Microsoft will upgrade the Entra ID authentication system in October 2026 to prevent external script injection attacks. The update will enforce a stricter Content Security Policy, allowing scripts only from trusted Microsoft domains, thus enhancing protection against cross-site scripting threats. Organizations should prepare by reviewing sign-in flows and discontinuing unsupported code-injection tools.

Widespread account lockouts among Microsoft Entra ID users were triggered by a false positive issue during the rollout of the MACE Credential Revocation app, which mistakenly flagged unique user credentials as leaked. Many admins reported that locked accounts showed no signs of compromise, leading to confusion and concern within organizations. Microsoft acknowledged the problem but has not yet provided a public response.