@@ -1,24 +1,37 @@ --- title: Create a governed workforce tenant titleSuffix: Microsoft Entra ID Governance-description: Learn how to create a new Microsoft Entra tenant using the secure add-on tenant creation workflow in Tenant Governance+description: Learn how to securely create a governed Microsoft Entra workforce tenant and establish governance from your home tenant.+author: tafra00+ms.author: tazkiaafra ms.topic: how-to-ms.date: 03/12/2026+ms.date: 07/29/2026+ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1018+#customer intent: As an IT administrator, I want to create a governed workforce tenant so that my organization can manage it through a governance relationship. ---  # Create a governed workforce tenant +This article is for IT administrators who need to create an add-on tenant that is governed from an existing Microsoft Entra tenant. Review the prerequisites before you use the secure add-on tenant creation flow.+ When you create a tenant using the **Governed Workforce** option in the Microsoft Entra admin center, the secure add-on tenant creation flow automatically:  - Creates the new workforce tenant - Establishes a [governance relationship](governance-relationships.md) between your home tenant and the new tenant based on your [governance policy template](governance-policy-templates.md) - Provisions a Microsoft Entra ID Free [billing asset](signals-metrics.md) under your selected Azure subscription and resource group +This article doesn't cover creating an external tenant configuration for consumer-facing apps. For customer identity and access management scenarios, see [Microsoft Entra External ID for customers](~/external-id/customers/overview-customers-ciam.md).+ ## Prerequisites -- You must have at least **Tenant Contributor** permissions on at least one Microsoft Customer Agreement (MCA) subscription.-- Enterprise Agreement (EA) subscriptions aren't supported.-- The **default** [governance policy template](governance-policy-templates.md) must be configured in the governing tenant. The tenant creation service uses only the default template (ID: `default`). If the default template isn't defined, the secure add-on tenant creation flow doesn't establish a governance relationship, even if other templates exist.+Before you create a governed workforce tenant, confirm that you meet these requirements:++- Your organization is a paid customer. Customers using a free tenant or trial subscription can't create additional tenants from the Microsoft Entra admin center. If you need a new tenant, sign up for a [free Azure account](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn).+- You have either an [Enterprise Agreement (EA)](/azure/cost-management-billing/manage/understand-ea-roles) or [Pay-As-You-Go](https://azure.microsoft.com/pricing/offers/ms-azr-0003p?cid=msft_learn) subscription. Both [Microsoft Online Subscription Agreement (MOSA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-online-services-program) and [Microsoft Customer Agreement (MCA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-customer-agreement) billing accounts are supported. To identify your billing account type, see [View your billing accounts in the Azure portal](/azure/cost-management-billing/manage/view-all-accounts).+- Your Microsoft Entra tenant allows member users to create add-on tenants. If [**Restrict non-admin users from creating tenants**](~/fundamentals/users-default-permissions.md#restrict-member-users-default-permissions) is set to **Yes**, your account needs the [Tenant Creator](~/identity/role-based-access-control/permissions-reference.md#tenant-creator) role.+- You have the required Azure Resource Manager (ARM) permissions for the selected subscription through the **Tenant Contributor** or **Subscription Owner/Creator** role.+- The governing tenant has a configured **default** [governance policy template](governance-policy-templates.md). The tenant creation service uses only the default template (ID: `default`). If the default template isn't defined, the secure add-on tenant creation flow doesn't establish a governance relationship, even if other templates exist.  ## Create the tenant