diff --git a/src/applications/auth/controller/config/PhabricatorAuthEditController.php b/src/applications/auth/controller/config/PhabricatorAuthEditController.php
--- a/src/applications/auth/controller/config/PhabricatorAuthEditController.php
+++ b/src/applications/auth/controller/config/PhabricatorAuthEditController.php
@@ -11,6 +11,32 @@
     $provider_class = $request->getStr('provider');
     $config_id = $request->getURIData('id');
 
+
+    $locked_config_key = 'auth.lock-config';
+    $is_locked = PhabricatorEnv::getEnvConfig($locked_config_key);
+
+    if ($is_locked) {
+      $message = pht(
+        'Authentication provider configuration is locked, and can not be '.
+        'changed without being unlocked. See the configuration setting %s '.
+        'for details.',
+        phutil_tag(
+          'a',
+          array(
+            'href' => '/config/edit/'.$locked_config_key,
+          ),
+          $locked_config_key));
+
+      $dialog = id(new AphrontDialogView())
+        ->setUser($viewer)
+        ->setMethod('GET')
+        ->setTitle(pht('Authentication Config Locked'))
+        ->appendChild($message)
+        ->addCancelButton($this->getApplicationURI());
+
+      return id(new AphrontDialogResponse())->setDialog($dialog);
+    }
+
     if ($config_id) {
       $config = id(new PhabricatorAuthProviderConfigQuery())
         ->setViewer($viewer)
diff --git a/src/applications/auth/controller/config/PhabricatorAuthNewController.php b/src/applications/auth/controller/config/PhabricatorAuthNewController.php
--- a/src/applications/auth/controller/config/PhabricatorAuthNewController.php
+++ b/src/applications/auth/controller/config/PhabricatorAuthNewController.php
@@ -9,6 +9,30 @@
 
     $viewer = $this->getViewer();
     $cancel_uri = $this->getApplicationURI();
+    $locked_config_key = 'auth.lock-config';
+    $is_locked = PhabricatorEnv::getEnvConfig($locked_config_key);
+
+    if ($is_locked) {
+      $message = pht(
+        'Authentication provider configuration is locked, and can not be '.
+        'changed without being unlocked. See the configuration setting %s '.
+        'for details.',
+        phutil_tag(
+          'a',
+          array(
+            'href' => '/config/edit/'.$locked_config_key,
+          ),
+          $locked_config_key));
+
+      $dialog = id(new AphrontDialogView())
+        ->setUser($viewer)
+        ->setMethod('GET')
+        ->setTitle(pht('Authentication Config Locked'))
+        ->appendChild($message)
+        ->addCancelButton($cancel_uri);
+
+      return id(new AphrontDialogResponse())->setDialog($dialog);
+    }
 
     $providers = PhabricatorAuthProvider::getAllBaseProviders();