Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection
🚨 The Signal: Microsoft Entra ID will block external script injection on sign-in pages by enforcing Content Security Policy (CSP). This enhances protection against cross-site scripting (XSS) by only allowing trusted Microsoft scripts, improving authentication security.
The Impact
Organizations using browser extensions or custom tools that inject scripts into Entra sign-in pages are affected, facing potential authentication failures.
- Users with browser extensions injecting scripts may experience sign-in issues.
- Admins using monitoring or customization tools injecting scripts will see them blocked.
- Security teams benefit from reduced XSS risk on Entra sign-in pages.
- Organizations relying on external script injection for branding may lose functionality.
The Action
- Identify all browser extensions, monitoring tools, or customization solutions that inject scripts into login.microsoftonline.com.
- Test authentication flows with identified tools in a non-production environment.
- Evaluate alternative, Microsoft-supported methods for necessary customizations or monitoring.
- Communicate potential changes to affected users regarding browser extension compatibility.
Domain: Entra · Impact: medium · Workload: Entra ID