diff --git a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
index c68b5ca257..e37cb1e9c6 100644
--- a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
+++ b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
@@ -34,6 +34,7 @@ const SiteTopNav = ({
     isGlobalMaintainer,
     isAnyTeamMaintainer,
     isNoAccess,
+    isMdmEnabled,
   } = useContext(AppContext);
 
   const renderNavItem = (navItem: INavItem) => {
@@ -97,7 +98,8 @@ const SiteTopNav = ({
     isAnyTeamAdmin,
     isAnyTeamMaintainer,
     isGlobalMaintainer,
-    isNoAccess
+    isNoAccess,
+    isMdmEnabled
   );
 
   const renderNavItems = () => {
diff --git a/frontend/components/top_nav/SiteTopNav/navItems.ts b/frontend/components/top_nav/SiteTopNav/navItems.ts
index db86550905..34c2108107 100644
--- a/frontend/components/top_nav/SiteTopNav/navItems.ts
+++ b/frontend/components/top_nav/SiteTopNav/navItems.ts
@@ -20,7 +20,8 @@ export default (
   isAnyTeamAdmin = false,
   isAnyTeamMaintainer = false,
   isGlobalMaintainer = false,
-  isNoAccess = false
+  isNoAccess = false,
+  isMdmEnabled = false
 ): INavItem[] => {
   if (!user) {
     return [];
@@ -59,7 +60,7 @@ export default (
         regex: new RegExp(`^${URL_PREFIX}/controls/`),
         pathname: PATHS.CONTROLS,
       },
-      exclude: !isMaintainerOrAdmin,
+      exclude: !isMaintainerOrAdmin || !isMdmEnabled,
     },
     {
       name: "Software",
diff --git a/frontend/router/components/MdmEnabledRoutes/MdmEnabledRoutes.tsx b/frontend/router/components/MdmEnabledRoutes/MdmEnabledRoutes.tsx
new file mode 100644
index 0000000000..bdd485800a
--- /dev/null
+++ b/frontend/router/components/MdmEnabledRoutes/MdmEnabledRoutes.tsx
@@ -0,0 +1,20 @@
+import React, { useContext } from "react";
+import { useErrorHandler } from "react-error-boundary";
+import { AppContext } from "context/app";
+
+interface IMdmEnabledRoutesProps {
+  children: JSX.Element;
+}
+
+const MdmEnabledRoutes = ({ children }: IMdmEnabledRoutesProps) => {
+  const handlePageError = useErrorHandler();
+  const { isMdmEnabled } = useContext(AppContext);
+
+  if (!isMdmEnabled) {
+    handlePageError({ status: 404 });
+    return null;
+  }
+  return <>{children}</>;
+};
+
+export default MdmEnabledRoutes;
diff --git a/frontend/router/components/MdmEnabledRoutes/index.ts b/frontend/router/components/MdmEnabledRoutes/index.ts
new file mode 100644
index 0000000000..7676b4892f
--- /dev/null
+++ b/frontend/router/components/MdmEnabledRoutes/index.ts
@@ -0,0 +1 @@
+export { default } from "./MdmEnabledRoutes";
diff --git a/frontend/router/index.tsx b/frontend/router/index.tsx
index 8ff6f07486..6a58d7e3be 100644
--- a/frontend/router/index.tsx
+++ b/frontend/router/index.tsx
@@ -60,6 +60,7 @@ import UnauthenticatedRoutes from "./components/UnauthenticatedRoutes";
 import AuthGlobalAdminMaintainerRoutes from "./components/AuthGlobalAdminMaintainerRoutes";
 import AuthAnyMaintainerAnyAdminRoutes from "./components/AuthAnyMaintainerAnyAdminRoutes";
 import PremiumRoutes from "./components/PremiumRoutes";
+import MdmEnabledRoutes from "./components/MdmEnabledRoutes/MdmEnabledRoutes";
 
 interface IAppWrapperProps {
   children: JSX.Element;
@@ -170,10 +171,12 @@ const routes = (
           </Route>
 
           <Route path="controls" component={AuthAnyMaintainerAnyAdminRoutes}>
-            <IndexRedirect to={"mac-os-updates"} />
-            <Route component={ManageControlsPage}>
-              <Route path="mac-os-updates" component={MacOSUpdates} />
-              <Route path="mac-settings" component={MacSettingsPage} />
+            <Route component={MdmEnabledRoutes}>
+              <IndexRedirect to={"mac-os-updates"} />
+              <Route component={ManageControlsPage}>
+                <Route path="mac-os-updates" component={MacOSUpdates} />
+                <Route path="mac-settings" component={MacSettingsPage} />
+              </Route>
             </Route>
           </Route>