Microsoft Is Blocking Every Third-Party Script from Its Entra Sign-In Page — and It Hits Mid-October

Starting in mid-to-late October 2026, Microsoft will enforce Content Security Policy (CSP) on sign-in pages at login.microsoftonline.com. The global rollout , part of the Secure Future Initiative , blocks every script not originating from a trusted Microsoft domain. Browser extensions that inject JavaScript into the Entra sign-in page — password managers, accessibility overlays, session recorders, monitoring tools — will stop functioning once enforcement activates. CSP is a browser security header requiring an allow-list for scripts. Microsoft’s enforcement allow-lists only trusted script nonces and origins from Microsoft domains; everything else is blocked by default. The risks it mitigates are straightforward: cross-site scripting (XSS) , session hijacking, credential theft, and token compromise.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.