Microsoft Entra External ID utilizes a Monthly Active Users (MAU) billing model to license guest users for premium capabilities, replacing the legacy 1:5 ratio. A guest is only counted as “active” (and thus counts toward the billing limits) if they successfully authenticate to your tenant within a calendar month; invited guests who never sign in cost $0.
In managed environments, linking an Azure subscription to your directory is the necessary step to activate this model, which unlocks Entra ID P1 and P2 features—such as Conditional Access—for external identities. With the Microsoft Entra admin center, you can initialize this billing connection centrally. This guide walks through linking a subscription to enable guest licensing.
Why Enable Guest Licensing (MAU)?
Controlling the MAU billing link at the tenant level helps with:
- Premium feature access: It allows you to enforce advanced security controls, like Conditional Access policies and Risk-Based Conditional Access (Identity Protection), on your B2B guest users.
- Cost efficiency: The MAU model provides the first 50,000 guest user authentications per month for free, significantly reducing the overhead of secure B2B collaboration.
- Scalable collaboration: Without linking a subscription, guest users cannot natively utilize Entra ID Premium features, leaving a significant security gap when external partners access your internal corporate resources.
Important Licensing Note for Business Premium
Microsoft 365 Business Premium includes Microsoft Entra ID P1 licenses for your internal users. This means you already have the foundation needed to enable premium features for guest users.
Technical Requirement: To unlock the MAU billing model, the tenant must have at least one active Entra ID P1 or P2 license assigned to any user (internal or guest). Business Premium satisfies this requirement.
However, as of January 30, 2026, Microsoft requires all tenants to have a linked Azure subscription to continue using Identity Governance features for guest users. This guide walks you through that requirement.
What You’ll Configure
You will access the Microsoft Entra admin center to navigate to the External Identities settings and link an active Azure subscription to your directory. Note: This process does not assign individual licenses to guests, but rather activates the tenant-wide MAU billing engine.
Before You Begin: Prerequisites
To complete this configuration, you need:
- Global Administrator role in Microsoft Entra ID – to access the External Identities settings.
- Contributor or Owner role on an active Azure subscription within the same tenant – to link it to your directory. If you do not have an Azure subscription, you can create a free one.
- A credit card on file for the Azure subscription – because even though guest licensing has a generous free tier, Microsoft requires a payment method for billing purposes.
- The Azure subscription must be associated with the same Microsoft Entra directory (tenant) as your Microsoft 365 Business Premium subscription.
Note for administrators new to Azure billing: If you do not have an Azure subscription, you can create a free Pay-As-You-Go account at portal.azure.com. The free account includes an initial credit that will easily cover any minimal costs, and the MAU free tier means most small businesses will never be charged.
Step 1: Access External Identities
- Navigate to the Microsoft Entra admin center and log in with your Global Administrator account.
- Crucial: Ensure you are in the correct tenant. Click the Settings (gear) icon in the top toolbar, select Directories + subscriptions, find your target workforce tenant in the list, and click Switch. (Admins often fail to link the subscription because they are signed into their personal Azure tenant instead of the customer’s M365 tenant).
- On the left navigation pane, go to Identity → External Identities → Overview.
- Under the Subscriptions section, select Linked subscriptions.
Step 2: Link an Azure Subscription
- On the Linked subscriptions page, check the box next to your tenant name.
- Click the Link subscription button at the top of the pane.
- In the flyout menu, use the drop-down to select your target Subscription.
- Select your target Resource group. (If you do not have a resource group, create a basic one in the Azure portal first, as this pane requires an existing group to bind the billing).
- Click Apply to bind the MAU billing model to your Entra ID tenant.
Step 3: Verify the Configuration
- Allow a few moments for the provisioning process to complete, then refresh the Linked subscriptions page.
- Verify that the Status column next to your tenant now displays as Linked.
- (Optional) Navigate to the Azure portal (portal.azure.com), open your selected subscription, and verify under Resource providers that Microsoft.AzureActiveDirectory is registered. This is usually done automatically but is worth checking if you encounter issues.
Propagation Note: After linking your subscription, it can take up to 24 hours for the MAU billing model to fully apply across all services. If you create a Conditional Access policy targeting guest users immediately after linking and it does not work, wait a few hours and test again.
What This Unlocks for You (Business Premium)
After linking your subscription, here is what becomes available for your B2B guest users:
| Capability | Available for Guest Users? | Notes |
| Conditional Access policies | ✅ Yes, without per-guest licenses | You can enforce MFA, block legacy authentication, and require compliant devices. |
| Entra ID P1 features (e.g., dynamic groups, self-service password reset) | ✅ Yes, covered by MAU billing | Guest users inherit P1 capabilities without needing individual licenses. |
| Entra ID Governance features (e.g., access reviews, entitlement management) | ✅ Yes, with linked subscription | As of January 2026, this requires linking an Azure subscription. |
| MAU free tier (first 50,000 active guests per month) | ✅ Included | You will not be billed for guest usage until you exceed 50,000 monthly active users. |
| Microsoft 365 services (Exchange mailbox, OneDrive, Office apps) | ❌ Not for guest users | Guest accounts cannot reliably use Microsoft 365 licenses for services like Outlook mailboxes or Office desktop app activation. |
Cost Expectations for Business Premium
| Scenario | Expected Cost |
| You have fewer than 50,000 guest user authentications per month | $0 (covered by free tier) |
| You exceed 50,000 guest MAU in a month | Billed at standard MAU rates. Action: Set up an Azure Budget Alert in the Azure portal to prevent unexpected charges. |
| You link a subscription but never invite any guests | $0 (no usage, no charges) |
Common Questions from Administrators
Q1: Do I need to assign an Entra ID P1 license to every guest user?
A: No. With the MAU billing model, you do not need to assign a separate P1 license to each guest user. Having at least one P1 license for your internal users (which Business Premium provides) is sufficient while utilizing MAU billing for guest users.
Q2: What happens if I do NOT link a subscription?
A: Your tenant can still invite guest users, but they will not have access to premium Entra ID features like Conditional Access or Identity Protection. Additionally, as of January 30, 2026, Identity Governance features for guest users will stop working.
Q3: Can I link any Azure subscription?
A: It must be an active subscription within the same tenant as your Microsoft 365 Business Premium subscription. Pay-as-you-go subscriptions work fine.
Q4: Will I be billed for guests who never sign in?
A: No. MAU billing only counts users who actively authenticate to your tenant within a calendar month. Invited guests who never accept the invitation or never sign in are not billed.
Wrap-Up
You can enable modern guest licensing for your Microsoft 365 tenant by accessing the External Identities module in Entra ID and linking an Azure subscription to activate MAU billing. Ensure you hold both Global Administrator rights and Azure subscription Contributor rights before starting. Use this configuration to securely scale your B2B collaboration, providing the essential licensing framework required to enforce strict identity governance and conditional access on all external users. And remember, the free tier covers the first 50,000 monthly active guests – so for most small businesses, this costs nothing.
