Create a governed workforce tenant
In brief
Learn how to securely create a governed Microsoft Entra workforce tenant and establish governance from your home tenant.
Documentation change
Create a governed workforce tenant
This article is for IT administrators who need to create an add-on tenant that is governed from an existing Microsoft Entra tenant. Review the prerequisites before you use the secure add-on tenant creation flow.
When you create a tenant using the Governed Workforce option in the Microsoft Entra admin center, the secure add-on tenant creation flow automatically:
- Creates the new workforce tenant
- Establishes a governance relationship between your home tenant and the new tenant based on your governance policy template
- Provisions a Microsoft Entra ID Free billing asset under your selected Azure subscription and resource group
This article doesn't cover creating an external tenant configuration for consumer-facing apps. For customer identity and access management scenarios, see Microsoft Entra External ID for customers.
Prerequisites
- You must have at least Tenant Contributor permissions on at least one Microsoft Customer Agreement (MCA) subscription.
- Enterprise Agreement (EA) subscriptions aren't supported.
- The default governance policy template must be configured in the governing tenant. The tenant creation service uses only the default template (ID:
default). If the default template isn't defined, the secure add-on tenant creation flow doesn't establish a governance relationship, even if other templates exist.
Before you create a governed workforce tenant, confirm that you meet these requirements:
- Your organization is a paid customer. Customers using a free tenant or trial subscription can't create additional tenants from the Microsoft Entra admin center. If you need a new tenant, sign up for a free Azure account.
- You have either an Enterprise Agreement (EA) or Pay-As-You-Go subscription. Both Microsoft Online Subscription Agreement (MOSA) and Microsoft Customer Agreement (MCA) billing accounts are supported. To identify your billing account type, see View your billing accounts in the Azure portal.
- Your Microsoft Entra tenant allows member users to create add-on tenants. If Restrict non-admin users from creating tenants is set to Yes, your account needs the Tenant Creator role.
- You have the required Azure Resource Manager (ARM) permissions for the selected subscription through the Tenant Contributor or Subscription Owner/Creator role.
- The governing tenant has a configured default governance policy template. The tenant creation service uses only the default template (ID:
default). If the default template isn't defined, the secure add-on tenant creation flow doesn't establish a governance relationship, even if other templates exist.
Create the tenant
diff --git a/docs/id-governance/tenant-governance/how-to-create-tenant.md b/docs/id-governance/tenant-governance/how-to-create-tenant.md index 06b76bf024c..625cefbb99f 100644 --- a/docs/id-governance/tenant-governance/how-to-create-tenant.md +++ b/docs/id-governance/tenant-governance/how-to-create-tenant.md @@ -1,24 +1,37 @@ --- title: Create a governed workforce tenant titleSuffix: Microsoft Entra ID Governance -description: Learn how to create a new Microsoft Entra tenant using the secure add-on tenant creation workflow in Tenant Governance +description: Learn how to securely create a governed Microsoft Entra workforce tenant and establish governance from your home tenant. +author: tafra00 +ms.author: tazkiaafra ms.topic: how-to -ms.date: 03/12/2026 +ms.date: 07/29/2026 +ai-usage: ai-assisted +ms.custom: msecd-doc-authoring-1018 +#customer intent: As an IT administrator, I want to create a governed workforce tenant so that my organization can manage it through a governance relationship. --- # Create a governed workforce tenant +This article is for IT administrators who need to create an add-on tenant that is governed from an existing Microsoft Entra tenant. Review the prerequisites before you use the secure add-on tenant creation flow. + When you create a tenant using the **Governed Workforce** option in the Microsoft Entra admin center, the secure add-on tenant creation flow automatically: - Creates the new workforce tenant - Establishes a [governance relationship](governance-relationships.md) between your home tenant and the new tenant based on your [governance policy template](governance-policy-templates.md) - Provisions a Microsoft Entra ID Free [billing asset](signals-metrics.md) under your selected Azure subscription and resource group +This article doesn't cover creating an external tenant configuration for consumer-facing apps. For customer identity and access management scenarios, see [Microsoft Entra External ID for customers](~/external-id/customers/overview-customers-ciam.md). + ## Prerequisites -- You must have at least **Tenant Contributor** permissions on at least one Microsoft Customer Agreement (MCA) subscription. -- Enterprise Agreement (EA) subscriptions aren't supported. -- The **default** [governance policy template](governance-policy-templates.md) must be configured in the governing tenant. The tenant creation service uses only the default template (ID: `default`). If the default template isn't defined, the secure add-on tenant creation flow doesn't establish a governance relationship, even if other templates exist. +Before you create a governed workforce tenant, confirm that you meet these requirements: + +- Your organization is a paid customer. Customers using a free tenant or trial subscription can't create additional tenants from the Microsoft Entra admin center. If you need a new tenant, sign up for a [free Azure account](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn). +- You have either an [Enterprise Agreement (EA)](/azure/cost-management-billing/manage/understand-ea-roles) or [Pay-As-You-Go](https://azure.microsoft.com/pricing/offers/ms-azr-0003p?cid=msft_learn) subscription. Both [Microsoft Online Subscription Agreement (MOSA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-online-services-program) and [Microsoft Customer Agreement (MCA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-customer-agreement) billing accounts are supported. To identify your billing account type, see [View your billing accounts in the Azure portal](/azure/cost-management-billing/manage/view-all-accounts). +- Your Microsoft Entra tenant allows member users to create add-on tenants. If [**Restrict non-admin users from creating tenants**](~/fundamentals/users-default-permissions.md#restrict-member-users-default-permissions) is set to **Yes**, your account needs the [Tenant Creator](~/identity/role-based-access-control/permissions-reference.md#tenant-creator) role. +- You have the required Azure Resource Manager (ARM) permissions for the selected subscription through the **Tenant Contributor** or **Subscription Owner/Creator** role. +- The governing tenant has a configured **default** [governance policy template](governance-policy-templates.md). The tenant creation service uses only the default template (ID: `default`). If the default template isn't defined, the secure add-on tenant creation flow doesn't establish a governance relationship, even if other templates exist. ## Create the tenant