Free tools Windows power users keep installed
One-click scans. No signup required.
For most Microsoft Entra ID workforce tenants, use built-in company branding and application themes rather than starting a new custom CSS implementation. CSS availability now depends on when the tenant was created and whether it already uses CSS, and Microsoft is retiring layout and positioning properties before eventually retiring custom CSS altogether. The right choice depends on the branding you need, your tenant’s eligibility, and how much change you can support.
What can you customize without CSS?
Microsoft Entra ID’s built-in company-branding settings cover common sign-in page elements: background image or color, favicon, logos, sign-in text, page layout, and header and footer. Any property you leave unchanged retains its default behavior. The default branding applies across the tenant; it is the starting point for users who do not receive an application-specific theme. Microsoft’s company-branding guide describes the controls and prerequisites.
As an Amazon Associate I earn from qualifying purchases.
For branding that should differ by application, Entra ID supports branding themes that override default branding for selected applications. Unset theme properties fall back to the default branding. Microsoft documents a maximum of five themes per tenant, so themes provide targeted variation, not unlimited page designs or a general-purpose styling system. See Microsoft’s branding themes guidance.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Default branding can also be localized. A language-specific configuration takes precedence when the user’s browser language matches it, and Microsoft documents right-to-left layout support for languages including Arabic and Hebrew. The sign-in page’s basic background, logo, and text areas are also illustrated in Microsoft 365 sign-in branding guidance.
#1 Best Overall
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
Can you still use custom CSS?
Not every tenant can newly configure it. Microsoft’s current eligibility rules distinguish tenants by creation date and prior CSS use:
- Tenant created after January 5, 2026: custom CSS is not available for company branding.
- Tenant created before January 6, 2026, with no existing custom CSS: after July 21, 2026, it cannot newly configure custom CSS.
- Tenant that already uses custom CSS: these cutoffs do not by themselves establish that its existing CSS will stop working immediately. Check the current CSS reference and plan for Microsoft’s stated retirement direction.
These are policy dates, not a general guarantee that CSS remains supported for a particular tenant. Microsoft has not stated a final date on its CSS reference guide for global blocking of the affected properties or for full CSS retirement.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How built-in branding and custom CSS compare
| Decision | Built-in company branding and themes | Custom CSS |
|---|---|---|
| Availability | Documented branding controls; themes can target selected applications. | New configuration is restricted by tenant creation date and whether the tenant already uses CSS. |
| Scope | Default branding is tenant-wide; a theme overrides it for selected applications. | CSS styles the sign-in experience, but actual selector and property behavior must be checked against Microsoft’s current reference. |
| Typical controls | Background, favicon, logos, sign-in text, layout, header, and footer. | More styling control, subject to Microsoft’s CSS support and retirement changes. |
| Operational outlook | Microsoft documents these settings and theme workflows as branding controls. | Microsoft is retiring layout and positioning properties and says it will eventually retire custom CSS. |
| Key checks | Confirm licensing, required roles, and whether the desired application scope is supported. | Confirm tenant creation date, prior CSS use, affected properties, and migration guidance. |
Why Microsoft is retiring CSS layout and positioning
Microsoft says the change aligns with its Secure Future Initiative and focus on identity security and phishing resistance. Its CSS reference states: “To align with the Microsoft Secure Future Initiative and its focus on identity security and phishing resistance, Microsoft Entra ID is retiring support for custom CSS layout and positioning properties in company branding.”
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe announced sequence is to deprecate and block affected layout and positioning properties globally, then eventually retire custom CSS. Microsoft says it plans to provide advance notice and recommended migration paths before full retirement, but the reference does not give a final date for either milestone. Do not assume a selector or page-positioning behavior will remain available indefinitely.
Rank #3
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
Check licensing and administrator roles before rollout
Microsoft’s company-branding guidance lists Microsoft Entra ID P1 or P2, Microsoft 365 Business Standard, or SharePoint Plan 1 among qualifying licenses and names Organizational Branding Administrator as the minimum role for default company branding. Theme creation guidance lists Organizational Branding Administrator and Application Administrator. Verify the current licensing and role requirements for your tenant and intended workload before scheduling a change; eligibility can depend on the setup. The details are in the company-branding guide and theme guidance.
How to choose and plan the change
- Identify the scope. Use default company branding for tenant-wide consistency; consider an application theme when selected applications need a distinct treatment.
- Check what the built-in controls cover. Compare the desired background, logos, text, layout, header, or footer with the documented branding and theme properties. Do not treat themes as unrestricted CSS.
- Establish CSS eligibility. Record the tenant creation date and whether it already uses CSS. Apply Microsoft’s eligibility cutoffs before designing a new CSS-based implementation.
- Review any existing stylesheet. Compare the properties and selectors it uses with Microsoft’s current CSS reference, paying particular attention to layout and positioning. Avoid promising continued behavior that Microsoft says is on the retirement path.
- Confirm administration prerequisites. Check the applicable licenses and assign the documented administrator role or roles for the branding task.
- Account for language and application differences. Review localized branding and any application-specific themes so the experience matches the intended users and sign-in routes.
Can you manage branding through Microsoft Graph?
Yes. Microsoft Graph documents the organizationalBranding resource for default organization branding, with a related localization resource for language-specific branding. Microsoft notes that the original configuration’s language cannot be changed; add locale-specific branding through the localization resource instead. See the Microsoft Graph organizationalBranding resource.
Rank #4
- FIDO2 + FIDO U2F certified security key, supports PIV credential authentication
- Sits with a low-profile when plugged-in
- Works in every browser without installing any drivers
- Supports desktops, laptops, tablets, and Android mobile devices via USB-C
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Scope: workforce Entra ID, not External ID
This guidance concerns Microsoft Entra ID workforce tenant sign-in branding. Microsoft Entra External ID customer branding is a separate product area with different applicability, so do not assume these settings or CSS eligibility rules transfer to customer identity tenants.
Quick Recap
Best Value
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
