Microsoft announced on July 21 that Microsoft Entra ID will stop honoring custom CSS positioning properties on branded sign-in pages beginning October 26, 2026. Full retirement of custom CSS is planned for later in 2027.
This sounds like a design change, but it is also an identity operations issue. A broken or unexpectedly rearranged sign-in page can trigger help-desk calls, confuse users, undermine carefully planned anti-phishing messaging, and make a legitimate login experience look suspicious.
Organizations using Entra company branding or branding themes should inventory their CSS now, remove affected properties, and test the supported layout before Microsoft enforces the change.
The timeline
- July 21, 2026: Entra ID tenants not already using the affected custom CSS positioning properties can no longer add them
- October 26, 2026: Microsoft begins retiring those properties globally; existing layouts that depend on them will change
- Later in 2027: Microsoft plans broader retirement of all custom CSS, with more notice and alternative customization guidance to come
Microsoft Entra External ID tenants are not affected by the October change described in the announcement.
Which properties are affected
Microsoft identifies the following properties for retirement:
- position, including top, right, bottom, left, and z-index
- margin, including its directional variations
- transform
- opacity
- overflow
- filter
- pointer-events
- clip-path
- mix-blend-mode
- translate
If a sign-in design relies on those rules to move, layer, hide, crop, or visually transform an element, expect it to render differently after October 26.
Why Microsoft is making the change
Microsoft ties the update to its Secure Future Initiative and phishing resistance. Restricting the ability to reposition or obscure elements reduces opportunities to create deceptive sign-in layouts and helps make Microsoft-hosted authentication experiences more consistent and recognizable.
That security goal is reasonable. It also means design teams must work within tighter layout boundaries. The safest response is not to fight for pixel-perfect recreation. It is to preserve the trust signals that matter:
- Accurate company name and logo
- Clear sign-in instructions
- Approved privacy and terms links
- Consistent colors and imagery within supported options
- A layout users can recognize across devices and languages
Who needs to take action
Your organization is likely affected if it:
- Uses custom CSS in Entra ID Company Branding
- Uses Branding Themes for application-specific sign-in experiences
- Asked an agency, identity consultant, or developer to build a highly customized login page
- Has multiple localized branding configurations that may contain different CSS
- Has not reviewed sign-in branding since an Azure AD-era implementation
Do not assume the absence of visible problems means there is no dependency. The current layout may be working precisely because a soon-to-be-retired property is active.
A practical remediation plan
1. Identify every branding configuration
Inventory default company branding, localized branding, and app-specific branding themes. Include production and test tenants. Record the owner, business purpose, supported languages, and affected applications.
2. Export and inspect the configuration
Microsoft’s announcement provides a Graph Explorer workflow to retrieve branding localizations, export the JSON, and inspect it for affected properties. Use an appropriately authorized Global Administrator or Organizational Branding Administrator account and retain the export for change evidence.
3. Remove retired properties in a test path
Delete the affected CSS rules and preview the resulting supported layout. There is no direct replacement for the positioning properties, so design around the controls Microsoft continues to support.
4. Test the complete sign-in journey
Test more than the first username screen:
- Desktop and mobile layouts
- Common browser sizes and zoom levels
- Primary languages and localized text
- Password, passkey, authenticator, and recovery flows
- Guest and external collaboration paths
- Application-specific branding themes
- Windows join or enrollment experiences that display branding text
5. Validate accessibility
Confirm contrast, focus order, keyboard navigation, zoom behavior, readable error text, alternative text, and responsive layout. Removing layout CSS can expose previously hidden accessibility defects.
6. Prepare support communication
If the sign-in page will look materially different, alert the help desk and users before the change. Provide one approved screenshot and a short anti-phishing reminder: verify the domain, use bookmarks or company portals, and report unexpected prompts.
7. Finish before October
Do not schedule the production change for October 25. Complete remediation early enough to observe real sign-ins, resolve localization issues, and update training material.
What happens if you do nothing
Microsoft says logos, images, and text should generally remain visible, but elements may return to default placement or appearance when the CSS is ignored. Likely outcomes include:
- Logo or message placement changes
- Background treatments render differently
- Previously hidden or cropped elements reappear
- Text overlaps or spacing becomes awkward
- Localized layouts behave inconsistently
The sign-in service should continue to authenticate users. The risk is trust, clarity, and support disruption rather than a planned outage.
Use this moment to improve sign-in trust
While the page is open for review, tighten the surrounding identity experience:
- Remove sensitive help-desk or internal information from public sign-in text
- Make the company name and support path unambiguous
- Verify privacy and terms links
- Align sign-in guidance with passkeys and phishing-resistant MFA
- Remove old acquisition, rebrand, or legacy Azure AD references
- Document who owns future branding changes
Frequently Asked Questions
When do the affected properties stop working? Microsoft says beginning October 26, 2026.
Will our logo disappear? Microsoft says branding elements generally remain but may return to default placement or appearance.
Is all custom CSS ending in October? No. Microsoft plans broader custom CSS retirement later in 2027.
Is Entra External ID affected? Not by the October change described in Microsoft’s announcement.
Is there a supported replacement for these positioning properties? Microsoft says there is no supported migration or replacement. Remove the properties and test the supported layout.
Need to test and modernize your Entra sign-in experience?
We can inventory branding configurations, identify affected CSS, validate supported layouts, and align the result with phishing-resistant identity guidance.
Book a Free Consultation