Blog Post

Microsoft Entra Blog
3 MIN READ

Updates and billing guidance for guest governance

kamurphy's avatar
kamurphy
Icon for Microsoft rankMicrosoft
Dec 20, 2024

Important updates on feature launch timing and billing details for Microsoft Entra ID Governance for guests.

Were excited to provide an update on timing and billing clarifications for the Microsoft Entra ID Governance for guests add-on, following up on our previous blog post about Microsoft Entra ID Governance licensing clarifications.

Timing update 

Were pleased to announce that the general availability for the ID Governance for guests add-on is now scheduled for the second quarter of 2025. This timeline allows us to ensure a smooth and seamless rollout for all our customers. 

Billing clarity 

We previously have highlighted that ID Governance for guests will be billed at $0.75 per monthly governed identity. To provide additional clarity on billing, we want to highlight a few key points: 

  • Only features specific to Microsoft Entra ID Governance are eligible to be billed through the ID Governance for guests add-on. Governance features included in P2 will not be billed. Visit Microsoft Entra ID Governance licensing fundamentals - Microsoft Entra ID Governance | Microsoft Learn for a list of features by product.
  • Only users with a UserType of Guest are in scope to be billed.
  • Billing is consumptive and is charged based on usage every month. A single guest user identity that has a governance action applied in any month will only incur one $0.75 charge each month, regardless of the number of governance actions performed for that user in that month.

Examples 

Scenario 1: Automating access package assignments 

March: 

  • Contoso creates an auto-assignment policy that assigns an access package to 500 guest users.
  • Contoso IT runs the guest conversion API for another set of 500 guest users.
  • Billing: For March, Contoso is billed $750. This includes $375 for the auto-assignment policy (500 users x $0.75) and $375 for the guest conversion API (500 users x $0.75). 

April: 

  • The 500 guest users who were auto-assigned an access package in March retain their assignments but are not billed since there was not an explicit action taken on these users in April. Additionally, Contoso IT runs an inactive access review (AR) on 100 guests.
  • Billing: For April, Contoso is billed $75 for the inactive AR (100 users x $0.75). 

Scenario 2: Lifecycle workflow and access review for inactive users 

March: 

  • Fabrikam executes a lifecycle workflow for 300 guest users.
  • They also perform an access review for inactive users, targeting 100 of the same guests as above, plus a different set of 200 guests.
  • Billing: For March, Fabrikam is billed $375. This includes $225 for the lifecycle workflow (300 users x $0.75) and $150 for the access review (200 users x $0.75). Note that since 100 of the guest users already incurred a charge for the lifecycle workflow, they did not incur any additional charge for the inactive user review, since the maximum monthly charge per guest user is $0.75.

April: 

  • From the second group of 200 guest users in March, 150 guests receive an auto-assigned access package that grants access to an app and have the same inactive user access review that was run in March, repeated in April.
  • Billing: For April, Fabrikam is billed $112.50 for the access review (150 users x $0.75), and they are not charged for the access package auto-assignment action, since these 150 guests have already been charged for April.

Planning 

To prepare for the upcoming changes, we recommend checking out Identity Governance features that could involve guests, including: 

  • Auto-assigning policies in Entitlement Management
  • Entitlement management policies using custom extensions, Verified ID, or Lifecycle Workflows
  • Access reviews for user-to-group affiliation, inactive users, or PIM for groups 

Also, check out all the audit logs for these activities to find all guest users who have had governance actions taken.

We hope this update provides the clarity you need as we approach the launch of the ID Governance for guests add-on. While billing is not active yet, you can still use ID Governance for guests for free while its in public preview: https://aka.ms/IDGovernanceGuests  

 

Learn more about Microsoft Entra  

Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds. 

Updated Jan 15, 2025
Version 3.0
  • Can you fix the link in the "Billing clarity" section, it currently points to the review experience?

    Also, can you provide a comprehensive list of all actions/features that will result in charging the org? The licensing fundamentals article and the information you provided above is not sufficient. There are Microsoft Entra ID Governance specific features, such Insights and Reporting, that can potentially cover any and all users, every month. Please make it clear which actions are billable and which are not. 

    On the API front, what happens when a third-party app triggers a billable action against all your guest users in error or due to bad coding practices? And which API operations exactly are billable?