Microsoft Entra ID: Retirement of Custom Controls in Conditional Access and migration to External MFA

[What and Why]

Microsoft Entra ID is retiring Custom Controls in Conditional Access and replacing them with External MFA, a generally available, standards-based integration for third-party multifactor authentication (MFA) providers.

External MFA provides a more modern, supported, and standardized authentication experience while enabling organizations to continue using approved third-party MFA solutions with Conditional Access policies. This change helps improve long-term supportability, security, and interoperability.

[Rollout Schedule]

Key dates:

• September 2026: Administrators will no longer be able to create new Custom Controls or modify existing Custom Controls in Conditional Access policies.
• May 2027: Custom Controls will be fully retired and no longer supported.

[Impact on Your Organization]

Who is affected

• Organizations currently using Custom Controls in Microsoft Entra Conditional Access policies.
• Administrators responsible for Microsoft Entra ID and Conditional Access management.
• Organizations not using Custom Controls are not affected and do not need to take action.

Platforms/Services

• Microsoft Entra ID
• Conditional Access
• Third-party MFA providers integrated with Microsoft Entra ID

What will happen

• Existing Custom Controls will continue to function until retirement in May 2027.
• Beginning in September 2026, administrators will no longer be able to create new Custom Controls or modify existing Custom Controls.
• After retirement in May 2027, Custom Controls will no longer be supported.
• Organizations using Custom Controls must migrate affected Conditional Access policies to External MFA before retirement.
• No impact is expected for organizations that do not use Custom Controls.

[Action Required]

If your organization uses Custom Controls, action is required before May 2027.

Recommended actions:

• Review your Conditional Access policies and identify any policies that use Custom Controls.
• Configure your third-party MFA provider as an External Authentication Method.
• Update affected Conditional Access policies to use the standard Require multifactor authentication grant control.
• Validate authentication flows and confirm successful migration to External MFA.
• Remove all Custom Control references after migration is complete.
• Review the migration guidance: Migrate from custom controls to external multifactor authentication

Consider communicating this change to your identity, security, and help desk teams to ensure migration activities are completed before the retirement date.

Learn more: Migrate from custom controls to external multifactor authentication | Conditional Access | Microsoft Entra ID | Microsoft Entra | Microsoft Learn

[Compliance Considerations]