Microsoft Entra ID to enforce CSP, blocking sign-in script injection
From mid-October 2026, Entra ID enforces a Content Security Policy on login.microsoftonline.com, allowing only Microsoft-trusted scripts. Extensions and tools that inject code into sign-in will break.