Microsoft Is Blocking Every Third-Party Script from Its Entra Sign-In Page — and It Hits Mid-October
Photo: Forkast
Starting in mid-to-late October 2026, Microsoft will enforce Content Security Policy (CSP) on sign-in pages at login.microsoftonline.com. The global rollout , part of the Secure Future Initiative , blocks every script not originating from a trusted Microsoft domain. Browser extensions that inject JavaScript into the Entra sign-in page — password managers, accessibility overlays, session recorders, monitoring tools — will stop functioning once enforcement activates. CSP is a browser security header requiring an allow-list for scripts. Microsoft’s enforcement allow-lists only trusted script nonces and origins from Microsoft domains; everything else is blocked by default.
Source: Forkast
