Microsoft has reminded customers that the Entra ID identity and access management (IAM) solution will get better protection against external script injection attacks starting next month.
The company first revealed plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement.
According to a Monday message center update seen by BleepingComputer, Microsoft will begin enforcing additional Content Security Policy (CSP) defenses that will only allow scripts from trusted Microsoft content delivery network (CDN) domains during Entra ID sign-ins.
The rollout should end by late October 2026, after which all users will be protected from various sign-in security risks, including cross-site scripting attacks in which malicious code is injected into websites to steal credentials.
"Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026," the company said. "This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code."
Microsoft advised enterprise customers to stop using browser extensions and tools that inject code or scripts into sign-in pages before the new CSP changes take effect.
It also urged them to test sign-in scenarios before the next month's deadline to identify and address any dependency issues on code-injection tools. IT administrators can identify potential impact by reviewing sign-in flows in the browser developer console and looking for violations that appear in red text with details about the blocked scripts.