Microsoft to block Entra ID script injection attacks starting October

Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month.

The company first revealed plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement.

According to a Monday message center update seen by BleepingComputer, Microsoft will begin enforcing additional Content Security Policy (CSP) defenses that will only allow scripts from trusted Microsoft content delivery network (CDN) domains during Entra ID sign-ins.

The rollout should end by late October 2026, after which all users will be protected from various sign-in security risks, including cross-site scripting attacks in which malicious code is injected into websites to steal credentials.

"Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026," the company said. "This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code."