Microsoft changed how guest governance is paid for in Entra ID Governance, and most of the enterprises Azure IAM, LLC talks to found out when a new access package policy refused to save. The firm, an independent identity consultancy that migrates Microsoft Identity Manager (MIM) estates, keeps a running explanation for clients such as Contoso. This is the current version, drawn from Microsoft’s licensing documentation, the live Azure pricing page, and Message Center notice MC1225192. The firm’s services are described at https://azureiam.com/.
Two prices for two kinds of user
Entra ID Governance licenses member users per seat. Microsoft lists the standalone product at 7 dollars per user per month and Entra Suite, which bundles it with Private Access, Internet Access, ID Protection, and Verified ID, at 12 dollars. Both require an Entra ID P1 or P2 prerequisite, and Microsoft’s rule is that there must be enough seats to cover every member user in scope of a governance feature or who configures one.
Guest users are not seats. Any account with a userType of Guest, whether invited through B2B collaboration or converted by an administrator, is billed under a monthly active user (MAU) model: 75 cents per guest per month, charged to an Azure subscription linked to the tenant. The External ID free tier of 50,000 monthly active users covers sign ins, not governance; Microsoft’s documentation states plainly that there is no free tier for governance billing. The only seat the guest side needs is one Entra ID Governance or Entra Suite license for an administrator.
What makes a guest active
The meter counts guests, not actions. A guest with one or more Governance exclusive actions in a calendar month is billed once for that month. A guest with ten actions is billed once. A guest with none is not billed, even if an access package assigned months ago is still in force.
Microsoft’s billable list, as of October 2026:
Entitlement management: requests made on behalf of another user, access packages that include an Entra role or a PIM for Groups membership, policies with a sponsor as approver, policies that require Verified ID, policies with a custom extension, auto-assignment policies, direct assignment of an identity not yet in the directory, and marking a guest as governed.
Lifecycle workflows: any workflow run against a guest, guest lifecycle policies that disable or delete an account, sponsor attestation that extends a guest, and a user sponsoring a new guest.
Access reviews: reviews with machine learning recommendations enabled, reviews scoped to inactive guests, and catalog access reviews.
Everything that shipped under Entra ID P2 stays off the meter: basic access reviews, basic entitlement management, access package expiration, and the standard approval flows. Each billable event carries GovernanceLicenseFeatureUsed set to True in the audit log, so the usage is auditable after the fact.
What the 2026 enforcement blocks
Microsoft began enforcing the linked subscription on January 30, 2026, with access reviews following by March 31, 2026. A tenant without a linked subscription and the guest governance meter turned on cannot:
create or update entitlement management policies that scope to guests and use the Governance exclusive features above;
create auto-assignment policies whose rule includes userType equals Guest;
mark a guest as governed or directly assign a guest to an access package;
create or update lifecycle workflows whose execution scope includes guests;
create access reviews of guests that use the inactive user or user to group affiliation options.
Existing policies keep running. The practical effect is that tenants which governed partners under P2 for years hit a wall the first time they touch a guest policy, and the fix is a subscription link in the governance dashboard plus a resource group an Azure Owner can see.
Worked numbers
Microsoft’s own examples are modest. A tenant with 10,000 guests runs an inactive guest review, the review identifies 240 inactive accounts, and the bill is 240 guests, or 180 dollars for the month. A lifecycle workflow executed for 300 guests bills 300, or 225 dollars. A guest who is both reviewed and workflowed in the same month is still one record.
The number grows with cadence and population. Azure IAM’s arithmetic for a Contoso sized estate:
500 partner guests, reviewed quarterly: 500 times 75 cents times four, 1,500 dollars a year.
5,000 contractor guests, each touched by a monthly lifecycle workflow or sponsor attestation: 5,000 times 75 cents times twelve, 45,000 dollars a year.
20,000 affiliate or student guests on a monthly cycle, typical of a university or a healthcare network: 180,000 dollars a year.
Those figures sit on top of the per seat licenses for employees. In MIM, the same contractors and affiliates were objects in the metaverse and the MIM Service, governed by sets, workflows, and management policy rules with no per identity charge beyond the server licenses.
Five ways to keep the meter low
Measure before linking. Microsoft’s EIG Guest Usage Monitoring Workbook reports the guest actions that would have been billed in past months. Azure IAM runs it before any subscription is linked so the first invoice is not a surprise.
Use a multitenant organization for sister tenants. Guests whose home tenant participates in the same multitenant organization do not accrue to the meter, and member users synchronized across tenants with userType Member never did.
Scope reviews to inactive guests. Only guests included in a review are billed, not every guest the review scans. A tenant with 10,000 guests and 240 inactive ones pays for 240.
Match cadence to the control. A guest reviewed quarterly costs 3 dollars a year; the same guest on a monthly workflow costs 9. Many controls are satisfied by a quarterly certification plus an event driven disable.
Stay on P2 features where they are enough. Standard access reviews and standard access packages with manager or specific approvers are not metered. Reserve sponsors, custom extensions, Verified ID, and auto-assignment for the populations that need them.
How the meter changes the MIM migration decision
For most workforce estates the guest meter is a rounding error, and Entra ID Governance is the simpler target for joiner, mover, and leaver automation on employees. The meter matters when an organization’s external population is large and continuously governed: defense contractors with thousands of cleared subcontractors, universities with affiliates and alumni, health systems with community physicians and vendor clinicians. For those estates the comparison with SailPoint IdentityIQ changes, because IdentityIQ is licensed per governed identity under a negotiated agreement, not per month of activity, and it governs the same population inside the same platform that handles employees.
MIM 2016 SP2 remains supported until January 10, 2029, so no estate is forced to decide this year. Azure IAM’s fixed fee assessment models both targets against the actual guest counts, review cadences, and workflow triggers in a MIM estate, so the number in the business case is the number that will appear on the invoice. Book a scoping call at https://azureiam.com/contact.
Azure IAM, LLC
2521 North Main
Unit 1-276
Las Cruces
New Mexico
88001
United States
