OWASP ZAP showing “Content Security Policy (CSP) Header Not Set” for Azure AD B2C /authorize endpoint — can this be fixed from application side?

Hello Microsoft Team,

We are using Azure AD B2C for authentication in our ASP.NET web application through OpenID Connect.

During a recent OWASP ZAP security scan, we received the following finding:

"Content Security Policy (CSP) Header Not Set for

https://mscb2cagfautprd.b2clogin.com/mscb2cagfautprd.onmicrosoft.com/b2c_1a_dups_signindynamicmfa/o…"

ZAP reports this as a Medium risk issue, recommending that a Content-Security-Policy header be included in the response.

However, since this endpoint is hosted under b2clogin.com (Microsoft-owned), we do not have control over its HTTP response headers.

Our application itself already includes a proper CSP header in all responses.

We would like to confirm the following points:

1)Is it expected that Microsoft’s Azure AD B2C authorize endpoint does not include a CSP header in its responses?

2)Is there any supported configuration in Azure AD B2C that allows us to add or customize response headers (like CSP) for the /authorize endpoint or login pages?

3)From a security compliance standpoint, can we safely mark this finding as “third-party managed” since the response originates from Microsoft’s B2C login domain, not our own?

4)Are there any official Microsoft statements or documentation confirming that we cannot modify CSP headers for the /authorize or token endpoints?

We use the following authentication flow:

Application: ASP.NET (C#)

Identity: Azure AD B2C

Protocol: OpenID Connect (/authorize → /token → redirect back to our app)

The CSP header is already added to all responses from our own app using <customHeaders> in Web.config.

Thank you in advance for clarifying whether this ZAP finding applies to us.