Microsoft to block Entra ID script injection attacks starting October
-
Microsoft is introducing stronger protections for Entra ID against external script injection attacks, with enforcement beginning in October.
The change is designed to prevent malicious scripts from being injected into authentication flows, which attackers could abuse to manipulate how sign-in pages behave or to harvest credentials. Administrators should review their tenant configuration ahead of the rollout, since custom branding and script-dependent customizations are the most likely areas to be affected.
Key points to be aware of:
- Enforcement starts in October
- The protection targets external script injection in Entra ID authentication
- Organizations using custom scripts or third-party customizations in sign-in experiences should validate them before the change takes effect
- Testing in a staging or pilot tenant before October is recommended to avoid unexpected sign-in disruptions
If your environment relies on injected scripts for branding or authentication page customization, now is the time to audit those dependencies and confirm they still function under the new restrictions.
Source: BleepingComputer
Does your organization use custom scripts in Entra ID sign-in flows, and if so, have you already tested them against this upcoming change?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login