Identity management evolves rapidly across modern cloud ecosystems. Consequently, system administrators must constantly adapt to new security frameworks. Recently, Microsoft announced a critical update regarding its cloud identity platform. The tech giant is officially deprecating custom controls inside Microsoft Entra ID (formerly Azure Active Directory).
For years, organizations used custom controls to connect third-party identity providers to Conditional Access policies. However, modern cybersecurity demands more robust and seamless integrations. Therefore, Microsoft introduced External Authentication Methods (EAM) as the modern replacement. This transition represents a major step forward for enterprise security architectures. However, administrators must act quickly to avoid authentication failures.
Understanding the Sunset: Why Custom Controls Are Leaving
Custom controls originally allowed organizations to redirect authentication flows to external providers. For example, users could authenticate using Duo Security, RSA SecurID, or Symantec VIP. Consequently, admins enforced secondary authentication outside the native Microsoft ecosystem.
However, custom controls suffered from critical technical limitations. First, they relied on legacy JSON definitions and standard web redirects. Second, Microsoft Entra ID could not verify the exact strength of the external MFA authentication. Instead, the system simply trusted that the external vendor performed the check.
Furthermore, custom controls never supported mobile application access properly. Consequently, users experienced broken authentication loops on iOS and Android devices. Moreover, custom controls failed to satisfy modern Zero Trust security principles. As a result, Microsoft built a superior framework from the ground up.
The Rise of External Authentication Methods (EAM)
Microsoft developed External Authentication Methods to fix these architectural flaws. Now, EAM offers a native, deeply integrated bridge between Entra ID and external Identity Providers.
Unlike legacy controls, EAM uses open standards like OAuth 2.0 and OpenID Connect. Therefore, the authentication process remains completely secure and transparent. Additionally, Entra ID can now evaluate the real-time status of the authentication event.
Here are the key technical advantages of EAM:
- Native Policy Integration: EAM integrates directly with Entra authentication strength policies.
- Enhanced User Experience: Users encounter fewer redirects and experience smoother logins across all web devices.
- Full Mobile Support: EAM works seamlessly across desktop browsers, native desktop apps, and mobile operating systems.
- Detailed Auditing: Sign-in logs now display full cryptographic context for external authentication events.
- FIDO2 and Passkey Compatibility: Organizations can easily implement phishing-resistant credentials through external partners.
To learn more about the underlying architecture of EAM, check out the official Microsoft Entra EAM Documentation.
Step-by-Step Migration Strategy for IT Administrators
Migrating away from legacy controls requires careful planning. Otherwise, your users might lose access to critical corporate resources. Fortunately, Microsoft provides a clear path for adopting EAM.
Follow this streamlined migration plan to ensure a smooth transition:
- Audit Existing Policies: First, identify all Conditional Access policies currently enforcing custom controls.
- Register the EAM Provider: Next, set up your vendor app registration within the Entra Admin Center.
- Configure Authentication Strengths: Then, add your new EAM provider into your Entra authentication strength definitions.
- Update Access Policies: Subsequently, swap out legacy controls for the new EAM requirement in your active policies.
- Test Thoroughly: Finally, validate the sign-in experience with a pilot user group before full deployment.
💡 PRO-TIP: Always create a backup emergency access account (break-glass account) before modifying core authentication policies. Exclude this account from external MFA dependencies to prevent complete tenant lockouts!
For detailed guidelines on managing administrative access, review the CISA Identity Management Guidelines for enterprise networks.
Managing Third-Party Integrations: Okta, Duo, and RSA
Many enterprise environments rely on third-party vendors for multi-factor authentication. Fortunately, major vendors already built ready-to-use EAM integration templates.
For instance, Cisco Duo published comprehensive technical guides for this exact transition. Similarly, Okta offers seamless EAM bindings for its customer base.
However, administrators must manually reconfigure their app registrations. You cannot simply flip a single global switch. Therefore, schedule dedicated maintenance windows for each third-party tool.
Check the Duo Security Migration Portal or the Okta Identity Cloud Center to download specific integration manifests for Microsoft Entra ID.
⚠️ WARNING: Do not wait until the final retirement deadline to begin your EAM migration! Once Microsoft disables custom controls completely, affected users will immediately fail Conditional Access checks.
Impact on Zero Trust Architecture and Compliance
Modern cybersecurity frameworks demand continuous access evaluation. Consequently, organizations running legacy setups risk non-compliance with international standards.
By replacing custom controls with EAM, your organization strengthens its alignment with National Institute of Standards and Technology policies. You can read more about these standards on the official NIST Computer Security Resource Center.
Specifically, EAM provides the precise cryptographic proof required for high-assurance compliance. Furthermore, security operations center (SOC) teams gain immediate visibility into external authentication factors. Consequently, incident response teams can investigate compromised sessions much faster.
Final Thoughts and Next Steps
Microsoft’s decision to sunset custom controls marks a necessary step forward. While migrations require effort, the security benefits far outweigh the temporary operational overhead. By adopting External Authentication Methods, your enterprise gains stronger protocol security, superior mobile support, and complete audit visibility.
Take control of your tenant security today. Audit your policies, test your EAM configurations, and protect your enterprise from unexpected access disruptions.
What Is Your Take?
Have you started migrating your Conditional Access policies to EAM yet? What challenges have you encountered with third-party providers? Join the conversation in the comments below! If you found this article helpful, please share it with your fellow sysadmins on LinkedIn and Twitter.