Microsoft Entra ID Adds External MFA Integration via OpenID Connect

Microsoft has made external multi-factor authentication (MFA) generally available in Microsoft Entra ID, allowing organizations to integrate trusted third-party MFA providers directly into the identity platform while keeping Conditional Access, real-time risk evaluation, and session controls enforced centrally in Entra ID. The feature is built on OpenID Connect (OIDC) and lets administrators manage both native and external MFA methods through Entra ID’s authentication methods policy, including assigning them to specific user groups.

Microsoft said the capability is aimed at enterprises with regulatory, business, or merger-related requirements that need a consistent MFA approach across fragmented environments. The company also said the new framework will replace Entra ID Custom Controls, which are scheduled for deprecation on September 30, 2026; existing configurations will continue to work during a migration period, and Microsoft plans to publish migration guidance before retirement. Microsoft warned that sign-in frequency and session settings should be tuned carefully, noting that excessive reauthentication can increase phishing risk.