Microsoft Entra External ID and B2B Licensing: What Enterprise Organisations Actually Owe

The 50,000 MAU Free Tier — Why Most Enterprises Owe Nothing

The most important fact about Microsoft Entra External ID licensing is this: the first 50,000 monthly active users (MAU) are free. Every month. Not a one-time allowance — a recurring free tier that resets monthly. Monthly active users are counted as external identities (guests, partners, customers) who authenticate to your tenant at least once in that calendar month. For B2B collaboration use cases — partner organisations accessing shared SharePoint sites, Teams channels, or joint project environments — 50,000 MAU is a substantial threshold. Most mid-market enterprises operate well below this level without knowing it, and without validating this against their tenant's actual external identity count before accepting pre-committed External ID packages in their EA.

Microsoft's sales motion for Entra External ID is increasingly to propose pre-committed MAU packages — typically P1 or P2-tier External ID at $0.00325/MAU (P1) or $0.0195/MAU (P2) — as part of EA renewals alongside Entra P1/P2 workforce identity. For an enterprise with 8,000 monthly active external B2B guests, the correct cost is $0 — they are within the free tier. Accepting a pre-committed package of 100,000 MAU at P1 pricing costs $3,900/month ($46,800/year) for what should be a $0 line item. This is not an unusual scenario in our EA reviews.

B2B Collaboration vs Entra External ID — The Naming Transition

Microsoft rebranded and restructured external identity products in 2023–2024. Azure AD B2B Collaboration is now "Entra External ID for workforce tenants" (B2B invitations, guest accounts). Azure AD B2C (business-to-consumer customer identity) is now "Entra External ID for external-facing applications." The underlying technology and licensing mechanics are largely continuous, but the product naming in Microsoft's commercial motions has shifted, creating confusion in EA conversations where account teams reference "Entra External ID" as a new product requiring new licensing rather than continuity of what the tenant already uses.

For EA purposes, the critical clarification is: if your organisation uses B2B guest invitations for partner and supplier collaboration in SharePoint/Teams, and your monthly active external guest count is below 50,000, you have been operating on the free tier throughout, and any EA proposal to add "Entra External ID" licences is a new cost for something that was previously free. If your count exceeds 50,000, or if you are building a consumer-facing identity experience (customer login for a web application or portal), the paid tier becomes relevant — but even then, the pricing is consumption-based MAU, not per-seat, and should not be pre-committed in large fixed packages without MAU measurement data.

B2B Guest Licensing — The 1:5 Rule for Workforce Features

For B2B guest users who access Entra ID P1 or P2 features in your tenant (such as Conditional Access policies applied to guests, MFA enforcement for guests, Access Reviews of guest accounts), a licensing rule applies: for every 5 guests who use P1 or P2 features, you need 1 Entra ID P1 or P2 licence in your tenant (or a licensed user at the corresponding tier in the guest's home tenant). This "1:5 ratio" has been Microsoft's standard B2B licensing rule for several years.

The practical implication: if you have 3,000 guest users accessing resources and subject to Conditional Access policies (a P1 feature), you need 600 Entra P1 licences covering those guests. If your M365 E3 user count is 5,000, and your workforce P1 count is 5,000 (all covered by E3), the 600 additional guest-covering P1 licences may already be satisfied by the ratio embedded in your existing licence pool — Microsoft's interpretation has generally been that the ratio can be satisfied from the same EA. This is an area worth validating explicitly with your Microsoft account team during renewal to avoid purchasing standalone P1 licences for guest coverage when the ratio is already met by workforce licences.

External ID P1 vs P2 — What the Paid Tiers Add

For organisations that do exceed the 50,000 MAU free threshold, or that require advanced external identity features, the paid External ID tiers add capabilities beyond the free B2B baseline. External ID P1 adds custom branded sign-in experiences (custom domain for the external sign-in portal, branded login pages rather than Microsoft's default), custom user attributes (capturing additional data points at external sign-up), and API connectors (calling external APIs during the authentication flow for validation or enrichment). External ID P2 adds Identity Protection for external users (sign-in risk assessment and risk-based CA for external identities), Access Reviews for external users (periodic re-certification of partner/supplier access), and Entitlement Management for external access packages (structured partner onboarding with defined access packages and lifecycle management).

For most enterprise B2B collaboration use cases — partners accessing shared SharePoint libraries, supplier access to project portals, contractor Teams channels — the free tier is architecturally sufficient. The P1 additions (custom branding, API connectors) are relevant primarily for consumer-facing scenarios or high-volume partner portals where Microsoft's default Entra sign-in experience is commercially unacceptable. The P2 additions (Identity Protection for external users, Access Reviews for guests) are relevant for high-security environments with strict partner access governance requirements — typically regulated industries (financial services, government, healthcare) with external user lifecycle management compliance obligations.

EA Negotiation — Three External Identity Tactics

1. Validate MAU Before Accepting Any External ID Line Item

Before your EA renewal, export your actual monthly active external user count from the Entra admin centre. Navigate to: Entra admin centre → Identity → External Identities → Overview — the dashboard shows monthly active external users for the current and prior months. If your MAU is below 50,000, there is no basis for a paid External ID line in your EA. If the account team proposes one, reject it as inconsistent with the free tier entitlement. If your MAU is above 50,000, calculate the incremental cost based only on the above-threshold volume — do not accept a flat per-user rate applied to total guest count, which overstates cost by including the free tier population in the calculation. This is a frequent pricing error in Microsoft EA proposals for external identity lines.

2. Challenge Pre-Committed MAU Packages

Microsoft's sales motion for External ID has shifted toward pre-committed MAU packages rather than pure PAYG consumption billing, particularly in EA contexts. Pre-committed packages look attractive (slightly lower per-MAU rate) but lock you into paying for capacity regardless of usage. For B2B guest populations that fluctuate with project cycles — a construction firm with large project teams, a consulting firm with client-engagement guest access, a retail company with seasonal supplier portals — actual MAU can vary 3–5x between peak and trough. Pre-committing at peak capacity means paying full price during low-use months. The correct EA structure for External ID beyond the free tier is PAYG consumption with an Azure MACC credit coverage option — not a fixed pre-committed seat count. Our Azure MACC negotiating leverage guide covers how External ID PAYG consumption can count toward MACC commitment targets.

3. Verify the 1:5 Guest Ratio Against Workforce Licences

If guests in your tenant access P1 or P2 features (Conditional Access policies applied to guests, Access Reviews of guest accounts, PIM-managed guest roles), validate whether the 1:5 ratio is satisfied by your existing workforce licence count before accepting standalone guest-covering P1/P2 licences. For a 10,000 E3 user organisation with 2,500 monthly active guests using Conditional Access, the 1:5 ratio requires 500 P1 licences covering guests. Your 10,000 E3 licences already include P1 — the ratio is satisfied without additional purchase. Microsoft's account teams do not always surface this calculation proactively. If your EA renewal includes a line for "Entra ID P1 for guest users" or "Azure AD External Identities," validate the ratio first. The Entra ID complete guide provides the full inclusion mapping for M365 bundles against external identity licensing requirements.

The broader context for external identity licensing sits within the full Entra ID licensing architecture. External identity is a frequently overlooked dimension of EA proposals — both for potential overpayment (pre-committed packages above the free tier threshold) and for the interaction with workforce P1/P2 via the 1:5 ratio. Our security licensing guide covers how external identity governance requirements intersect with the Entra Governance and P2 investment framework for organisations with strict partner access compliance requirements.