The Clock on Entra Custom Controls Runs Out This Month
Custom controls in Entra Conditional Access stop accepting new edits this month, with full retirement in early 2027. Here is what MSPs need to check across their customer tenants before the freeze hits.
The freeze is closer than it looks
If any of your customer tenants still route multifactor authentication through a third party provider wired into Conditional Access using a custom control, the clock is almost out. Starting in September 2026, admins can no longer create new custom controls or edit existing ones. Full retirement follows in early 2027.
Custom controls were always a workaround. They do not satisfy Conditional Access's native Require multifactor authentication grant, they do not show up correctly as MFA in sign-in logs, and they are not compatible with Privileged Identity Management, risk based Conditional Access, or Intune device registration flows. External MFA, now generally available, fixes all of that with a standards based integration that plugs third party MFA providers directly into the native MFA grant.
Migrating before the freeze
The path is well documented: audit which policies reference a custom control, register the external MFA provider with its app ID, client ID, and discovery endpoint, pilot with a test group in report only mode, then roll out phase by phase before disabling, and eventually deleting, the old policy.
- Confirm whether any Conditional Access policy in each tenant still references a custom control
- If a tenant needs changes to that policy, make them now, since edits will not be possible after the freeze
- Start the external MFA pilot in parallel rather than waiting until the deadline forces the issue
Across a multi-tenant book of business
Custom control usage tends to be inconsistent across a customer base. Some tenants were configured years ago with a provider nobody currently supports, and it is easy to lose track of exactly which ones still depend on it. The freeze date is the same for every tenant you manage, but the amount of migration work behind it almost certainly is not.
Have you checked which of your customers are still depending on a policy you will not be able to touch in a few weeks?