Microsoft 365 tenant branding is managed through Microsoft Entra ID company branding. It changes the work-or-school account sign-in experience used by Microsoft 365 and applications that authenticate with your Entra tenant.

The default branding can include a banner logo, square logos for light and dark themes, a favicon, background image or color, page layout, header, footer, and public sign-in text. The banner logo is the short, wide logo shown above the Microsoft sign-in form and is the asset most public tenant-branding checks attempt to discover.

Branding does not apply to personal Microsoft accounts. In many Microsoft and multitenant applications, users see neutral Microsoft branding first; the tenant-specific branding appears only after they enter an email address from your verified domain.

Confirm that your account has the Organizational Branding Administrator role. This is the minimum Microsoft Entra role Microsoft documents for changing company branding. A Global Administrator can assign the role if necessary.

Microsoft lists Microsoft Entra ID P1 or P2, Microsoft 365 Business Standard, or SharePoint Plan 1 as eligible licensing options. Licensing and portal features can change, so verify your tenant's current entitlement before scheduling the change.

Prepare organization-approved images and public wording. Do not put passwords, internal phone extensions, confidential instructions, security details, or other sensitive information in sign-in page text because unauthenticated visitors may be able to see it.

Official Microsoft instructions: https://learn.microsoft.com/en-us/entra/fundamentals/how-to-customize-branding

Use RGB images rather than print-oriented CMYK files. Check transparency, contrast, spelling, and trademark approval before uploading the final assets.

The default sign-in experience applies tenant-wide and is the correct place for an organization that wants one consistent public Microsoft 365 sign-in identity. Application-specific branding themes are a separate feature and may have additional licensing or role requirements.

Favor Microsoft's supported templates over custom CSS. Microsoft has restricted custom CSS for newer tenants and is retiring several CSS positioning capabilities as part of its sign-in security changes.

If Microsoft rejects an upload, confirm the pixel dimensions, format, file size, and file extension. Re-exporting the image as an optimized PNG usually resolves metadata or compression issues.

Use sign-in page text for a short organization identifier, an approved help-desk contact, or a warning that the system is limited to authorized users. Microsoft permits up to 1,024 Unicode characters and supports basic formatting.

Avoid username hint text when guests or users from multiple organizations share the sign-in experience because a company-specific hint can confuse them. Never include private troubleshooting steps, employee-only URLs, or information that would help an attacker imitate your support process.

Review privacy and terms links carefully. Microsoft notes that link behavior can vary between browser and native application sign-in experiences, so the visible wording should remain understandable even when a link is not clickable.

Once a default sign-in experience is created, Microsoft does not provide a single delete action for it. You can edit the experience and remove individual custom settings to return those elements to their defaults.

A successful Entra preview or branded Microsoft sign-in is the authoritative validation. A third-party public lookup can fail even when branding is configured because Microsoft controls which assets are exposed, when they appear, and how endpoints behave.

The absence of a publicly retrievable logo does not prove that a tenant is unbranded, misconfigured, or insecure. Treat the Entra admin center and a real tenant-specific sign-in test as the source of truth.

Review branding after a company rename, merger, domain change, logo update, help-desk change, or identity-platform migration. Keep the original artwork in an organization-controlled repository rather than an individual administrator's computer.

Assign the Organizational Branding Administrator role only to staff who need it, use multifactor authentication for administrative accounts, and review privileged-role assignments regularly. Company branding improves recognition but is not a security control and does not replace phishing-resistant MFA, Conditional Access, user training, or sign-in monitoring.

For assistance configuring or validating Microsoft 365 and Microsoft Entra, contact Network Thinking Solutions at https://www.networkthinking.com/contact-us.