specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
provider: Microsoft Entra
providerId: microsoft-entra
publisherName: Microsoft Corporation
serviceCategory: Identity
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Identity
  - Access Management
  - Microsoft
  - FinOps
  - FOCUS
description: 'FOCUS-aligned FinOps for Microsoft Entra: per-user-per-month subscriptions for the ID tiers
  (Free, P1, P2, Suite, Governance, Internet Access, Private Access), per-workload-identity for Workload
  ID, and per-monthly-active-user metering for External ID beyond the 50K free tier.'
sources:
  - https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing
  - https://learn.microsoft.com/en-us/entra/
billingModel:
  pricingCategory: Tiered Subscription + Pay-As-You-Go (External ID)
  billingFrequency: Monthly
  billingCurrency: USD
  chargeCategories:
    - Usage
    - Purchase
    - Tax
    - Adjustment
focusColumns:
  ServiceName: Microsoft Entra
  ServiceCategory: Identity
  ProviderName: Microsoft
  PublisherName: Microsoft Corporation
  InvoiceIssuerName: Microsoft Corporation
  BillingCurrency: USD
  ChargeCategory: Purchase
meters:
  - name: entra_id_seats
    description: Per-user seat licences across ID Free / P1 / P2 / Suite
    unit: seat
    aggregation: sum
    dimensions:
      - tenant
      - sku
  - name: entra_id_governance_seats
    description: ID Governance seats (requires P1 or P2)
    unit: seat
    aggregation: sum
    dimensions:
      - tenant
  - name: entra_internet_access_seats
    description: Internet Access add-on seats
    unit: seat
    aggregation: sum
    dimensions:
      - tenant
  - name: entra_private_access_seats
    description: Private Access add-on seats
    unit: seat
    aggregation: sum
    dimensions:
      - tenant
  - name: workload_identities
    description: Workload identities under Workload ID protection
    unit: workload_identity
    aggregation: sum
    dimensions:
      - tenant
  - name: external_id_mau
    description: Monthly active users for External ID; first 50K free per tenant
    unit: monthly_active_user
    aggregation: max
    dimensions:
      - tenant
  - name: verified_id_face_check
    description: Verified ID Face Check verification calls (premium add-on)
    unit: verification
    aggregation: sum
principles:
  - name: Visibility
    description: Use Microsoft 365 admin centre for seat licence usage and the Microsoft Entra usage and
      insights workbooks for sign-ins, MFA, and Conditional Access activity.
  - name: Allocation
    description: Tag licence assignments via Entra groups bound to cost-centres; flow External ID MAU
      to the consuming app via Azure subscription tags.
  - name: Optimization
    description: Reclaim unused P1 / P2 seats with access reviews and lifecycle workflows; avoid double-licensing
      where Microsoft 365 E5 already includes Entra ID P2; pre-warm the External ID free 50K MAU tier.
  - name: Accountability
    description: Identity team owns Conditional Access scope and Workload ID coverage; finance owns Microsoft
      365 / Entra licence counts; app owners reconcile External ID MAU against Azure invoices.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com