communicate changes to users regarding potential minor visual adjustments to sign-in pages.

Domain: Entra · Impact: medium · Workload: Entra ID · Essential Eight: Multi-Factor Authentication · ISM: ISM-0109, ISM-0123, ISM-0140, ISM-0974, ISM-1173, ISM-1228, ISM-1401, ISM-1504, ISM-1505, ISM-1679, ISM-1680, ISM-1681, ISM-1682, ISM-1683, ISM-1815, ISM-1819, ISM-1872, ISM-1873, ISM-1874, ISM-1892, ISM-1893, ISM-1894, ISM-1906, ISM-1907