Microsoft Entra ID branded sign-in security changes

Introduction

Microsoft is updating Microsoft Entra ID custom branding to make branded sign-in pages more secure, consistent, and resistant to phishing. For IT teams that rely on customized sign-in experiences, this change matters because unsupported CSS positioning properties will stop working in 2026, with broader custom CSS retirement planned for 2027.

What’s changing

Microsoft announced a phased retirement of custom CSS used in Entra ID branded sign-ins:

• July 21, 2026: Tenants not already using custom CSS positioning properties can no longer configure them.
• October 26, 2026: Custom CSS positioning properties will be retired globally.
• Later in 2027: Microsoft plans to retire all custom CSS, with advance notice and alternative customization options.

The change is designed to reduce the risk of deceptive sign-in page layouts and improve trusted, recognizable authentication experiences.

Affected CSS properties

Organizations should review branding configurations for these deprecated properties:

• position
• top, right, bottom, left, z-index
• margin, margin-top, margin-bottom, margin-left, margin-right
• transform
• opacity
• overflow
• filter
• pointer-events
• clip-path
• mix-blend-mode
• translate

After October 26, 2026, these properties will be blocked and no longer function.

Impact on administrators

If your tenant currently uses these CSS properties in Company Branding or Branding Themes, your sign-in page layout may change once the properties are retired. In most cases, logos, text, and images will still appear, but they will fall back to default placement.

Not all tenants are affected:

• Affected: Existing Entra ID tenants already using the deprecated positioning properties
• Not affected: Tenants not using those properties, new tenants created after January 5, 2026, and Microsoft Entra External ID tenants

What admins should do now

Microsoft recommends reviewing your branding configuration as soon as possible.

1. Sign in with a Global Administrator or Branding Administrator role.
2. Use Microsoft Graph Explorer to query your organization and branding localizations.
3. Export or copy the branding localization JSON.
4. Run the JSON through Microsoft’s provided detection tool to identify impacted locales and properties.
5. Remove deprecated CSS properties before October 26, 2026.

Next steps

Admins should test branded sign-in pages early and remove unsupported CSS before enforcement begins. This will help avoid unexpected layout issues and support Microsoft’s broader move toward more secure, phishing-resistant authentication experiences.