SecurityBleepingComputerabout 2 hours ago
Microsoft to Block Entra ID Script Injection
3 min read
Microsoft will enforce a Content Security Policy for Entra ID sign-ins starting mid-October 2026, allowing only trusted Microsoft CDN scripts. The rollout ends late October 2026, blocking cross-site scripting attacks that steal credentials. Enterprise customers must stop using code-injecting browser extensions and test sign-in flows before the deadline. The change is enabled by default and requires no tenant configuration.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyMicrosoft