Microsoft Entra ID rolled out two notable updates this week: a security-focused retirement of custom CSS positioning properties in branded sign-in pages, and the general availability of the Migration Policy Analyzer for organizations transitioning from Azure AD B2C to Microsoft Entra External ID. Both changes have actionable deadlines for IT administrators.
Entra ID Retires Custom CSS Positioning Properties in Branded Sign-ins
On July 21, 2026, Microsoft announced it is retiring custom CSS positioning properties in Microsoft Entra ID branded sign-in pages to strengthen phishing defenses and deliver more secure, trusted sign-in experiences.
Why This Matters
Custom CSS positioning properties can be exploited to create deceptive sign-in page layouts. A malicious or misconfigured brand configuration could move, hide, or overlay critical sign-in elements — username/password fields, tenant indicators, legal text — making it possible to build phishing-style pages that look trustworthy but mislead users. Properties like pointer-events, opacity, filter, and clip-path can create transparent or partially obscured interactive layers, enabling click-jacking scenarios within the Microsoft-hosted sign-in page itself.
By constraining what administrators can customize, Microsoft ensures that critical sign-in elements remain in trusted, predictable locations. This is part of a broader strategy to standardize the Entra sign-in experience and reduce opportunities for visual deception.
Retirement Timeline
| Date | What Happens |
|---|---|
| July 21, 2026 | Tenants NOT already using custom CSS positioning properties can no longer configure them going forward |
| October 26, 2026 | Custom CSS positioning properties retired globally for all tenants |
| Later in 2027 | Full retirement of all custom CSS planned (advance notice promised) |
New Entra ID tenants created after January 5, 2026, already do not have custom CSS available for company branding. Microsoft Entra External ID tenants are unaffected by this change.
Affected CSS Properties
The following properties will no longer be honored after October 26, 2026:
- position (including top, right, bottom, left, z-index)
- margin (including margin-top, margin-bottom, margin-left, margin-right)
- transform
- opacity
- overflow
- filter
- pointer-events
- clip-path
- mix-blend-mode
- translate
What Administrators Should Do
Check if your tenant is affected. Sign in with a Global Administrator or Branding Administrator account, navigate to Microsoft Graph Explorer, and retrieve your organization’s branding configuration to check for use of the affected properties.
Remove positioning properties. Remove all instances of the retired properties from Company Branding and Branding Themes CSS configurations. Microsoft has explicitly stated there is no supported migration path or replacement for these positioning behaviors.
Test the user experience. After removing CSS, test sign-in flows across web browsers, native client apps (Outlook, Teams), and different device types. Confirm that logos, background images, and text still display correctly in their default positions.
Plan for full CSS retirement in 2027. Minimize all custom CSS dependencies now. Use only supported, documented branding controls (logo, background image, text) that do not rely on arbitrary CSS. Update internal documentation, screenshots, and help desk training materials.
Impact on Branding
Branding elements such as logos, images, and text will remain visible after the retirement — they will simply appear in their default state once positioning properties are no longer honored. Organizations with heavily customized sign-in pages should plan for a transition to standard layout behavior.
This change aligns with other Entra security standardization efforts, including the retirement of Custom Controls in Conditional Access (replaced by External MFA) and the move toward passkeys as the default authentication method.
Migration Policy Analyzer for Azure AD B2C Now Generally Available
On July 20, 2026, Microsoft announced the general availability of the Migration Policy Analyzer, a tool that helps organizations plan their migration from Azure AD B2C to Microsoft Entra External ID by analyzing Identity Experience Framework (IEF) custom policies.
The Challenge
One of the first hurdles in planning a B2C-to-External ID migration is understanding what is actually implemented in the current tenant. Azure AD B2C deployments often grow organically over time to include custom user journeys, federation integrations, claims transformations, API connections, and tailored sign-up/sign-in experiences. As teams change and solutions evolve, assessing migration scope becomes time-consuming and complex.
What the Migration Policy Analyzer Does
The tool performs a deterministic analysis of custom policy definitions in the Identity Experience Framework and generates a structured assessment report. Each detected capability is categorized to help organizations evaluate migration complexity:
- Available: Capabilities that can be implemented using existing Microsoft Entra External ID functionality, including common sign-up/sign-in experiences, federation scenarios, verification workflows, and account recovery experiences.
- Requires Custom Development: Capabilities that may need extensibility mechanisms, API integrations, partner-developed solutions, or additional application logic.
- Architecture Change Recommended: Scenarios that may be better served by a different implementation pattern in Entra External ID.
- Not Currently Supported: Capabilities without a direct implementation path, requiring alternative approaches or future evaluation.
For example, a policy combining social identity federation, REST API claims enrichment, and a custom password reset flow might be categorized as “Available” for the federation and password reset experiences and “Requires Custom Development” for the REST API claims enrichment — giving teams an immediate sense of where effort will be concentrated.
How to Use It
- Open the Identity Experience Framework in your Azure AD B2C tenant
- Select a policy and click Analyze policy
- Review and download the generated migration assessment report
- Share the report across engineering, architecture, and business stakeholders
No policy modifications or additional configuration are required to run the analysis.
Strategic Value
The Migration Policy Analyzer helps teams move from discovery to an actionable plan:
- Estimate migration scope and effort with a categorized inventory
- Prioritize proof-of-concept activities based on complexity ratings
- Identify areas requiring redesign or custom development
- Build a phased migration strategy with shared understanding across stakeholders
This is particularly valuable for high-scale B2C tenants — generally those with 5 million or more objects — where manual policy review would be impractical. The tool complements the High Scale Compatibility (HSC) mode announced earlier this year, which enables B2C customers to transition applications to External ID without re-registering users or resetting passwords.
Key Takeaways
- Branded sign-in CSS retirement is a security measure — treat October 26, 2026 as the enforced cutoff for positioning CSS, and start designing for a future where sign-in branding uses configuration, not CSS hacks.
- Migration Policy Analyzer removes guesswork from B2C migrations — run it before starting any migration planning to get a data-driven assessment of scope and complexity.
- Both changes reflect Microsoft’s broader Entra strategy — standardize and secure identity experiences, reduce customization attack surfaces, and provide tooling for smooth platform transitions.
For ongoing Entra ID updates, follow https://x.com/kkaminsk on X and bookmark the Microsoft Entra What’s New page on Microsoft Learn.