diff --git a/apps/acls/migrations/0002_auto_20210926_1047.py b/apps/acls/migrations/0002_auto_20210926_1047.py
index 45171a5f7..53ab54711 100644
--- a/apps/acls/migrations/0002_auto_20210926_1047.py
+++ b/apps/acls/migrations/0002_auto_20210926_1047.py
@@ -76,12 +76,12 @@ class Migration(migrations.Migration):
             field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE,
                                     related_name='login_acls', to=settings.AUTH_USER_MODEL, verbose_name='User'),
         ),
-        migrations.RunPython(migrate_login_confirm),
         migrations.AddField(
             model_name='loginacl',
             name='rules',
             field=models.JSONField(default=dict, verbose_name='Rule'),
         ),
+        migrations.RunPython(migrate_login_confirm),
         migrations.RunPython(migrate_ip_group),
         migrations.RemoveField(
             model_name='loginacl',
diff --git a/apps/acls/serializers/login_acl.py b/apps/acls/serializers/login_acl.py
index 47b909ad7..cf40e078b 100644
--- a/apps/acls/serializers/login_acl.py
+++ b/apps/acls/serializers/login_acl.py
@@ -35,6 +35,20 @@ class LoginACLSerializer(BulkModelSerializer):
             "reviewers": {'allow_null': False, 'required': True},
         }
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.set_action_choices()
+
+    def set_action_choices(self):
+        from xpack.plugins.license.models import License
+        action = self.fields.get('action')
+        if not action:
+            return
+        choices = action._choices
+        if not License.has_valid_license():
+            choices.pop(LoginACL.ActionChoices.confirm, None)
+        action._choices = choices
+
     def get_rules_serializer(self):
         return RuleSerializer()