Microsoft Entra ID GovernanceDeploy Microsoft Entra Tenant Governance end to end
In brief
Learn how to deploy Microsoft Entra Tenant Governance from setup through tenant discovery, governance, and configuration monitoring
Documentation change
Deploy Microsoft Entra Tenant Governance end to end
- A Microsoft Entra tenant with the appropriate license for Tenant Governance. For details, see Microsoft Entra licensing.
- An account with the Tenant Governance Administrator or Global Administrator role.
- For configuration management: an account with the Global Administrator or Privileged Role Administrator role.
- For secure tenant creation: at least Tenant Contributor permissions on a Microsoft Customer Agreement (MCA) subscription. Enterprise Agreement (EA) subscriptions aren't supported.
- For secure tenant creation: either a paid Enterprise Agreement (EA) or Pay-As-You-Go subscription. Both Microsoft Online Subscription Agreement (MOSA) and Microsoft Customer Agreement (MCA) billing accounts are supported. You also need the required Azure Resource Manager (ARM) permissions for the selected subscription through the Tenant Contributor or Subscription Owner/Creator role. To identify your billing account type, see View your billing accounts in the Azure portal.
Phase 1: Enable related tenant discovery
Use the secure add-on tenant creation feature to create new tenants that are immediately governed.
- Sign in to the Microsoft Entra admin center with at least Tenant Contributor permissions on a Microsoft Customer Agreement subscription.
- Sign in to the Microsoft Entra admin center with the Tenant Contributor or Subscription Owner/Creator role for the selected subscription.
- Create a new tenant using the Governed Workforce option.
- Select the Azure subscription and resource group for the Microsoft Entra ID Free billing asset.
diff --git a/docs/id-governance/tenant-governance/deployment-guide.md b/docs/id-governance/tenant-governance/deployment-guide.md index 342a6c836d2..d7fb2dc03b1 100644 --- a/docs/id-governance/tenant-governance/deployment-guide.md +++ b/docs/id-governance/tenant-governance/deployment-guide.md @@ -3,7 +3,9 @@ title: Deploy Microsoft Entra Tenant Governance end to end titleSuffix: Microsoft Entra ID Governance description: Learn how to deploy Microsoft Entra Tenant Governance from setup through tenant discovery, governance, and configuration monitoring ms.topic: how-to -ms.date: 03/17/2026 +ms.date: 07/29/2026 +ai-usage: ai-assisted +ms.custom: msecd-doc-authoring-1018 --- # Deploy Microsoft Entra Tenant Governance end to end @@ -19,7 +21,7 @@ Before you begin, confirm that your environment meets these requirements: - A Microsoft Entra tenant with the appropriate license for Tenant Governance. For details, see [Microsoft Entra licensing](~/fundamentals/licensing.md#microsoft-entra-tenant-governance). - An account with the Tenant Governance Administrator or Global Administrator role. - For configuration management: an account with the Global Administrator or Privileged Role Administrator role. -- For secure tenant creation: at least Tenant Contributor permissions on a Microsoft Customer Agreement (MCA) subscription. Enterprise Agreement (EA) subscriptions aren't supported. +- For secure tenant creation: either a paid [Enterprise Agreement (EA)](/azure/cost-management-billing/manage/understand-ea-roles) or [Pay-As-You-Go](https://azure.microsoft.com/pricing/offers/ms-azr-0003p?cid=msft_learn) subscription. Both [Microsoft Online Subscription Agreement (MOSA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-online-services-program) and [Microsoft Customer Agreement (MCA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-customer-agreement) billing accounts are supported. You also need the required Azure Resource Manager (ARM) permissions for the selected subscription through the Tenant Contributor or Subscription Owner/Creator role. To identify your billing account type, see [View your billing accounts in the Azure portal](/azure/cost-management-billing/manage/view-all-accounts). ## Phase 1: Enable related tenant discovery @@ -219,7 +221,7 @@ For more information, see [See monitor results and configuration drifts](how-to- Use the secure add-on tenant creation feature to create new tenants that are immediately governed. -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with at least Tenant Contributor permissions on a Microsoft Customer Agreement subscription. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with the Tenant Contributor or Subscription Owner/Creator role for the selected subscription. 1. Create a new tenant using the **Governed Workforce** option. 1. Select the Azure subscription and resource group for the Microsoft Entra ID Free billing asset.