Configure the tenant-wide sign-in experience in Entra ID > Custom Branding, using Microsoft’s supported branding controls rather than building a new layout around custom CSS. Before changing anything, confirm your tenant’s licensing and admin roles, decide whether branding should apply across the tenant or only to selected apps, and test the sign-in routes users actually take.
Choose the right branding scope
Microsoft Entra ID has two distinct branding approaches. Default company branding provides a tenant-wide baseline; application-specific branding themes can target selected apps but are marked preview for Entra ID tenants. Both can use the tenant’s default branding as a fallback for properties not specified in a theme. The themes feature is generally available for External ID, but that does not change its preview status for Entra ID tenants.
As an Amazon Associate I earn from qualifying purchases.
| Decision | Default company branding | Application-specific branding themes |
|---|---|---|
| Scope | Tenant-wide sign-in experience. | Selected applications, with default tenant branding as fallback. |
| Feature maturity | Documented company-branding configuration flow. | Preview for Entra ID tenants; generally available for External ID. |
| Roles | Organizational Branding Administrator is the documented minimum. | Organizational Branding Administrator and Application Administrator for the targeted applications. |
| Limits and preview behavior | Branding elements are optional; unset properties retain their default behavior. | Up to five themes per tenant; live preview does not show custom text overrides. |
| Best fit | A consistent baseline across tenant sign-ins. | Different branding requirements for selected apps, when preview status is acceptable. |
Microsoft lists Entra ID P1 or P2, Microsoft 365 Business Standard, or SharePoint Plan 1 for default company branding. For branding themes, it lists Entra ID P1 or P2. Confirm the entitlement that applies to your tenant and use case in Microsoft’s company branding guide and branding themes guide before rollout.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set up tenant-wide branding without relying on CSS
- Confirm the intended scope. Decide whether all tenant sign-ins should share a baseline or whether specific applications need themes. Treat Entra ID application themes as a preview feature before using them in a production-critical flow.
- Check licensing and access. Ensure the tenant has an applicable license and that the operator has the Organizational Branding Administrator role. For application themes, also verify Application Administrator access for the target apps.
- Review existing settings. In the Microsoft Entra admin center, open Entra ID > Custom Branding. Inspect the current configuration before editing; any branding element you leave unset continues to use its default behavior.
- Prepare images for their specific fields. Microsoft’s current guide gives examples of a 32 × 32 px favicon with a 5 KB maximum, a 1920 × 1080 px background image with a 300 KB maximum, and a 245 × 36 px header logo with a 10 KB maximum. A banner logo has a separately listed 50 KB maximum. These limits are field-specific; check the exact portal control rather than applying one asset limit to every image.
- Use supported visual controls. Configure the available images, colors, layout, header, footer, logos, and sign-in text instead of using CSS to hide, move, layer, or resize sign-in controls.
- Keep public text safe. Microsoft warns, “Anyone can see your sign-in page, so don’t put sensitive info here.” Keep message-box content generic and operational; do not include internal details or confidential information.
- Review each language and route. Check the experience in the languages your users need. Microsoft supports localization, and right-to-left layout adjusts for languages such as Arabic and Hebrew. For themes, add custom-text translations for each required language; those overrides are not automatically localized.
- Allow changes to propagate. Microsoft says the time before branding changes appear varies by tenant geographical location.
For direct configuration details and asset requirements, use Microsoft’s Add company branding to your organization’s sign-in page guide. For theme targeting, custom text, and preview behavior, use its branding themes guidance.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Understand the sign-in experience users will see
A portal preview is not a substitute for testing the authentication paths users follow. In Microsoft SaaS and multitenant apps such as Outlook and My Apps, tenant branding may appear only after a user enters an email address or phone number and selects Next, when the service can identify the tenant.
- Home Realm Discovery: In supported scenarios, a custom URL or
whrdomain hint can show tenant branding at the initial screen. - B2B cross-tenant sign-in: The user sees the home tenant’s branding, not necessarily the resource tenant’s design.
- Theme preview: Live preview shows sign-in-page style and layout but not custom text overrides. Check the text separately in the relevant language and application flow.
Test the email-first SaaS flow, any Home Realm Discovery route you use, and B2B access from the perspective of the relevant home tenant. Microsoft describes these behaviors in its company branding guide and themes guide.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check your tenant’s CSS eligibility and retirement risk
Custom CSS is not a sound foundation for new Entra ID branding work. Availability depends on when the tenant was created and whether it already used CSS. Microsoft’s current CSS reference states:
Recommended Free Tools
- Tenants created after January 5, 2026 do not have custom CSS for company branding.
- After July 21, 2026, tenants created before January 6, 2026 that were not already using custom CSS cannot configure it.
- Microsoft plans to block affected layout and positioning properties globally when they are deprecated. It says the full CSS feature will eventually be retired, with further notice and migration guidance.
- Microsoft Entra External ID tenants are not affected by this particular CSS change.
The affected-property list includes, among others, position and directional properties, z-index, margin variants, transform variants, opacity, overflow variants, filter, pointer-events, clip-path, display, visibility, inset, zoom, scale, rotate, grid placement properties, and masks. The list is not exhaustive; consult Microsoft’s reference for the current list. Microsoft says the deprecated properties have no supported migration or replacement.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If an existing tenant uses CSS, inspect the actual stylesheet against that list and do not assume an existing configuration will remain dependable. Microsoft explains that retiring layout controls is intended to keep sign-in layouts “consistent and predictable”; its guidance does not provide a measured phishing-reduction figure. This CSS schedule concerns company branding in Microsoft Entra ID, not the separate External ID tenant case noted above.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use Microsoft Graph only with current endpoint guidance
Microsoft Graph exposes the organizationalBranding resource, including Get and Update operations and properties for elements such as background color and image, logos, favicon, text, and CSS. The resource reference was last updated July 22, 2024, so consult the current endpoint-specific API documentation and permissions before scripting a change: organizationalBranding resource type.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The presence of a customCSS property in the Graph model does not mean that CSS is available to every tenant or that CSS properties on Microsoft’s retirement path are supported. Read the resource reference alongside the current CSS guidance, and validate the target tenant’s eligibility before automating changes.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
