Azure AD P2 Licensing for Microsoft Teams Guest MFA
Question details
Determine the correct Azure AD (Microsoft Entra ID) licensing model required to enable multifactor authentication (MFA) for Microsoft Teams guests.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- An organization using Microsoft 365 Business Premium needs to set up MFA for Teams guests and wants to know if they need to purchase Azure AD P2 licenses under the 1:5 ratio or if the MAU model covers it.
- Observed behavior
- The administrator is seeking clarity on whether guest access and advanced MFA require extra per-user licenses or if it falls under the included 50,000 MAU threshold.
Verify that your Microsoft 365 tenant has transitioned to the Microsoft Entra External ID Monthly Active Users (MAU) billing model, as Microsoft has largely deprecated the legacy 1:5 ratio model for new configurations.
Utilize the Monthly Active Users (MAU) Billing Model
Switching to the MAU model is the current standard for external identities, allowing you to secure guests with MFA without purchasing individual per-guest licenses.
Under the Microsoft Entra External ID MAU model, the first 50,000 monthly active external users are typically included for free for P1 and P2 features, which includes Conditional Access and MFA.
You do not need to purchase individual Azure AD P2 licenses for each guest. However, your internal administrators configuring these advanced features will still require appropriate licenses.
Log in to the Microsoft Entra admin center or Azure portal using an account with Global Administrator or Billing Administrator privileges.
In the left-hand navigation pane, select 'Identity', then 'External Identities', and choose 'Linked subscriptions'.
Select your tenant and link it to a valid active Azure subscription to enable MAU billing for external users.
Go to 'Security' > 'Conditional Access' to create policies that mandate MFA for your Teams guest users, utilizing the free MAU allowance.
Evaluate the Legacy 1:5 Guest Ratio
If your tenant has not yet moved to MAU billing, your guest limits are determined by the number of premium licenses assigned to internal users.
Looking for a Cost-Effective Office Productivity Suite?
While managing enterprise identities and Teams guest MFA requires navigating complex Microsoft licensing tiers, equipping your team with powerful productivity tools doesn't have to be complicated or expensive. WPS Office provides a robust, free alternative to Microsoft Office that easily handles document creation and collaboration.
- 1. Download the software: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen prompts to set up the suite on your computer.
- 3. Open existing documents: Launch WPS Office and open your existing Microsoft Office files directly; your formatting and layouts will remain perfectly intact.
Frequently Asked Questions
Do Microsoft Teams guests need a dedicated Microsoft 365 license?
No, inviting and adding guests to Microsoft Teams generally does not require an additional Microsoft 365 license. However, if you enforce advanced security policies like Conditional Access MFA, those features are governed by Microsoft Entra ID (Azure AD) licensing rules.
What is the Monthly Active Users (MAU) billing model in Azure AD?
The MAU model allows organizations to provide premium identity features (such as MFA and Identity Protection) to external guests. Under this model, the first 50,000 monthly active external users are typically included for free, after which a per-user fee applies.
Are there hidden costs with the MAU free tier?
While the first 50,000 guest MAU are free for Azure AD P1/P2 features, Microsoft charges a flat fee for each SMS or voice-call MFA attempt. Utilizing a push notification or time-based code via an authenticator app bypasses these extra telecom charges.
Do our internal administrators still need Azure AD P2 licenses if we use MAU?
Yes. While your guest users are covered by the MAU allowance for P2 features, any internal administrators who configure, manage, or utilize Azure AD P2 features (like risk-based Conditional Access) must have their own individual P2 licenses.
