diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/TenantDiscoveryResponse.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/TenantDiscoveryResponse.java
index 947193f99d..af9e933788 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/TenantDiscoveryResponse.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/TenantDiscoveryResponse.java
@@ -26,8 +26,29 @@ public class TenantDiscoveryResponse {
     @JsonProperty("tenant_id")
     private String tenantId;
 
+    @JsonProperty("tenant_name")
+    private String tenantName;
+
     private String domain;
 
+    /**
+     * @deprecated Superseded by {@link #openframeLoginEnabled} and {@link #customProviders}: this
+     * list mixes the tenant's own apps, system defaults and the built-in login, so the login form
+     * can't tell which buttons are the tenant's. Kept while the web frontend and the app shell
+     * still read it.
+     * TODO(CU-17tkuw5x9mz): remove once both are migrated.
+     */
+    @Deprecated
     @JsonProperty("auth_providers")
     private List<String> authProviders;
+
+    @JsonProperty("openframe_login_enabled")
+    private Boolean openframeLoginEnabled;
+
+    /**
+     * Providers the tenant configured with its own app (e.g. google, microsoft), without the
+     * system defaults that {@link #authProviders} also includes.
+     */
+    @JsonProperty("custom_providers")
+    private List<String> customProviders;
 }
\ No newline at end of file
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SSOConfigService.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SSOConfigService.java
index a740f335f6..b722bbd438 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SSOConfigService.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SSOConfigService.java
@@ -80,6 +80,18 @@ public List<String> getEffectiveProvidersForTenant(String tenantId) {
         return List.copyOf(result);
     }
 
+    /**
+     * Providers the tenant configured with its own app — active per-tenant configs only, no
+     * defaults and no built-in login toggle.
+     */
+    public List<String> getCustomProvidersForTenant(String tenantId) {
+        return getActiveForTenant(tenantId).stream()
+                .map(cfg -> cfg.getProvider().toLowerCase(Locale.ROOT))
+                .filter(provider -> !SSOConfig.OPENFRAME_PROVIDER.equals(provider))
+                .distinct()
+                .toList();
+    }
+
     /**
      * Whether the built-in OpenFrame (password) login is enabled for the tenant. Controlled by a
      * pseudo-provider document ({@link SSOConfig#OPENFRAME_PROVIDER}) in {@code sso_configs};
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/tenant/TenantDiscoveryService.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/tenant/TenantDiscoveryService.java
index 2372dffea1..d048647fbd 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/tenant/TenantDiscoveryService.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/tenant/TenantDiscoveryService.java
@@ -78,12 +78,16 @@ private Optional<Tenant> resolveActiveTenant(String tenantId) {
     }
 
     private TenantDiscoveryResponse tenantFound(String email, Tenant tenant) {
+        boolean openframeLoginEnabled = ssoConfigService.isOpenframeLoginEnabled(tenant.getId());
         return TenantDiscoveryResponse.builder()
                 .email(email)
                 .hasExistingAccounts(true)
                 .tenantId(tenant.getId())
+                .tenantName(tenant.getName())
                 .domain(tenant.getDomain())
-                .authProviders(availableAuthProviders(tenant))
+                .authProviders(availableAuthProviders(tenant, openframeLoginEnabled))
+                .openframeLoginEnabled(openframeLoginEnabled)
+                .customProviders(ssoConfigService.getCustomProvidersForTenant(tenant.getId()))
                 .build();
     }
 
@@ -94,9 +98,9 @@ private TenantDiscoveryResponse noAccounts(String email) {
                 .build();
     }
 
-    private List<String> availableAuthProviders(Tenant tenant) {
+    private List<String> availableAuthProviders(Tenant tenant, boolean openframeLoginEnabled) {
         List<String> providers = new ArrayList<>(ssoConfigService.getEffectiveProvidersForTenant(tenant.getId()));
-        if (ssoConfigService.isOpenframeLoginEnabled(tenant.getId())) {
+        if (openframeLoginEnabled) {
             providers.add(OPENFRAME_PROVIDER);
         }
         return providers.stream()