specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
provider: Microsoft Active Directory
providerId: active-directory
publisherName: Microsoft Corporation
serviceCategory: Identity / Directory Services
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Active Directory
  - Identity Management
  - Microsoft Entra
  - Zero Trust
  - FinOps
  - FOCUS
description: FOCUS-aligned FinOps for Microsoft Entra ID (the modern Active Directory). Billed per user
  per month at a tier (Free / P1 / P2 / Suite) with optional standalone identity products (ID Governance,
  Internet Access, Private Access, Verified ID) and per-workload-identity charges for Workload ID. Programmatic
  access via Microsoft Graph is rate-limited rather than separately metered.
sources:
  - https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing
  - https://learn.microsoft.com/en-us/graph/throttling-limits
billingModel:
  pricingCategory: Subscription
  billingFrequency: Monthly
  billingCurrency: USD
  chargeCategories:
    - Purchase
    - Usage
focusColumns:
  ServiceName: Microsoft Entra ID
  ServiceCategory: Identity / Directory Services
  ProviderName: Microsoft
  PublisherName: Microsoft Corporation
  InvoiceIssuerName: Microsoft Corporation
  BillingCurrency: USD
  ChargeCategory: Purchase
meters:
  - name: entra_user_seat
    description: Licensed Entra user seat (Free / P1 / P2 / Suite).
    unit: seat
    aggregation: max
    dimensions:
      - tier
      - tenant
  - name: entra_id_governance_seat
    description: Standalone Entra ID Governance seat.
    unit: seat
    aggregation: max
    dimensions:
      - tenant
  - name: entra_internet_access_seat
    description: Entra Internet Access seat.
    unit: seat
    aggregation: max
    dimensions:
      - tenant
  - name: entra_private_access_seat
    description: Entra Private Access seat.
    unit: seat
    aggregation: max
    dimensions:
      - tenant
  - name: workload_identity
    description: Entra Workload ID — service principal / managed identity protected by Workload ID.
    unit: workload-identity
    aggregation: max
    dimensions:
      - tenant
  - name: graph_throttle_consumption
    description: ResourceUnit consumption against Microsoft Graph; not directly billed but a leading
      indicator of where automation pressure exists.
    unit: resource-unit
    aggregation: sum
    dimensions:
      - application
      - tenant
      - operation
principles:
  - name: Visibility
    description: Use Microsoft Cost Management on the EA / MCA enrollment for Entra licensing line items;
      use the Entra admin center "Licenses" pane for assignment counts; use the Microsoft Graph activity
      logs and the x-ms-throttle-limit-percentage header for automation pressure.
  - name: Allocation
    description: Allocate Entra seats by AD group → cost center mapping. For Workload ID, tag each managed
      identity with its owning application and route cost to the consuming product team.
  - name: Optimization
    description: Right-tier users (don't put everyone on P2 if only privileged users need PIM); reclaim
      seats from terminated employees through Lifecycle Workflows; consolidate point identity tools that
      are duplicated by Entra ID Governance, Internet Access, or Private Access; prefer change-notifications
      over polling to stay below throttle ceilings.
  - name: Accountability
    description: The IAM team owns tier mix and renewals; product owners own their Workload ID footprints
      and the Graph applications calling on their behalf.
maintainers:
  - FN: Kin Lane
    email: info@apievangelist.com