Description
The company branding of the tenant sets Sign-in page text to a short legal notice:
{{ sign_in_notice_text }}. The text appears at the bottom of the sign-in box for every user who
signs in through the tenant's branded page, including on Windows during Autopilot.
The text is validated by the legal department and translated into the languages of the users through branding localizations if needed.
Phishing kits copy the branding of their targets, so the notice is not an anti-phishing control. Company branding needs Microsoft Entra ID P1 or P2, or an Office 365 license.
Rationale
A notice that the system is restricted to authorized users and that activity is logged supports disciplinary or legal action after misuse, and is required by some regulations and contracts. Together with the company logo, it also helps users recognize the genuine sign-in page.
Impact
None known. The text is public: anyone who enters an address of the tenant sees it, so it must not contain internal information such as phone extensions of administrators. It is limited to 1,024 characters.
Setting
| Location | Microsoft Entra admin center > Entra ID > Custom Branding > Company branding > Default sign-in experience > Sign-in form > Sign-in page text |
| Default | Empty |
| Recommended | {{ sign_in_notice_text }} |
Parameters
| Parameter | Baseline | Hardened | Bounds |
|---|---|---|---|
sign_in_notice_textstring. Legal notice shown on the sign-in page, validated by the legal department (1,024 characters at most). | Access to this system is restricted to authorized users. Activity is logged and may be monitored. Unauthorized use may lead to disciplinary and legal action. | Access to this system is restricted to authorized users. Activity is logged and may be monitored. Unauthorized use may lead to disciplinary and legal action. |
The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.
Audit
- Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
- Browse to Entra ID > Custom Branding > Company branding and open Default sign-in experience > Sign-in form.
- Check that Sign-in page text contains the approved notice.
- Alternative (Microsoft Graph, scope
Organization.Read.All):GET https://graph.microsoft.com/v1.0/organization/{tenant-id}/brandingand readsignInPageText. - Fail if the text is empty or differs from the approved notice.
Remediation
- Have the notice validated by the legal department.
- Sign in to the Microsoft Entra admin center as an Organizational Branding Administrator.
- Browse to Entra ID > Custom Branding > Company branding > Default sign-in experience > Edit (or Configure the first time).
- On the Sign-in form tab, enter the notice in Sign-in page text, then Review and Save.
- Add localized versions under Customize by browser language if users work in several languages.
In Microsoft Graph: PATCH https://graph.microsoft.com/v1.0/organization/{tenant-id}/branding
with {"signInPageText": "..."}.
Rollback
Clear Sign-in page text and save.
References
- Add company branding to your organization's sign-in page Microsoft, vendor-doc, accessed 2026-10-24
- organizationalBranding resource type Microsoft, vendor-doc, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-8 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Related controls
- related
CB-M365-AUTH-027Hide the "Stay signed in" option at sign-in
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
