Microsoft Entra ID: Retirement of Custom Controls in Conditional Access and migration to External MFA

Microsoft Entra ID is retiring Custom Controls in Conditional Access by May 2027, replacing them with External MFA for standardized third-party MFA integration. Administrators must migrate policies by September 2026, updating Conditional Access to use External MFA to ensure continued support and security. What and Why Microsoft Entra ID is retiring Custom Controls in Conditional Access and replacing them with External MFA, a generally available, standards-based integration for third-party multifactor authentication (MFA) providers. External MFA provides a more modern, supported, and standardized authentication experience while enabling organizations to continue using approved third-party MFA solutions with Conditional Access policies. This change helps improve long-term supportability, security, and interoperability. Rollout Schedule Key dates: September 2026: Administrators will no longer be able to create new Custom Controls or modify existing Custom Controls in Conditional Access policies. May 2027: Custom Controls will be fully retired and no longer supported. Impact on Your Organization Who is affected Organizations currently using Custom Controls in Microsoft Entra Conditional Access policies. Administrators responsible for Microsoft Entra ID and Conditional Access management. Organizations not using Custom Controls are not affected and do not need to take action. Platforms/Services Microsoft Entra ID Conditional Access Third-party MFA providers integrated with Microsoft Entra ID What will happen Existing Custom Controls will continue to function until retirement in May 2027. Beginning in September 2026, administrators will no longer be able to create new Custom Controls or modify existing Custom Controls. After retirement in May 2027, Custom Controls will no longer be supported. Organizations using Custom Controls must migrate affected Conditional Access policies to External MFA before retirement. No impact is expected for organizations that do not use Custom Controls. Action Required If your organization uses Custom Controls, action is required before May 2027. Recommended actions: Review your Conditional Access policies and identify any policies that use Custom Controls. Configure your third-party MFA provider as an External Authentication Method. Update affected Conditional Access policies to use the standard Require multifactor authentication grant control. Validate authentication flows and confirm successful migration to External MFA. Remove all Custom Control references after migration is complete. Review the […]

The post Microsoft Entra ID: Retirement of Custom Controls in Conditional Access and migration to External MFA appeared first on M365 Admin.