Blog Post

Microsoft Entra Blog
3 MIN READ

Enhance protection of Microsoft Entra ID authentication by blocking external script injection

AnkurPatel's avatar
AnkurPatel
Icon for Microsoft rankMicrosoft
Nov 25, 2025

Microsoft is further enhancing security of the Microsoft Entra ID authentication experience by blocking external script injection. [Action may be required]

As part of Microsoft’s Secure Future Initiative, we’re making an important update to our Content Security Policy (CSP) that will enhance the security of the Microsoft Entra ID sign-in experience. Thi...
Updated Nov 19, 2025
Version 1.0
end user
entra id
identity security
microsoft 365
GMulhern's avatar
GMulhern
Tin Contributor
Oct 05, 2026

Will this affect ChromeOS logins on Google tenants that have been federated to use EntraID for authentication? Google has, for a long time now, injected a script into the 3rd-party SAML login process that scrapes the IdP password for setting the local device password to match. When using non-password (FIDO key) login flows the user is prompted to set a device password immediately after successful IdP authentication. Will this new CSP change now make even the password login flows have that same bad experience, prompting the user to set a device password immediately after IdP login?

And that's actually the better of two possible outcomes. If ChromeOS is coded to halt the login process, if it cannot successfully inject its script into the login page, this will break 3rd-party authentication on Chromebooks. It's been awhile since I've inspected the ChromeOS https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/resources/gaia_auth_host/authenticator.js