On 2026-09-01, Microsoft made passkeys the default authentication method for Entra ID tenants. Roughly six weeks later, inside a window spanning mid-to-late October, the company will enforce a Content Security Policy on login.microsoftonline.com that blocks every script not carrying a server-issued nonce or matching an origin allow-list. No opt-out. No per-tenant exception. One URL, global, single switch.
That URL is the front door for the majority of enterprise identity on the planet. Whatever happens there propagates outward.
I have watched this exact architectural maneuver before, on a different stack. In 2021 I spent three weeks pulling transaction hashes for a wash-trading cluster operating across fifteen wallets in the BAYC and CryptoPunks markets. The structure was identical to what Microsoft is doing now, inverted: a small set of actors controlled the surface everyone else depended on, and the surface had no enforcement layer. When I published the forensic breakdown, the useful part was not the accusation. It was the transaction graph showing exactly where trust was being assumed and never verified.
CSP is Microsoft installing the enforcement layer. The question for anyone who builds on injected scripts โ including every browser wallet in crypto โ is whether they get a nonce or get blocked.
Context: what actually changed
Content Security Policy is not new. The specification has existed since 2012, and it exists for one reason: to make the browser refuse to execute code the origin did not authorize. The mechanism is mechanical. The server attaches a nonce to each response, includes it in the script-src directive, and any script tag lacking that exact nonce is dropped. Alternatively, an allow-list enumerates permitted origins. Microsoft is deploying both, defaulting to block.
The scope is narrow by design. Only the browser-facing login page at login.microsoftonline.com is affected. Microsoft Authentication Library flows, the Entra security token service API, and all non-browser authentication paths are explicitly exempt. External ID and CIAM custom domains retain their existing flexibility. That last detail matters: it is evidence of tenant-tiered policy governance, not a blanket wall.
The three categories that break are the ones that reach into the DOM. Password managers that fill credentials by injecting content scripts. Session recorders that capture field-level keystrokes for compliance archives. Accessibility overlays that rewrite contrast, spacing, and focus behavior for users who cannot read the default rendering.
Microsoft frames the whole thing under the Secure Future Initiative, the internal program it stood up after the Storm-0558 token-forging incident in 2023, when a stolen signing key let an actor mint tokens for enterprise mailboxes. Read the sequence plainly: signing-key compromise in 2023, passkey-by-default in September 2026, CSP enforcement six weeks later. That is not a product roadmap. That is a trust-repair program with a delivery schedule.
Based on my audit experience, trust-repair programs share a predictable failure mode: they are scheduled by the party holding the signing keys and resourced by the party holding the integrations. In 2017 I spent six weeks manually auditing Ethereum Classic's block reward distribution logic after the 51% attack, and the finding that mattered was not the exploit itself โ it was a rounding flaw in the reward split that would have compounded instability for months after remediation. Nobody had scheduled time to look at it. Security programs get funded at the perimeter and starved at the seams. The seam here is the third-party extension layer, and it is being closed on six weeks' notice.
Core: the nonce is the whole story
Here is the part almost nobody is pricing correctly.
A nonce-based policy is not a symmetric technical rule. It is a delegation of authority. Microsoft's own scripts get nonces because Microsoft's server issues them. Third-party scripts do not, because Microsoft's server does not issue them to third parties. The policy is neutral in syntax and asymmetric in effect. Any architecture where one party writes the allow-list and everyone else applies to be on it is a governance structure wearing a security costume.
That asymmetry is not inherently malicious. Default-deny is the correct posture for a credential entry page. But the second-order consequence is that the platform now owns the definition of trusted script, with no stated appeals process and no opt-out path. In platform terms, that is rule-making without rule-review.
The migration cost is real and it is not Microsoft's. It lands on the vendors. Password managers must abandon content-script injection and rebuild on the Credential Management API, WebAuthn, and passkey primitives. Session recorders must move off DOM-level capture toward network and endpoint telemetry. Accessibility vendors must argue that their overlays are load-bearing rather than cosmetic โ and Microsoft must be prepared to accept that argument, which brings us to the part the reporting treats as a footnote.
The downstream cost is measurable and it is being misattributed. A login page that fails autofill does not produce a security incident; it produces a support ticket. Multiply a low single-digit increase in failed first-attempt logins by the daily authenticated population of a large enterprise and the result is a help-desk queue that looks nothing like a breach and costs almost as much. During the DeFi Summer stress tests in 2020 I built leading indicators off exactly this kind of proxy โ abnormal gas spikes that preceded protocol exploits by hours, visible in mempool data before any post-mortem existed. Login abandonment rate is the enterprise equivalent of mempool congestion: a cheap, real-time signal that something upstream is misconfigured, published nowhere official.
Before the compliance discussion, note what the exemption architecture communicates. By keeping MSAL, the STS API, and non-browser flows open while closing DOM injection, Microsoft drew a line: integrate programmatically, do not manipulate the page. That is a coherent developer-facing position. It is also a positioning statement in the identity market, where Okta and CyberArk have spent years selling open compatibility with your existing toolchain. Microsoft just converted compatibility into a cost center and security into the differentiator.
The competitive read follows directly. Okta, Ping, and CyberArk cannot match unilateral control over a login surface they do not own, so their differentiation will migrate toward exactly the property Microsoft just removed: openness. Expect works-with-your-existing-stack-without-an-allow-list-application to become a sales line within two quarters. Whether that line wins deals depends on how badly the migration goes, which is a customer-success problem wearing a marketing costume.
The crypto parallel is not metaphorical
Every browser wallet in production today is a content-script injector. MetaMask, Phantom, Rabby, Coinbase Wallet โ they operate by injecting a provider object into the page context and responding to EIP-1193 requests. window.ethereum is a DOM injection. It exists because there was no native browser primitive for signing, and because the dApp ecosystem needed a shared interface fast.
That model has the same properties as the password-manager model Microsoft just restricted. It assumes the page can be modified at runtime. It assumes the injector is honest. It assumes the user can distinguish which of two scripts on screen is the real one. None of those assumptions survive contact with an adversary.
Look at the trajectory on the crypto side over the same window. Passkeys and WebAuthn are becoming the default credential in consumer wallets. EIP-7702 lets an externally owned account delegate execution to contract code, moving session logic into the account rather than the extension. Account abstraction relocates signing policy from the client to the smart contract layer. Every one of those shifts reduces the amount of trust that has to be placed in an injected script.
Data doesn't lie about directionality. The injection layer is being retired on both sides of the fence, and the retirement is being driven by security teams, not by user demand.
There is a structural analogy worth stating precisely. A nonce budget is a scarce resource allocated by the platform, in the same way blob space is a scarce resource allocated by the protocol. My long-standing read on blobs is that post-Dencun capacity saturates well inside two years and rollup fees reset upward when it does โ not because anyone planned it, but because the allocation mechanism is a governance parameter that gets repriced under load. The same logic applies here. Microsoft's allow-list is a governance parameter. When liability pressure rises, the list tightens. Nobody should model the current allow-list as a permanent entitlement.
The same critique applies to how this industry treats security parameters generally. Aave's interest rate curve bends at a utilization kink chosen by governance, not discovered by the market. Compound's collateral factors are votes. Entra's nonce allow-list is an internal review process. All three are arbitrary thresholds presented as engineering. The only difference is who bears the cost of the arbitrariness.
And to be blunt about a related category error: injecting a content script into a login form to fill a password field, when the Credential Management API exists, is the same failure mode as inscribing a JPEG pointer into Bitcoin's blockspace to move a JPEG. It insults the substrate and it does not carry much cargo.
Contrarian: the defense is a point, not a chain
The consensus reading is that Microsoft hardened the browser layer, and the browser layer is where credential theft happens. That reading is wrong in a specific and expensive way.
CSP protects the page where a human types a credential. It does nothing once a session token exists. The supporting analysis cites eight separate incidents involving default trust at the federation or proxy layer โ the server-side components that accept assertions and hand out sessions. CSP does not touch that surface. Microsoft closed the top of the funnel and left the middle of the chain intact. Attackers who stopped stealing passwords in favor of token theft will not notice this change at all.
Then there is the agent problem, the blind spot with the shortest fuse. When an autonomous agent inherits a human session โ via a delegated token, a browser profile, or a shared refresh credential โ the CSP has already done its job and become irrelevant. The policy governs the moment of human authentication. It has no opinion about what happens after. Every enterprise now running agentic workflows on inherited credentials is operating outside the boundary this control actually defends.
Accessibility is the compliance tail of the same oversight. European Accessibility Act obligations became enforceable in 2025, and ADA case law in the United States is mature and well-litigated. A platform operator that blocks assistive overlays without publishing a certified native alternative is exposed. The affected population is small, organized, and legally sophisticated. Probability moderate, impact high, and the mitigation is documentation Microsoft has not yet been shown to have produced.
Risk Check
Before the October window closes, four items are worth auditing at the tenant level. Inventory every browser extension touching the login flow, sorted by injection mechanism. Test password manager autofill against a staging tenant with the policy applied. Identify accessibility-dependent users and confirm their tooling against Microsoft's native conformance claims. Map any session-recording deployment against financial-sector retention requirements, because DOM-level capture is the mechanism being removed and a regulator will not accept the platform changed as an explanation for a control failure.
Verify the hash, ignore the hype. The hash here is your own tenant's login telemetry, not Microsoft's release notes.
Takeaway
The strategic logic is clear and it is not primarily about security. Closing UI injection while keeping API paths open, six weeks after making passkeys the default, funnels authentication from third-party injectors toward platform-native credentials. Microsoft's passkey and Windows Hello ecosystem is the beneficiary. That is a legitimate outcome, executed competently, but it should be named for what it is: a reallocation of control, not a neutral patch.
On-chain metrics > Twitter polls applies here too, transposed. Watch what enterprises actually deploy inside the window, not what they announce.
The question worth sitting with is not whether crypto wallets will face the same restriction. It is which wallets have already built the native-credential path, and which ones are preparing to argue that their content script deserves a nonce.