Loading story…
Microsoft will enforce a stricter Content Security Policy (CSP) for browser-based Microsoft Entra ID authentication beginning in mid-October 2026 and completing the rollout by late October. Sign-in pages at login.microsoftonline.com will permit scripts only from trusted Microsoft CDN domains, blocking unauthorized external code injection and reducing exposure to cross-site scripting (XSS) and credential-theft attacks.
The protection is enabled by default and requires no tenant-side configuration. Organizations should inventory browser extensions, custom tooling, and other integrations that inject scripts into Entra ID sign-in pages, remove or replace incompatible components, and test authentication workflows before enforcement; Microsoft Authentication Library (MSAL) and API-based authentication flows are not affected.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft will begin enforcing stricter Content Security Policy protections on browser-based Entra ID sign-in pages, allowing scripts only from trusted Microsoft CDN domains to block unauthorized script injection and reduce XSS credential-theft risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has made **external multi-factor authentication (MFA)** generally available in **Microsoft Entra ID**, allowing organizations to integrate trusted third-party MFA providers directly into the identity platform while keeping **Conditional Access**, real-time risk evaluation, and session controls enforced centrally in Entra ID. The feature is built on **OpenID Connect (OIDC)** and lets administrators manage both native and external MFA methods through Entra ID’s authentication methods policy, including assigning them to specific user groups. Microsoft said the capability is aimed at enterprises with regulatory, business, or merger-related requirements that need a consistent MFA approach across fragmented environments. The company also said the new framework will replace Entra ID **Custom Controls**, which are scheduled for deprecation on **September 30, 2026**; existing configurations will continue to work during a migration period, and Microsoft plans to publish migration guidance before retirement. Microsoft warned that sign-in frequency and session settings should be tuned carefully, noting that excessive reauthentication can increase phishing risk.
Jun 29, 2026
Microsoft identity-related security enforcement is changing across both on-prem AD and cloud Entra environments, with potential authentication and access-control impacts if organizations have legacy configurations. In Windows Server 2025, **LDAP signing** is enabled by default on domain controllers via a new policy setting (`LDAP server signing requirements Enforcement`), while **LDAP channel binding** default behavior is unchanged; organizations are advised to audit before enforcing to avoid breaking LDAP-dependent applications and integrations. Separately, Microsoft Entra will change **Conditional Access** enforcement starting March 27, 2026 (phased through June 2026) for sign-ins via client apps requesting only **OIDC scopes** or a limited set of directory scopes when Conditional Access targets **All resources** and includes **resource exclusions**. After the change, Conditional Access will be enforced at sign-in even when exclusions exist, which may newly trigger controls such as **MFA** or device compliance for affected tenants; tenants without “All resources” policies that include exclusions are not impacted.
Jun 29, 2026
Microsoft has warned administrators to stop using SMS- and voice-based authentication in **Microsoft Entra ID**, saying the methods are too vulnerable to phishing, SIM-swapping, replay attacks, and increasingly effective AI-assisted social engineering. The company will begin prompting Entra users who still rely on phone-based verification to register a **passkey** starting September 1, with Microsoft positioning passkeys and **Microsoft Authenticator** as phishing-resistant, passwordless alternatives. Microsoft plans to permanently disable SMS and voice verification for all Entra ID accounts on February 1, 2027, with no tenant opt-out reported. The company is also moving to phase out text-based verification and account recovery for personal Microsoft accounts, though it has not announced a final consumer cutoff date. The shift is expected to force organizations to update onboarding and recovery processes, support users on older devices, and reduce the risk of account compromise tied to phone-based authentication.
Aug 15, 2026