Microsoft Entra Conditional Access Custom Controls Are Retiring: Migrating to External MFA Before September 30, 2026

Microsoft is retiring Custom Controls in Microsoft Entra Conditional Access. Creating new Custom Controls or editing existing ones stops working starting September 30, 2026, with full end of life for anything still running on Custom Controls set for May 2027. If your organization uses a third-party MFA provider integrated into Conditional Access through a Custom Control, this is not a distant planning item, it is an active migration you need to start now. Here is what is actually changing, what replaces it, and how to migrate without breaking sign-in for your users.

What a Custom Control actually is, and why it is going away

Custom Controls let Conditional Access hand off the authentication decision to a third-party service outside Microsoft’s own MFA stack, commonly used by organizations standardized on a specific third-party MFA provider rather than Microsoft’s own methods. The mechanism relied on an older integration pattern that predates Microsoft’s current, standards-based approach to external authentication. Microsoft’s replacement, External MFA, is a generally available, standards-based integration built specifically to let approved third-party MFA providers plug into Conditional Access policies through a supported, modern path rather than the legacy Custom Controls mechanism.

The practical difference for admins: Custom Controls were somewhat ad hoc, provider-specific integrations. External MFA is a first-class, Microsoft-supported authentication method type, meaning it shows up alongside your other authentication methods in the Entra admin center rather than living as a special-case control bolted onto a Conditional Access policy.

The actual timeline

• Now through September 30, 2026: existing Custom Controls continue to function normally. You cannot create new ones after this date, and you cannot edit existing ones after this date either, meaning any change you need to make to a Custom-Control-based policy needs to happen before this cutoff or wait until you have migrated to External MFA.
• September 30, 2026 through May 2027: existing Custom Controls keep working as a bridge period, but they are frozen configuration, not something you can adjust.
• May 2027: Custom Controls stop working entirely. Any Conditional Access policy still depending on one will no longer enforce MFA the way it did, which is a real access-control gap, not just an inconvenience.

Migrating to External MFA, step by step

First, confirm your third-party MFA provider actually supports the External MFA integration. Check with your vendor directly, since not every provider that supported the old Custom Controls pattern has necessarily published an External MFA integration yet, this is the single most important thing to verify before doing anything else.

In the Microsoft Entra admin center:

1. Navigate to Protection → Authentication methods → Policies.
2. Look for your third-party provider under the External authentication methods section. If your provider has published an integration, it appears here as a configurable authentication method, not as a Conditional Access control.
3. Configure and enable the External MFA method for your provider, following your vendor’s specific setup documentation for the Entra integration (this step is genuinely vendor-specific, the general Microsoft-side steps are consistent but the provider-side app registration and configuration details are not).

Then, in your existing Conditional Access policies:

# List your current Conditional Access policies to identify which ones reference a Custom Control
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.GrantControls.CustomAuthenticationFactors -ne $null -or
    $_.GrantControls.BuiltInControls -contains "mfa"
} | Select-Object DisplayName, Id

For each affected policy, update the grant control from the Custom Control reference to require the newly configured External MFA authentication method instead. Test this change against a small pilot group first, a Conditional Access policy targeting a test group of a handful of accounts, before rolling it out organization-wide. Authentication policy changes that go wrong lock people out, not something you want discovered by your whole user base at once.

What happens if you do nothing

Between now and May 2027, nothing changes for you if you take no action, your existing Custom Controls keep working. The risk is entirely about what happens after May 2027: any policy still depending on a Custom Control silently stops enforcing that control. Depending on how your policy is structured, this could mean a Conditional Access policy that used to require MFA no longer effectively does, which is a significant, easy-to-miss security regression if nobody catches it before the cutoff.

Frequently asked questions

Do I need to migrate if my organization only uses Microsoft’s own MFA (Microsoft Authenticator, FIDO2 keys) rather than a third-party provider?
No. Custom Controls specifically exist to integrate third-party MFA providers into Conditional Access. If you are not using one, this retirement does not affect your policies at all, your built-in Microsoft authentication methods are unaffected.

My third-party MFA vendor has not published an External MFA integration yet. What are my options?
Contact your vendor directly and ask for their timeline, since External MFA has been generally available for a while now and any actively maintained MFA provider serving Entra ID customers should have a clear answer. If your vendor has no plan to support External MFA, you have two real options before May 2027: migrate to a provider that does support it, or migrate that use case to Microsoft’s own native authentication methods (Microsoft Authenticator, FIDO2, Windows Hello for Business) instead of a third-party provider.

Is this the same thing as the retirement of legacy per-user MFA?
No, these are two separate Microsoft deprecations. Per-user MFA (the legacy, account-level MFA toggle) is being retired in favor of the Authentication Methods Policy and Conditional Access-based enforcement generally. Custom Controls retirement specifically affects how third-party MFA providers plug into Conditional Access policies. An organization could be affected by one, both, or neither depending on how its MFA is currently configured, worth checking both separately rather than assuming they are the same change.