Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIf your Microsoft Entra sign-in page is missing a logo, showing the wrong layout, or ignoring custom CSS, first confirm which branding surface and sign-in flow the user is actually seeing. Then check tenant eligibility, application-specific overrides, asset settings, CSS availability, and propagation—before replacing settings or layering on more CSS.
Identify the sign-in experience before changing branding
“Entra branding” can refer to different systems: workforce tenant-wide company branding, an application-specific branding theme, Microsoft Entra External ID customer branding, or an older Azure AD B2C flow. Their controls are not interchangeable. This guide focuses on workforce company branding and app-specific themes; External ID and B2C may require their own configuration paths.
As an Amazon Associate I earn from qualifying purchases.
Record the affected tenant, application, exact sign-in URL, browser language, and the precise point where the appearance changes. Also note whether the user is signing in with a work or school account, a personal Microsoft account, or as a guest. Workforce tenant branding does not carry over to personal Microsoft account sign-ins, and in B2B cross-tenant sign-ins users see their home tenant’s branding.
Recommended Free Tools
Check whether branding is expected to appear later
For some SaaS and multitenant applications, the user may see a generic first step, then the tenant’s branding only after entering an email address or phone number and selecting Next. Supported Home Realm Discovery domain hints can cause branding to appear on the initial step. Compare the user’s actual route and sign-in stage with the behavior described in Microsoft’s company branding guidance.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check access and licensing
Microsoft lists the Organizational Branding Administrator role as the minimum role for company branding. Workforce company branding requires Microsoft Entra ID P1 or P2, Microsoft 365 Business Standard, or SharePoint Plan 1. An application-specific theme also requires Application Administrator access for the target app, an application registration, and—when using a workforce Entra tenant—P1 or P2 licensing. See Microsoft’s branding themes guidance for theme requirements and status.
Confirm which settings control this application
Tenant-wide company branding supplies the default. An assigned application theme can override the properties configured for that application; properties not set in the theme fall back to tenant default branding and then to neutral branding. Therefore, editing the tenant default may not change a property already overridden by an app theme.
For workforce Entra tenants, Microsoft currently labels application branding themes as preview in its documentation. The theme preview shows the sign-in page and style or layout changes, but Microsoft says it does not include custom text overrides. A preview that omits text is not, by itself, proof that the saved text setting has failed.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Fix missing logos, backgrounds, headers, and footers
Validate the image file and layout
Microsoft recommends PNG images; JPG is also accepted for company branding images. Check the file type, pixel dimensions, and file size against the documented examples before uploading:
| Asset | Example workforce limit |
|---|---|
| Favicon | 32 × 32 px; maximum 5 KB |
| Background image | 1920 × 1080 px; maximum 300 KB |
| Header logo | 245 × 36 px; maximum 10 KB |
| Banner logo | 245 × 36 px; maximum 50 KB |
| Square logo | 240 × 240 px; maximum 50 KB |
These are the examples in Microsoft’s workforce company branding instructions; check the current portal and documentation for the specific asset field you are editing. A correctly uploaded image can still be absent if its section is disabled: enable Show header or Show footer to display those elements. A full-screen template can obscure the background image, so choose partial-screen if visibility of that image matters.
Account for cropping and fallback behavior
The background image is scaled and cropped to fit the viewport, and the sign-in prompt can cover part of it. If the background image cannot load—for example, because of connection latency—the configured background color appears instead. Microsoft Graph’s organizationalBranding resource reference documents image content properties and format, size, and dimension constraints.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Diagnose unavailable or ineffective custom CSS
CSS controls are subject to tenant-creation-date cutoffs and prior use. Microsoft’s current CSS reference says tenants created after January 5, 2026, do not have custom CSS available for company branding. After July 21, 2026, tenants created before January 6, 2026, that were not already using custom CSS cannot configure it. Microsoft describes this as a staged change: layout and positioning properties will later be deprecated globally, and the custom CSS feature will eventually be retired. Those later stages are described as future events; do not assume every existing stylesheet is already blocked.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Inspect the existing stylesheet before editing
- In the Microsoft Entra admin center, edit company branding and open Layout.
- Download the current CSS instead of adding speculative overrides on top of it.
- For all locales, export
/v1.0/organization/{tenant-id}/branding/localizationsthrough Microsoft Graph and check the response with the tenant branding inspector, as described in Microsoft’s CSS reference. - Remove deprecated properties, upload the revised file, and save.
- Validate the visual result in a test tenant before applying the change in production.
The documented supported selector reference includes .ext-background-image, .ext-header, .ext-header-logo, .ext-sign-in-box, .ext-title, .ext-subtitle, .ext-link, .ext-error, and button and input selectors. A selector’s presence in that reference does not make every CSS property supported; use Microsoft’s CSS documentation to check the properties and deprecations relevant to the stylesheet.
Allow for propagation, then retest the real route
Microsoft says the time for branding changes to appear varies with the tenant’s geographical location; its guidance gives no fixed propagation interval. After saving, reproduce the actual sign-in URL, application, browser language, and sign-in stage. If the result differs, check whether you are seeing an app-specific override, a home-tenant experience, or a route that reveals branding only after the user enters an identifier.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use Microsoft Graph to verify configuration
For automated configuration or a second view of the saved settings, Microsoft Graph’s organizationalBranding resource includes properties for logos, background images, custom CSS, text, and layout. The Update organizationalBranding reference says a successful update returns 204 No Content. That confirms the API operation succeeded; it does not prove the intended appearance is visible on every sign-in route.
Custom footer URLs are displayed as text rather than clickable links in the documented sign-in experience. If a footer URL appears but cannot be opened, that behavior is expected.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
