Friday, 10 July 2026

Conditional Access Custom Controls retirement makes External MFA migration the top Entra priority

Microsoft Entra ID administrators received a retirement notice requiring Conditional Access policies that use Custom Controls to move to External MFA by September 2026; Custom Controls are scheduled to retire by May 2027. The period also brings changed first-factor authentication behavior for Microsoft-managed tenants and an upcoming general-availability capability for managing Dynamics 365 Contact Center users through Entra security groups. An accompanying Learn-page update supports the migration guidance, but its supplied summary does not establish a separate product change.

• Entra ID · Conditional Access

  Retirement: Custom Controls replaced by External MFA in Conditional Access

  Microsoft Entra ID is retiring Custom Controls in Conditional Access by May 2027. External MFA is the stated replacement for standardized third-party MFA integration, and administrators must migrate affected policies by September 2026 to maintain support.

• Entra ID · Authentication

  Changed behavior: system-preferred authentication now applies to first-factor sign-in

  For tenants in the Microsoft managed state, system-preferred authentication now applies to first-factor authentication and selects the most secure registered method. Rollout starts in late June 2026; tenants can keep or change the setting and should update user guidance.

• Entra ID · Security

  Upcoming GA: Entra security groups can manage Dynamics 365 Contact Center users

  A new capability will allow user management in Dynamics 365 Contact Center through Microsoft Entra security groups. The message states that the capability will reach general availability on July 24, 2026, so this is an upcoming GA milestone rather than a launch on July 10.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.