CERT24Microsoft to strengthen Entra ID protection against external script injection attacks starting in OctoberLoading data…
CERT24Threat Observatory
Period

Microsoft to strengthen Entra ID protection against external script injection attacks starting in October

Microsoft will begin enforcing additional Content Security Policy (CSP) protections for Entra ID sign-ins in October 2026. The controls will allow scripts only from trusted Microsoft CDN domains and block unauthorized or externally injected code.

← Back to intelligence

Microsoft to strengthen Entra ID protection against external script injection attacks starting in October

Microsoft will begin enforcing additional Content Security Policy (CSP) protections for Entra ID sign-ins in October 2026. The controls will allow scripts only from trusted Microsoft CDN domains and block unauthorized or externally injected code.