4 October 2026
Entra Sign-In CSP Starts Mid-October — Test Injected Scripts This Week
Microsoft will enforce Content Security Policy on login.microsoftonline.com from mid-to-late October 2026, blocking external script injection. Here’s what New Zealand mid-market and public-sector tenants should check before rollout.
Microsoft is tightening the Microsoft Entra ID browser sign-in page. From mid-October 2026, with rollout expected to finish by late October, Entra will enforce a Content Security Policy (CSP) on login.microsoftonline.com so only scripts from trusted Microsoft content delivery network domains can run. Inline scripts that are not Microsoft-authorised will be blocked too.
The change is part of Microsoft’s Secure Future Initiative. Message Center item MC1191924 described it earlier; Microsoft reminded tenants again around late September 2026, and BleepingComputer covered the reminder on 30 September. There is nothing to turn on in the tenant. When the service update lands, CSP is on by default.
Users can still sign in if a browser extension or third-party tool stops injecting into the page. What breaks is the injection itself — monitoring overlays, customisation helpers, or any kit that relied on running its own script inside the Entra sign-in experience.
Why NZ organisations should care
Most New Zealand mid-market and public-sector Microsoft 365 tenants put staff through browser sign-in at login.microsoftonline.com every day: interactive MFA, password reset hand-offs, and “open this admin portal” flows. CSP does not change your Conditional Access policies. It changes what the browser is allowed to execute on that Microsoft-hosted page.
That matters if anyone in your estate — security tooling, a managed service provider, or an overly helpful browser extension — injects code into the sign-in page to monitor, brand, or automate steps. Microsoft’s own analysis says most CSP violations come from external extensions and third-party injected scripts. After mid-October those scripts will fail closed in the browser console, even though the user still gets a token.
Under the Privacy Act 2020, if you hold personal information in a Microsoft tenant you need reasonable safeguards around how people authenticate. Blocking untrusted script on the sign-in page is a Microsoft-side hardening step in that direction. Your job is to make sure legitimate operational tools do not depend on the old, weaker host behaviour — and that nobody is still running a shady injector that was never a good idea.
MSAL and API-based authentication are not affected. Microsoft Entra External ID tenants that sign in on custom or CIAM domains are not affected. This is specifically the workforce Entra browser experience on login.microsoftonline.com.
What to do this week
- Inventory injectors. Ask security, helpdesk, and any MSP whether they use browser extensions, SOAR helpers, or sign-in customisation tools that inject JavaScript into Entra sign-in. If the answer is “we are not sure,” treat that as a yes until proven otherwise.
- Test with the developer console. Walk a normal staff sign-in and an admin sign-in with the browser console open. Look for CSP violations in red — blocked script sources or inline script. Microsoft’s CSP preparation guidance is the official checklist.
- Retire or replace non-compliant tools before mid-October. Prefer vendors that do not inject into
login.microsoftonline.com. Do not invent a tenant CSP toggle — there is none for this service update. - Do not panic about MSAL apps. Native and MSAL/API token flows talk to the STS without that browser page CSP. Focus effort on human browser sign-in and any tooling wrapped around it.
- Keep the lasting controls. CSP is defence in depth on the host page. It does not replace phishing-resistant MFA, Conditional Access, or least-privilege admin. Use the Conditional Access starter checklist and the Microsoft Secure Score Quick-Start Checklist for the backlog that still matters after October.
What this is not
It is not a customer-applied patch, not an Entra Connect version deadline, and not a reason to freeze all sign-in change. It is a Microsoft-hosted browser hardening with a short clock. Most tenants that never injected into the sign-in page will notice nothing. Tenants that did should finish testing before mid-October 2026.
Sources: Microsoft Learn — Content Security Policy (CSP) rollout in Microsoft Entra ID, MC1191924 — Enhance protection by blocking external script injection, BleepingComputer — Microsoft to block Entra ID script injection attacks starting October (30 Sep 2026).