Microsoft Is Retiring Entra ID CSS Properties in October 2026

Microsoft is retiring several Entra ID CSS properties used to customize branded sign-in pages, giving IT administrators until October 26, 2026, to update affected configurations.

The company announced the change in Microsoft 365 Message Center advisory MC1485474. Organizations that do not use the affected CSS properties do not need to make any changes.

Microsoft says the restrictions will improve Entra ID security and make it harder for attackers to reproduce legitimate branded login pages in phishing campaigns.

Entra ID CSS properties will start disappearing in October

Microsoft plans to begin retiring the affected custom CSS properties in October 2026.

Administrators who rely on them should update their Entra ID branding before October 26, 2026. The change does not necessarily mean that existing logos, text, images, or other branding elements will disappear.

Instead, elements that depend on unsupported CSS properties may return to their default positions or styling once Microsoft removes support.

This means a company login page could continue working while looking different from the configuration administrators originally created.

Microsoft is removing several layout and positioning properties

The first stage of the Entra ID CSS retirement focuses heavily on properties that control positioning, margins, grids, visibility, clipping, and masking.

Microsoft plans to remove support for the following properties:

• offset, offset-path, offset-distance
• margin-block, margin-block-start, margin-block-end
• margin-inline, margin-inline-start, margin-inline-end
• order
• grid-area
• grid-column, grid-column-start, grid-column-end
• grid-row, grid-row-start, grid-row-end
• isolation
• overflow-x, overflow-y, overflow-block, overflow-inline
• content-visibility
• clip
• mask, mask-image
• -webkit-mask, -webkit-mask-image

Organizations using Entra ID custom branding should check their existing CSS files for these properties before the October deadline.

Microsoft says the change will reduce phishing risks

Microsoft says it is making the change as part of its Secure Future Initiative, with the goal of strengthening Entra ID security and reducing phishing risks.

According to the company, attackers have abused custom layout and positioning options to build convincing copies of branded authentication pages.

Restricting how organizations can move, hide, mask, or position sign-in page elements should make those techniques harder to reproduce.

The change continues Microsoft’s broader effort to tighten Entra ID authentication security.

The company recently fixed a maximum severity Entra ID security flaw. Microsoft also plans to make passkeys the default authentication method in Entra and has warned customers about the upcoming SMS authentication retirement.

Microsoft plans to retire custom CSS completely

The October change represents only the first stage of Microsoft’s Entra ID custom CSS deprecation.

Microsoft plans to retire custom CSS entirely by late 2027, which means organizations that rely heavily on customized Entra ID sign-in experiences will eventually need to move away from CSS-based branding.

The company says it will provide customers with additional notice before the complete retirement takes effect.

What Entra ID administrators should do before October 26

IT administrators should review their current Entra ID branding configurations now rather than waiting for Microsoft to remove the properties.

Admins should:

• Download and back up the organization’s current custom CSS file.
• Check the file for any CSS properties included in Microsoft’s retirement list.
• Replace unsupported properties with available alternatives.
• Update configurations before October 26, 2026.
• Test branded Entra ID sign-in pages after making changes.
• Inform users and other stakeholders if the updated branding causes noticeable visual changes.

Organizations that do not use any of the affected CSS properties can continue using their existing configurations without taking action at this stage.

Via Neowin