The 49 properties Entra is retiring from your login page are not about design

On 26 October Microsoft stops honouring a list of CSS properties on the page where your people type their password. There are 49 entries spread across two separate notices, and among them are position, z-index, opacity, visibility, clip-path and pointer-events: a good part of what it takes for a page to show one thing and collect the click on another. A feature some companies paid a designer for is being taken away, and we think that is right. What deserves discussion is who had permission to use it.

Three notices, two changes

This is the first thing to sort out, because the arithmetic does not work if you look it up in one place. The CSS retirement arrived in two message-centre notices a month apart: the second one extends the first one's list. The third notice is a different matter that shares the calendar by coincidence. Nor are the people who have to act the same.

Three exclusions worth having to hand before somebody raises a ticket about the wrong thing. The content security policy applies to the browser-based sign-in experience: MSAL and API-based flows are out of scope, so if your application authenticates without painting a page, this does not touch it. Microsoft Entra External ID tenants are not affected either, and the documentation says so in both places. And the 26 October in the table is the date from which whatever you have configured stops working, not the day sign-in gets switched off: people will keep getting in.

A detail that matters if you are going to look this up yourself: the 49 properties are not in a single notice. MC1435782 carries the narrow set — position, margin, transform, opacity, overflow, filter, pointer-events, clip-path, mix-blend-mode, translate — and the rest, which is more than half of them, arrives a month later with MC1458474. Anyone opening the message centre looking for the full list under the first notice will not find it. The only place it sits complete and current is the documentation reference guide, and that is the one to cite in the internal ticket.

The list of 49, read slowly

Microsoft's documentation publishes the full list. It has 49 entries, and two of them carry nine more — position includes top, right, bottom, left and z-index; margin includes its four sides — so it comes to 58 property names. Grouped by what they do, five families come out:

• Hide: display, visibility, opacity, content-visibility, clip, clip-path, mask and its variants, overflow and its four axis variants.
• Overlay: position with z-index, isolation, mix-blend-mode, inset.
• Move and resize: transform with its four vendor prefixes, translate, scale, rotate, perspective, zoom, offset, the logical margins and the whole grid (grid-area, grid-column, grid-row, order).
• Decide where the click lands: pointer-events. Just the one, and the only entry on the list whose effect is not visual.
• Just decoration: filter, which is blur(), grayscale() or drop-shadow(). It is on the list too, and with this one there is no second reading available.

Microsoft does not hide it. Its own documentation says these properties "control where elements appear on the sign-in page and how they're layered, sized, and displayed", and that "for example, they can move, overlap, resize, or hide page content". And it states the reason in full: "To align with the Microsoft Secure Future Initiative and its focus on identity security and phishing resistance, Microsoft Entra ID is retiring support for custom CSS layout and positioning properties." The effect it is after is a layout that stays "consistent and predictable".

Move, overlap, resize, hide. Lined up, those four verbs are the repertoire of UI redressing: the technique by which a page shows one button and collects the click somewhere else, or covers the real domain with a label of its own. pointer-events fits in there naturally, because its effect is not visual; the only thing it decides is whether the click lands on what you see or on what sits underneath. That reading is ours, not a Microsoft claim.

Worth not stretching it further than it goes. Of the 58 names, eleven are margin and its variants and eight are grid; add order, perspective, zoom and filter itself and close to 40% of the list is ordinary layout, the kind anyone uses to centre a box. Nobody is building a deception out of margin-inline-start. What holds the reading up is the other part: with position, z-index, opacity, visibility, clip-path, mix-blend-mode and pointer-events in the same stylesheet you can build a screen that shows one thing and does another, and that is no longer a hypothesis: it is the example the documentation itself gives when it says they can hide and overlay content.

"But I am the one who puts the CSS there"

Whoever says this is right about nearly everything. Branding CSS is not uploaded by just anyone from outside: it takes signing into the tenant with permissions. An attacker on the internet cannot redecorate your login page. To get there they would already have to be inside, and if they are inside with those permissions you have a bigger problem than the one we are discussing.

And this is where the documentation itself presses. To review or change the branding configuration, Microsoft says, "you need a Global Administrator or Branding Administrator account". Go and look that second role up in the official Entra roles reference and you will find Organizational Branding Administrator, with this one-line description: "Manage all aspects of organizational branding in a tenant." Template ID 92ed04bf-c94a-4b82-9729-b799a7a4c178. And, in that same table, it does not carry the privileged-role label.

That role sounds like marketing. It gets handed out the way access to the corporate website CMS gets handed out: to whoever owns the company image, to the agency of the moment, to the intern holding the brand manual. And it is the permission that decides exactly what each employee sees at the instant they type their password. We know of no public case of this role being abused and we are not going to invent one; what we are pointing at is the shape of the permission. Role inventories are usually built by asking what data each role can read or change, and that question leaves out a whole category: what it can change about what the user sees.

The third notice: what runs on that page

This one is already under way as you read. The rollout started in mid-October and Microsoft expects it to complete before the month is out, so login.microsoftonline.com may already be running Microsoft-hosted scripts only in your tenant. What breaks, per the notice, is "browser extensions and tools that inject scripts" into that page: session recorders, accessibility overlays, user-experience monitors, homegrown automation. Microsoft does not publish the list of what stops working, so the only honest answer to "does this affect me?" is to test it today.

Turn the sentence around and the uncomfortable part is left. If a tool of yours injects code into that page, what has been happening until today is that third-party code was executing on the screen where your company's passwords are typed. The policy is telling you what you had. And the failure, when it comes, will arrive as "the password manager stopped filling in" on a Tuesday morning, and somebody will blame the password manager. Writing the cause into the incident log today is worth more than any communication plan.

The six checks you can answer this afternoon

The first thing is to pull the tenant's actual branding configuration, rather than looking at the admin screen and trusting it. With an account that has the permissions, in Microsoft Graph Explorer:

GET https://graph.microsoft.com/v1.0/organization
GET https://graph.microsoft.com/v1.0/organization/<tenant-id>/branding/localizations

1. Export every localization, not just the default one. That is the trap in this change: branding is configured per language, and the retired property may live only in the Catalan or the English variant while the Spanish one is clean. The call above returns them all at once; the admin screen does not.
2. Look for the 49 in that JSON. Microsoft links a branding inspector you can paste it into so it lists the retired properties per locale. A note of our own: that inspector is hosted on GitHub Pages, outside Microsoft's domain. Your branding CSS is not a secret, but pasting your tenant configuration into a third-party web page is a decision, not a formality; if you would rather not make it, a grep for the list's property names over the downloaded JSON answers the same question.
3. Remove, do not migrate. The documentation is explicit: "these properties don't have a supported migration or replacement." There is no equivalent to put in their place. What you can do is redesign without them.
4. Validate in a test tenant before touching production. Microsoft recommends it and we sign it: a broken sign-in page at nine in the morning is an availability incident, not an aesthetic detail.
5. List who holds Branding Administrator and Global Administrator today. By name, including agency accounts and former suppliers. If somebody on that list no longer does the job they were doing when the role was granted, there is your first task.
6. Inventory whatever injects scripts into sign-in and test it with a real user: policy-deployed extensions, accessibility overlays, experience monitoring. Whatever breaks, breaks this month, not in January.

If your tenant is new, this is already none of your business

Two earlier dates explain where all of this is heading. Tenants created after 5 January 2026 have no custom CSS at all. And since 21 July 2026, older tenants that were not already using it can no longer configure it. In other words: the feature has been shut to new tenants for months, and is now being trimmed back for those who had it. The documentation says it plainly: this change "is the first step toward retiring the custom CSS feature entirely".

The cost is real and it has to be stated. If your company sold internally that the sign-in screen "has our face on it", this is a regression you did not choose, it arrives with three months' notice and it brings no alternative to offer. It is also the second Entra retirement of the quarter: we already wrote that Entra already retired SMS as a second factor on a calendar of its own. Thinking the change is right and finding it annoying sit together perfectly well; that is what happens when the vendor fixes a risk you had not counted and bills you for it in work.

Where this fits in what we do

Least privilege usually gets applied to people and to applications. The identity provider's role catalogue is reviewed far less, and that is where the surprises live: this branding role, and also the ones that were already in place before you arrived — we already saw that your tenant has conditional access policies you did not write. That is what we work on as Zero Trust, and it looks more like a list of who can do what and why they still can than like buying a product. Governance of the Microsoft 365 tenant — what ships switched on, which roles exist and who holds them — comes in the same bundle.

If you want us to pull your tenant's branding localizations with you before Monday and go through who holds each admin role today, let us talk. It is two queries and a table; if it comes back clean, we say so and there is no project.

Sources. The dates, scope and verbatim quotations for both changes come from the Microsoft 365 message centre notices: MC1435782 ("Microsoft Entra ID: Retirement of custom CSS positioning properties in custom branding", published 21 July 2026 and updated on the 31st; retirement from October 2026, expected to complete by late November, with the affected properties no longer honored from 26 October 2026), MC1458474 ("Microsoft Entra ID: Retirement of custom CSS layout and positioning properties in company branding", published 21 August 2026, extending the earlier list — "since the previous update in MC1435782, we are retiring an additional set of properties" — with an act-by date of 26 October 2026 and global retirement in late October 2026) and MC1481309 ("Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection", published 28 September 2026; rollout mid-October to late October 2026). The full list of 49 entries — which appears complete in neither notice, but split across both — the quotations about what the properties do, the stated reason, the absence of migration or replacement, the 5 January and 21 July 2026 dates, the sentence about retiring the feature entirely, the fact that Microsoft Entra External ID tenants are not affected, the Global Administrator or Branding Administrator account requirement and the two Microsoft Graph calls are in Microsoft Learn's company branding CSS reference guide, and the stated reason points to the Entra team announcement. The description of the Organizational Branding Administrator role, its template ID and the fact that it is not flagged as a privileged role are in the Microsoft Entra built-in roles reference. The count of 49 entries and 58 property names, the grouping into five families, reading four of them as the UI-redressing repertoire — with the caveat, also ours, that close to 40% of the list is ordinary layout with no second reading — the observation about pointer-events, the warning about per-language localizations, the note about the inspector hosted outside Microsoft's domain and the thesis about the branding role are our own judgement, not Microsoft claims. We know of no public case of the branding role being abused and we do not claim there is one. everyWAN provides managed identity and security services on Microsoft 365: the conflict of interest is declared, and we are not a Microsoft licence reseller. Cover photo: "Fukuoka Daimyō Garden City Tower the turnstiles on the 3rd floor", by Hirho, Wikimedia Commons, CC BY-SA 4.0.