{
  "id": "CB-M365-AUTH-048",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-048",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-048.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-048.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-048",
    "title": "Display a legal notice on the sign-in page",
    "finding": {
      "title": "The sign-in page does not tell users that access is restricted and monitored",
      "description": "Without a notice, the organization has a weaker basis to act against misuse, and users get no visual cue that they are on the real company page."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "info"
    },
    "assessment": "manual",
    "tags": [
      "branding",
      "sign-in-page",
      "legal-notice"
    ],
    "description": "The company branding of the tenant sets **Sign-in page text** to a short legal notice:\n`{{ sign_in_notice_text }}`. The text appears at the bottom of the sign-in box for every user who\nsigns in through the tenant's branded page, including on Windows during Autopilot.\n\nThe text is validated by the legal department and translated into the languages of the users\nthrough branding localizations if needed.\n",
    "rationale": "A notice that the system is restricted to authorized users and that activity is logged supports\ndisciplinary or legal action after misuse, and is required by some regulations and contracts.\nTogether with the company logo, it also helps users recognize the genuine sign-in page.\n",
    "impact": "None known. The text is public: anyone who enters an address of the tenant sees it, so it must not\ncontain internal information such as phone extensions of administrators. It is limited to 1,024\ncharacters.\n",
    "notes": "Phishing kits copy the branding of their targets, so the notice is not an anti-phishing control.\nCompany branding needs Microsoft Entra ID P1 or P2, or an Office 365 license.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Custom Branding > Company branding > Default sign-in experience > Sign-in form > Sign-in page text",
      "default_value": "Empty",
      "recommended_value": "{{ sign_in_notice_text }}"
    },
    "parameters": [
      {
        "name": "sign_in_notice_text",
        "type": "string",
        "description": "Legal notice shown on the sign-in page, validated by the legal department (1,024 characters at most).",
        "default": "Access to this system is restricted to authorized users. Activity is logged and may be monitored. Unauthorized use may lead to disciplinary and legal action."
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Custom Branding** > **Company branding** and open **Default\n   sign-in experience** > **Sign-in form**.\n3. Check that **Sign-in page text** contains the approved notice.\n4. Alternative (Microsoft Graph, scope `Organization.Read.All`):\n   `GET https://graph.microsoft.com/v1.0/organization/{tenant-id}/branding` and read\n   `signInPageText`.\n5. Fail if the text is empty or differs from the approved notice.\n"
    },
    "remediation": {
      "manual": "1. Have the notice validated by the legal department.\n2. Sign in to the Microsoft Entra admin center as an Organizational Branding Administrator.\n3. Browse to **Entra ID** > **Custom Branding** > **Company branding** > **Default sign-in\n   experience** > **Edit** (or **Configure** the first time).\n4. On the **Sign-in form** tab, enter the notice in **Sign-in page text**, then **Review** and\n   **Save**.\n5. Add localized versions under **Customize by browser language** if users work in several\n   languages.\n\nIn Microsoft Graph: `PATCH https://graph.microsoft.com/v1.0/organization/{tenant-id}/branding`\nwith `{\"signInPageText\": \"...\"}`.\n",
      "rollback": "Clear **Sign-in page text** and save.\n"
    },
    "references": [
      {
        "title": "Add company branding to your organization's sign-in page",
        "url": "https://learn.microsoft.com/entra/fundamentals/how-to-customize-branding",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "organizationalBranding resource type",
        "url": "https://learn.microsoft.com/graph/api/resources/organizationalbranding",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-8",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-027",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}