Microsoft Entra ID Governance
GovernanceDeploy Microsoft Entra Tenant Governance end to end
In brief
The deployment guide now documents a paid Azure subscription linked to an Enterprise Agreement or pay-as-you-go billing account, with Tenant Contributor or Subscription Owner/Creator access for the selected subscription.
What Entra admins need to know
Administrators should verify the subscription type and assigned role before creating a secure tenant.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Deploy Microsoft Entra Tenant Governance end to end
- A Microsoft Entra tenant with the appropriate license for Tenant Governance. For details, see Microsoft Entra licensing.
- An account with the Tenant Governance Administrator or Global Administrator role.
- For configuration management: an account with the Global Administrator or Privileged Role Administrator role.
- For secure tenant creation:
at leasta paid Azure subscription associated with an Enterprise Agreement (EA) or pay-as-you-go billing account. Legacy and modern billing experiences are supported. You also need the required permissions for the selected subscription through the Tenant Contributorpermissions on a Microsoft Customer Agreement (MCA) subscription. Enterprise Agreement (EA) subscriptions aren't supported.or Subscription Owner/Creator role. To identify your billing account type, see View your billing accounts in the Azure portal.
Phase 1: Enable related tenant discovery
Use the secure add-on tenant creation feature to create new tenants that are immediately governed.
- Sign in to the Microsoft Entra admin center with
at leastthe Tenant Contributorpermissions on a Microsoft Customer Agreementor Subscription Owner/Creator role for the selected subscription. - Create a new tenant using the Governed Workforce option.
- Select the Azure subscription and resource group for the Microsoft Entra ID Free billing asset.
@@ -3,7 +3,9 @@ title: Deploy Microsoft Entra Tenant Governance end to end titleSuffix: Microsoft Entra ID Governance description: Learn how to deploy Microsoft Entra Tenant Governance from setup through tenant discovery, governance, and configuration monitoring ms.topic: how-to-ms.date: 03/17/2026+ms.date: 07/29/2026+ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1018 --- # Deploy Microsoft Entra Tenant Governance end to end@@ -19,7 +21,7 @@ Before you begin, confirm that your environment meets these requirements: - A Microsoft Entra tenant with the appropriate license for Tenant Governance. For details, see [Microsoft Entra licensing](~/fundamentals/licensing.md#microsoft-entra-tenant-governance). - An account with the Tenant Governance Administrator or Global Administrator role. - For configuration management: an account with the Global Administrator or Privileged Role Administrator role.-- For secure tenant creation: at least Tenant Contributor permissions on a Microsoft Customer Agreement (MCA) subscription. Enterprise Agreement (EA) subscriptions aren't supported.+- For secure tenant creation: a paid Azure subscription associated with an [Enterprise Agreement (EA)](/azure/cost-management-billing/manage/understand-ea-roles) or [pay-as-you-go](https://azure.microsoft.com/pricing/offers/ms-azr-0003p?cid=msft_learn) billing account. Legacy and modern billing experiences are supported. You also need the required permissions for the selected subscription through the Tenant Contributor or Subscription Owner/Creator role. To identify your billing account type, see [View your billing accounts in the Azure portal](/azure/cost-management-billing/manage/view-all-accounts). ## Phase 1: Enable related tenant discovery @@ -219,7 +221,7 @@ For more information, see [See monitor results and configuration drifts](how-to- Use the secure add-on tenant creation feature to create new tenants that are immediately governed. -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with at least Tenant Contributor permissions on a Microsoft Customer Agreement subscription.+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with the Tenant Contributor or Subscription Owner/Creator role for the selected subscription. 1. Create a new tenant using the **Governed Workforce** option. 1. Select the Azure subscription and resource group for the Microsoft Entra ID Free billing asset.