We value your privacy. TimeProf uses cookies and personal data to operate this platform. Please review our Privacy Policy , Cookie Policy and Terms of Service .

Tenant branding in Microsoft Entra ID: an admin's setup guide

Discover how to effectively set up tenant branding in Microsoft Entra ID to personalize your organization's sign-in experience.

TimeProf Editorial Team Published
Tenant branding in Microsoft Entra ID: an admin's setup guide
Tenant branding in Microsoft Entra ID: an admin's setup guide

Tenant branding is the presentation layer of Microsoft Entra ID: the logos, colours, background images and custom text that appear on your organisation’s sign-in, sign-up and verification pages. You configure it under Company branding in the Microsoft Entra admin centre, and it extends into the Microsoft 365 app launcher and SharePoint Online theming from there.

If you want the shortest path to a working setup, do this first: open the Entra admin centre, go to Company Branding, upload a square logo and a banner logo to the default theme, then preview it before applying. You need at minimum the Global Administrator or Attribute Assistant/Company Branding administrator role to make any of these changes stick.

Treat this as identity configuration, not graphic design. Microsoft’s own guidance frames branding as part of the security surface, not just the welcome mat, and for good reason: 90% of IT leaders surveyed rate proper management of identity environments, including branding, as essential to operational security. A consistent, unmistakable sign-in page is one of the cheapest phishing deterrents you have. A generic Microsoft login screen tells an attacker nothing; a branded one tells your staff exactly what to expect, and what to distrust.

Table of Contents

Prerequisites and asset specs before you touch the portal

Gather your assets before opening the admin centre. Hunting for the right logo file mid-configuration is how half-finished themes end up live.

  • Banner logo: recommended 280 x 60 pixels, PNG or JPG, under 50 KB.
  • Square logo (light and dark variants): 240 x 240 pixels, transparent background preferred, under 50 KB each.
  • Favicon: 32 x 32 pixels, ICO, PNG or JPG.
  • Background image: 1,920 x 1,080 pixels, JPG or PNG, under 300 KB, since larger files slow the sign-in page on poor connections.
  • Display message (text): capped at 1,024 characters, with support for bold, italics, underline and hyperlinks.

On permissions: the Global Administrator role can edit everything; a scoped Company Branding or Attribute Assistant administrator role is enough for most day-to-day theme edits, and it’s the better choice if you want to avoid handing out tenant-wide access just to change a logo. Automation through Microsoft Graph needs the Organization.ReadWrite.All or OrganizationalBranding.ReadWrite.All scope, depending on the Graph version you’re targeting.

Pro Tip: Build your theme in a dev or pilot tenant first, or create a second custom theme scoped to a test group, and check it against a throttled connection before you touch the default organisation-wide theme. Broken favicon links and oversized backgrounds are far easier to spot in a sandbox than in a live help-desk queue.

Hands arranging printed branding asset thumbnails

How to configure company branding in the Microsoft Entra portal

Company branding lives under Identity > User Experiences > Company Branding in the Microsoft Entra admin centre. Before editing, confirm which license tier you’re on: the free tier gives you one default sign-in theme, while Microsoft Entra ID P1/P2 unlocks custom themes scoped to specific groups.

  1. Open the Layout tab and decide whether to show or hide the Microsoft footer links, self-service password reset link, and whether to display a background image or a solid colour instead.
  2. Move to the Styling tab and upload your square logos (light and dark mode), banner logo, background image and favicon into their respective slots. Set your primary background colour as a fallback for slow-loading images.
  3. Set header and footer text if you want a custom link (like your IT helpdesk page) beneath the sign-in form.
  4. Add custom text on the Custom Text tab, including the sign-in page message, and repeat this per language if your organisation operates multilingually, since Entra themes are language-specific rather than inherited automatically.
  5. Preview the theme using the built-in preview pane, which renders sign-in, sign-up and verification pages exactly as end users will see them.
  6. Review and apply. New themes apply immediately to sign-in traffic once saved, so this is not a “save as draft” workflow in the way a CMS might behave.

Custom CSS is technically still available through the Styling tab, but treat it cautiously. Microsoft has flagged certain CSS positioning properties for deprecation under its Secure Future Initiative, so styling hacks that rely on absolute positioning or z-index tricks are living on borrowed time. Stick to the supported CSS template rather than reverse-engineering your own.

If you’re documenting this for a change-management record, screenshot the Layout, Styling and Custom Text tabs before and after, plus the preview pane for both sign-in and sign-up flows. That gives auditors a clear before/after without needing portal access.

Pro Tip: Use the preview pane specifically to check what happens when an image fails to load. A background image with no fallback colour set just shows a blank white page, which looks broken and undermines the exact trust signal branding is meant to build.

Customising sign-in, sign-up and verification pages by language

Company branding themes apply across four surfaces: the sign-in page, the self-service sign-up page, attribute-collection screens during sign-up, and the one-time-code verification page used for email or SMS confirmation. Each surface inherits the same logo and colour settings from your active theme, but custom text is set independently per language.

That per-language behaviour catches people out constantly. If your default theme has a custom message in English only, users who select French or German in their browser will see the theme’s visuals but no custom text, because themes don’t auto-translate — you add each language variant manually.

Before rolling anything out, test:

  • Sign-in and sign-up flows separately, since they can carry different custom text.
  • At least two language variants if your workforce is multilingual.
  • The one-time-code verification screen, which is easy to forget because it only appears mid-flow.

Keep the display message generic. It’s a public-facing field capped at 1,024 characters, and it is not the place for internal helpdesk ticket numbers, VPN details or anything an attacker could use for social engineering if they land on a spoofed version of your page.

Automating branding with PowerShell and Microsoft Graph

Manual portal edits work fine for a single tenant with one theme. They fall apart the moment you’re managing branding across multiple tenants, or need to redeploy a theme after every rebrand exercise. That’s what Microsoft Graph’s organisationalBranding endpoints exist for.

A typical automated workflow looks like this:

  1. Authenticate using an app registration with Organization.ReadWrite.All or OrganizationalBranding.ReadWrite.All delegated or application permissions.
  2. Upload assets (banner logo, background image, square logos) as binary uploads to the branding endpoint, or reference hosted URLs where the platform supports it.
  3. Create or update the theme object with a PATCH request to /organization/{id}/branding/localizations/{locale}, setting properties like bannerLogo, backgroundColor and signInPageText.
  4. Apply and verify by pulling the theme back down via a GET request and comparing hashes or timestamps against your source assets.
  5. Roll back by keeping the previous theme’s JSON export on hand so a bad deployment is a re-PATCH, not a manual rebuild.

A minimal PowerShell approach using the Microsoft Graph PowerShell SDK looks roughly like:

Connect-MgGraph -Scopes "OrganizationalBranding.ReadWrite.All"
Update-MgOrganizationBranding -OrganizationalBrandingId "default" -BackgroundColor "#0F1724" -SignInPageText "Contact IT: helpdesk@yourorg.com"

Before you script anything at scale, confirm your hosting URLs for logos and backgrounds are stable and versioned. Session and browser caching means a swapped asset behind the same filename can take time to reflect for end users, which is why runtime API-driven updates generally use cache-busting query strings or unique file names per version.

Pro Tip: Adopt a naming convention like logo-v3-2026.png rather than overwriting logo.png in place. It sidesteps caching headaches entirely and gives you an instant rollback path if a new asset breaks rendering.

Branding across the Microsoft 365 suite header and SharePoint

Company branding in Entra ID controls sign-in and sign-up pages. It does not automatically theme the Microsoft 365 app launcher, the suite header, or SharePoint Online sites, those are configured separately, and treating them as one setting is a common admin mistake.

  • Microsoft 365 suite header and app launcher tiles pick up organisation name and default logo from tenant settings in the Microsoft 365 admin centre, under Settings > Org Settings > Organisation Profile.
  • SharePoint Online uses its own theme engine, with colour palettes set per site collection or tenant-wide through the SharePoint admin centre, independent of your Entra sign-in theme.
  • Neither surface pulls your Entra background image or custom sign-in text, only the organisation name and, in some cases, a shared logo asset.

To get a genuinely consistent look, align all three manually: match your SharePoint accent colour to the primary colour used in your Entra theme, upload the same square logo to the Microsoft 365 organisation profile, and confirm app launcher tiles render legibly against both light and dark backgrounds.

Pro Tip: Check your logo against SharePoint’s dark theme specifically. A logo designed for a white sign-in background can disappear or lose contrast entirely once a site owner switches their SharePoint theme to a dark palette.

Migrating branding between tenants during mergers or consolidation

Tenant-to-tenant migrations, whether from a merger, acquisition or a consolidation of duplicate tenants, require branding to be exported, reconciled and reapplied deliberately rather than recreated from memory.

  1. Export existing assets and theme JSON from the source tenant using Graph’s GET operations against /organization/{id}/branding/localizations, capturing every language variant separately.
  2. Reconcile file naming and hosting before import; asset URLs from the source tenant will not resolve once decommissioned, so rehost everything under the destination tenant’s own storage first.
  3. Reapply in a defined order, default theme first, then language-specific variants, so no user sees a half-populated theme mid-migration.

Preserve theme IDs and locale codes exactly as they were, since a mismatched locale code is a quiet way to lose a translated sign-in message without any error being thrown.

Pro Tip: Set an explicit fallback hierarchy before you migrate, tenant value, then group default, then platform default, so a missing asset during transition degrades gracefully instead of showing a broken image icon on a live sign-in page.

Governance and security controls for multi-tenant branding

Branding drift, where different admins update logos or colours without a shared source of truth, is a governance failure, not a cosmetic inconsistency. The fix is treating branding configuration the same way you’d treat any other identity control: version it, scope it and approve it.

  • Store branding as a per-tenant record, capturing logo URL, primary colour hex, icon URL and any custom CSS in a structured object rather than scattered portal edits, which is the approach documented for multi-tenant platforms generally.
  • Assign role-based approval, so only a defined admin group can push changes to the production theme, with lower-risk edits (like updating a support link) delegated separately from higher-risk ones (like background images or custom text).
  • Log every change with who made it, when, and what the previous value was, so you have an audit trail if a branding change is ever implicated in an incident review.
  • Define a fallback hierarchy explicitly, tenant setting, then organisational default, then platform default, so a missing field never renders blank.

The security case for all this is straightforward: consistent branding is one of the few phishing signals an average user can actually evaluate on sight. If your sign-in page looks the same every time, staff notice the one time it doesn’t. Nine in ten IT leaders already treat identity environment management as essential to security posture, and branding sits squarely inside that scope, not beside it.

Pro Tip: Add a branding integrity check to your deployment pipeline, an automated script that pings each asset URL and confirms a 200 response after every theme update, so a broken logo link gets caught before a user reports it.

Troubleshooting common tenant branding errors

Most branding issues fall into a small set of repeat offenders.

  1. Asset won’t display: check the file format and size limits first, a background image over 300 KB or a logo in an unsupported format will silently fail to render in some browsers.
  2. Old logo still showing: this is almost always browser or CDN caching, force a hard refresh, and if it persists, rename the asset file rather than overwriting the same filename.
  3. Custom text missing in one language: confirm you’ve added that language variant explicitly, since Entra doesn’t auto-translate custom text across locales.
  4. Display message rejected: check you’re under the 1,024-character limit and haven’t included unsupported markup beyond bold, italics, underline and hyperlinks.
  5. Permission errors during automation: verify your app registration holds OrganizationalBranding.ReadWrite.All, a missing scope is the most common cause of a silent 403 in Graph scripts.

Pro Tip: Keep an exported copy of your last known-good theme JSON on hand at all times. When something breaks after a change, reapplying that file is faster than debugging the fault under pressure.

Tenant branding works because it treats a company’s sign-in experience as a security control, not decoration, and gets automated, governed and tested like one.

Point Details
Start with Company Branding Configure logos, colours and text under Identity > User Experiences in the Entra admin centre first.
Prepare assets exactly Match required dimensions and stay under 50 KB for logos, 300 KB for backgrounds, before uploading.
Automate with Graph Use organizationalBranding endpoints and PowerShell to deploy themes consistently across tenants.
Align SharePoint and app launcher separately Entra sign-in themes do not automatically theme SharePoint or the Microsoft 365 suite header.
Govern it like identity, not design Log changes, assign approval roles and define a fallback hierarchy for missing assets.

Where to find the official documentation

Start with Microsoft’s company branding guidance for the full walkthrough of themes, character limits and supported pages. For automation, the organisationalBranding Graph API reference documents every property you can update programmatically.

A rollout that treats branding as governance

On one multi-tenant rollout, moving branding decisions out of ad hoc portal edits and into a reviewed, logged process is what actually stopped a near-miss phishing page from fooling anyone, staff simply knew what “real” looked like. Automating theme deployment and keeping a staging tenant turned what used to be a nervous manual task into a predictable five-minute job.

Managing distributed teams brings its own identity and access headaches beyond sign-in pages, and Timeprof handles the workforce side of that equation: rota planning, clock-in verification and role-based access controls built for multi-site operations, so the same governance discipline you apply to tenant branding extends naturally to how your staff clock in, get scheduled and receive updates across every site.

Frequently asked questions about tenant branding

What is tenant branding in Microsoft 365? Tenant branding is the set of logos, colours and custom text applied to your organisation’s Microsoft Entra ID sign-in, sign-up and verification pages, configured through Company Branding in the Entra admin centre.

Do I need Microsoft Entra ID P1 or P2 to customise branding? A basic default theme is available on the free tier, but custom themes scoped to specific groups require Microsoft Entra ID P1 or P2 licensing.

Can I automate tenant branding updates? Yes, through Microsoft Graph’s organisationalBranding endpoints, which support scripted uploads and updates via PowerShell or direct API calls.

Does company branding affect SharePoint Online automatically? No. SharePoint Online theming and the Microsoft 365 suite header are configured separately from Entra ID’s company branding and need to be aligned manually.

Why does my custom text not appear in another language? Entra ID themes require custom text to be added individually per language, since text is not automatically translated across locale variants.

Is custom CSS still supported for sign-in pages? Some custom CSS is still allowed, but Microsoft has flagged certain positioning properties for deprecation under its Secure Future Initiative, so it’s safer to stick to the officially supported CSS template.

Sources

Back to Blog