diff --git a/keystone/common/config.py b/keystone/common/config.py
index 21ca0a5809..903625daa6 100644
--- a/keystone/common/config.py
+++ b/keystone/common/config.py
@@ -489,6 +489,7 @@ FILE_OPTIONS = {
     'endpoint_policy': [
         cfg.BoolOpt('enabled',
                     default=True,
+                    deprecated_for_removal=True,
                     help='Enable endpoint_policy functionality.'),
         cfg.StrOpt('driver',
                    default='sql',
diff --git a/releasenotes/notes/deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml b/releasenotes/notes/deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml
new file mode 100644
index 0000000000..f36945365a
--- /dev/null
+++ b/releasenotes/notes/deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml
@@ -0,0 +1,4 @@
+---
+other:
+  - Deprecate the ``enabled`` option from ``[endpoint_policy]``, it will be
+    removed in the 'O' release, and the extension will always be enabled.