Conditional Access Custom Controls to Retire in 2027—Act Now

Custom controls, a feature of Entra ID used by a narrow segment of customers to integrate third-party multifactor authentication (MFA) providers into Entra ID, are deprecated as of Oct. 2026 and will be retired in May 2027. This change requires immediate migration work for affected organizations, while those not using custom controls have no action necessary. Custom controls allowed customers to integrate their third-party MFA providers external to Microsoft—such as RSA’s Cloud Authentication Service—into Entra ID. This allowed an organization’s users to meet MFA requirements defined as a part of conditional access within Entra ID, while using a third-party MFA provider that might offer different or additional benefits that customers required. However, custom controls as originally designed are being deprecated and should be replaced as soon as possible with Entra external MFA. The new Entra external MFA approach was designed to offer an even more comprehensive approach to integration of an external MFA provider into Entra ID’s conditional access flow.