Some companies add their own styling to the Microsoft sign-in page. This tool checks that styling for tricks that could move or stack images on top of the login boxes — a technique attackers use to fool people.
Paste the styling web address (it contains the word customcss) and check it for tricks that could move or stack content over the sign-in boxes.
No problem — if you have admin access you can pull it from Microsoft Graph. This also checks every language (locale) at once, so you don't have to do them one by one. In Microsoft Graph Explorer, run GET /v1.0/organization/<tenantId>/branding/localizations, then paste the full JSON response here — or upload it as a file. The tool builds the styling link for every locale that has custom CSS and checks them all. See how to get this JSON →