💡 Our Technical Review in summary
Summary
- Microsoft is introducing a mandatory requirement to link a valid Azure subscription to the Microsoft Entra ID tenant to continue using Entra ID Governance features for guest users (userType = Guest).
- This change is scheduled for general availability and enforcement starting January 30, 2026.
- The requirement ensures accurate billing under the Monthly Active User (MAU) model for advanced governance actions performed on or by guest identities.
Impact
- Administrative Restrictions: If a subscription is not linked by the deadline, admins will be blocked from creating or updating policies scoped to guest users. This includes Access Reviews (inactive user reviews), Entitlement Management (sponsor approvers, Verified ID, auto-assignment), and Lifecycle Workflows for guests.
- Access Reviews: While the primary enforcement begins in January, guest-scoped Access Reviews will be fully integrated into this requirement by March 31, 2026.
- Existing Policies: Currently active policies will continue to execute; however, no modifications or new guest-governance configurations can be authored until a subscription is linked.
- Billing Model: Usage will transition to the MAU model once the subscription is linked, allowing for scalable governance of external identities.
Action Required
- Verify Permissions: Ensure you have at least the Contributor role on the target Azure subscription to perform the linkage.
- Link Subscription: Before January 30, 2026, navigate to Microsoft Entra ID > Identity Governance > Dashboard. In the “Guest Access Governance” panel, select Get Started to link your subscription and resource group.
- Audit Current Usage: Review existing guest-scoped lifecycle workflows and entitlement management policies to identify which services will require an active subscription for future maintenance.
- Update Documentation: Revise internal IT governance manuals and documentation to include Azure subscription linkage as a prerequisite for guest identity management.
- Communicate: Notify internal compliance, security, and identity teams regarding the shift to the MAU billing model for these specific governance features.
Microsoft Official Update
Service: N/A
Category: planForChange
Severity: normal
Introduction
Beginning January 30, 2026, Microsoft Entra ID Governance will require all tenants to have a linked Azure subscription to continue using Identity Governance features for guest users. This change ensures accurate billing for governance actions performed by guests and supports continued access to advanced governance capabilities.
When this will happen:
General availability and enforcement begin on January 30, 2026.
How this will affect your organization:
Who is affected:
- Organizations using Microsoft Entra ID Governance features for guest users (
userType = Guest). - Admins managing lifecycle workflows or Entra ID Governance features in entitlement management for external or guest identities. Access reviews will be included by March 31, 2026.
What will happen:
- If your tenant does not have a linked Azure subscription, creation or updates of policies scoped to guest users using premium Entra ID Governance capabilities will be blocked.
- The following actions will be unavailable:
- Creating access reviews scoped to guest users (inactive user reviews, user-to-group affiliation helper)
- Creating or updating entitlement management policies involving guests, sponsor approvers, custom extensions, Verified ID, or auto-assignment rules
- Marking a guest as governed in entitlement management
- Directly assigning a guest user to an access package in entitlement management
- Creating or updating lifecycle workflows scoped to guest users.
- Existing policies will continue to run, but no new guest-governance actions can be authored without billing enabled.
- Once a subscription is linked, normal guest governance usage and billing will begin under the Monthly Active User (MAU) model.
What you can do to prepare:
- Before January 30, 2026, link a valid Azure subscription to your tenant:
- Navigate to Entra ID → ID Governance → Dashboard
- In the Guest Access Governance panel, select Get Started
- Choose a subscription and resource group, then select Turn on
- Confirm your account has at least the Contributor role to enable subscription linking.
- Review any guest-scoped workflows, reviews, or entitlement policies that may require updates after subscription linking.
- Communicate this change to support teams or internal governance admins.
- Update internal documentation regarding:
- Guest governance prerequisites
- Subscription dependency
- Billing behavior for governance actions
Learn more: Microsoft Entra ID Governance licensing for guest users | Microsoft Learn
Compliance considerations:
| Question | Explanation |
|---|---|
| Does the change alter how existing customer data is processed, stored, or accessed? | Guest-governance actions require a linked Azure subscription; creating or updating guest-scoped governance actions is blocked without subscription linkage. |
| Does the change modify admin controls? | Admins must link an Azure subscription to enable guest governance billing and can turn guest governance on or off in the Entra ID Governance dashboard. |
| Does the change allow a user or admin to enable or disable the feature? | Guest governance features can be enabled or disabled through the Guest Governance panel in the Entra ID Governance dashboard. |
