Microsoft Removes Entra ID Custom CSS Layout Options to Fight Phishing

Microsoft is retiring custom CSS layout and positioning properties in Microsoft Entra ID company branding today, October 26, 2026, as part of its Secure Future Initiative (SFI).

According to Microsoft 365 Message Center advisory MC1458474, the change aims to reduce phishing risks by preventing organizations from creating potentially misleading sign-in page layouts.

The retirement only affects organizations that were using custom CSS before July 21, 2026. Existing branding elements will remain available, although some may appear differently under Microsoft’s default layout.

Microsoft Entra ID Removes Custom CSS Layout Options

Microsoft is removing custom CSS layout and positioning properties from Entra ID company branding to strengthen sign-in security.

The company wants to prevent organizations from modifying sign-in page layouts in ways that could create deceptive experiences or facilitate phishing attacks.

Organizations can continue using their existing branding elements, but Microsoft’s default layout and positioning rules will determine how those elements appear.

As a result, sign-in pages that rely on retired CSS properties may look different starting October 26.

Organizations that were not using custom CSS before July 21, 2026, will not experience changes from this retirement.

What Microsoft Entra ID Administrators Need to Do

Microsoft previously advised administrators to review their company branding configurations ahead of the October 26 deadline.

Administrators should check their custom CSS settings, test sign-in pages to make sure branding looks correct, and inform support teams about any changes users might notice.

The retirement does not remove company branding from Microsoft Entra ID. It only restricts the custom layout and positioning properties that could affect the security of sign-in experiences.

In other news, Microsoft Entra ID introduces telephony providers ahead of the 2027 SMS retirement. Microsoft is also preparing to block injected scripts on Entra ID sign-in pages as part of its broader security improvements.

Via Neowin