Entra ID News & Updates

Microsoft Entra ID Sign-In CSP Blocks Script Injection

Microsoft will enforce a stricter Content Security Policy on the Entra ID sign-in page at login.microsoftonline.com by mid-to-late October 2026, limiting script downloads to trusted Microsoft CDNs and allowing inline scripts only through Microsoft-controlled nonce-based patterns. This matters because it hardens one of the most targeted parts of the authentication flow against script injection attacks, though organizations using browser extensions or custom tools that interact with the sign-in page may need to review compatibility before rollout.

3 min read · Nov 25, 2025

Entra ID

Microsoft Entra Agent ID and AI Access Security Updates

Microsoft is expanding the public preview of Entra Agent ID to give AI agents managed identities, lifecycle governance, and security controls similar to those used for employees, including access packages, Conditional Access, and threat-based protections. The update matters because it helps organizations adopt AI agents at scale without losing visibility or control, reducing risks like unmanaged identities, excessive permissions, and data exfiltration under a Zero Trust model.

3 min read · Nov 19, 2025