Don’t Worry if You See Unexpected Azure Costs for Azure AD Guest Access

Microsoft’s eCommerce System Will Figure Things Out

Earlier this month, I wrote about the need to link an Azure subscription to Azure AD to use Microsoft’s new Monthly Active User (MAU) model to license guest user access to premium Azure AD P1 and P2 features. The MAU model replaces the previous 1:5 ratio (one premium license covered five guest users).

After sorting out a small problem with the Azure providers available to my subscription, the transition for my tenant went well. That is, until I noticed costs creeping up for the subscription (Figure 1).

Examining invoice details shows that the Azure Active Directory service is accumulating the costs for its P2 monthly active user meter (Figure 2).

My tenant is small, but some guests access it to contribute to the Office 365 for IT Pros eBook. Because the tenant uses conditional access policies, the guest activity accumulates in the MAU meter. However, Microsoft says that the MAU model allows for 50,000 unique monthly active user authentications before any charges occur. Given that only 215 guest accounts are in the tenant directory, the level of unique guest authentications per month will never reach 50,000.

No Double Dipping

I contacted Microsoft to ask why the meter was running for Azure AD premium P2 activity generated by guests when the MAU model allowed for a huge number of free monthly unique authentications. The explanation I received is that Microsoft’s eCommerce system is not built to allow two allowances against charges.

My Azure subscription comes with a monthly allowance. Because I linked Azure AD with the subscription, I should also get 50,000 MAU. That’s the two allowances. The eCommerce system which generates the charges and invoices only allows tenants one benefit when it displays charging information in the Azure portal. However, when the time comes to generate an invoice and charge real money, the system takes all available benefits and offsets them against the charges. Because the allowance included in the subscription was larger than the charges for premium Azure AD activity, the invoice had a zero balance.

Learnings

Microsoft say they will update their documentation to reassure tenants that they’ll receive the benefit of the MAU model and won’t be charged for the first 50,000 unique MAU. The thing that I learned from this experience is that the tracking mechanism for MAU works well and is easier to manage than keeping track of licenses bought for guest users according to a 1:5 ratio that must be assessed manually.

---

Keep up with the changing world of the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Monthly updates mean that our subscribers learn about new development as they happen.