Important updates on feature launch timing and billing details for Microsoft Entra ID Governance for guests.
We’re excited to provide an update on timing and billing clarifications for the Microsoft Entra ID Governance for guests add-on, following up on our previous blog post about Microsoft Entra ID Governance licensing clarifications.
Timing update
We’re pleased to announce that the general availability for the ID Governance for guests add-on is now scheduled for the second quarter of 2025. This timeline allows us to ensure a smooth and seamless rollout for all our customers.
Billing clarity
We previously have highlighted that ID Governance for guests will be billed at $0.75 per monthly governed identity. To provide additional clarity on billing, we want to highlight a few key points:
- Only features specific to Microsoft Entra ID Governance are eligible to be billed through the ID Governance for guests add-on. Governance features included in P2 will not be billed. Visit Microsoft Entra ID Governance licensing fundamentals - Microsoft Entra ID Governance | Microsoft Learn for a list of features by product.
- Only users with a UserType of Guest are in scope to be billed.
- Billing is consumptive and is charged based on usage every month. A single guest user identity that has a governance action applied in any month will only incur one $0.75 charge each month, regardless of the number of governance actions performed for that user in that month.
Examples
Scenario 1: Automating access package assignments
March:
- Contoso creates an auto-assignment policy that assigns an access package to 500 guest users.
- Contoso IT runs the guest conversion API for another set of 500 guest users.
- Billing: For March, Contoso is billed $750. This includes $375 for the auto-assignment policy (500 users x $0.75) and $375 for the guest conversion API (500 users x $0.75).
April:
- The 500 guest users who were auto-assigned an access package in March retain their assignments but are not billed since there was not an explicit action taken on these users in April. Additionally, Contoso IT runs an inactive access review (AR) on 100 guests.
- Billing: For April, Contoso is billed $75 for the inactive AR (100 users x $0.75).
Scenario 2: Lifecycle workflow and access review for inactive users
March:
- Fabrikam executes a lifecycle workflow for 300 guest users.
- They also perform an access review for inactive users, targeting 100 of the same guests as above, plus a different set of 200 guests.
- Billing: For March, Fabrikam is billed $375. This includes $225 for the lifecycle workflow (300 users x $0.75) and $150 for the access review (200 users x $0.75). Note that since 100 of the guest users already incurred a charge for the lifecycle workflow, they did not incur any additional charge for the inactive user review, since the maximum monthly charge per guest user is $0.75.
April:
- From the second group of 200 guest users in March, 150 guests receive an auto-assigned access package that grants access to an app and have the same inactive user access review that was run in March, repeated in April.
- Billing: For April, Fabrikam is billed $112.50 for the access review (150 users x $0.75), and they are not charged for the access package auto-assignment action, since these 150 guests have already been charged for April.
Planning
To prepare for the upcoming changes, we recommend checking out Identity Governance features that could involve guests, including:
- Auto-assigning policies in Entitlement Management
- Entitlement management policies using custom extensions, Verified ID, or Lifecycle Workflows
- Access reviews for user-to-group affiliation, inactive users, or PIM for groups
Also, check out all the audit logs for these activities to find all guest users who have had governance actions taken.
We hope this update provides the clarity you need as we approach the launch of the ID Governance for guests add-on. While billing is not active yet, you can still use ID Governance for guests for free while it’s in public preview: https://aka.ms/IDGovernanceGuests
Learn more about Microsoft Entra
Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.
Updated Jan 15, 2025
Version 3.0kamurphy
Microsoft
Joined February 23, 2022
Microsoft Entra Blog
Stay informed on how to secure access for workforce, customer, and workload identities, from anywhere, to multicloud and on-premises resources, with comprehensive identity and network access solutions.