Entra ID Free after Azure free-trial expiry: personal Microsoft-account OAuth without PAYG

An expired Azure free-trial subscription does not automatically delete its Microsoft Entra tenant, but Microsoft’s published documentation does not guarantee that every app-management and personal-account OAuth operation will remain available indefinitely without an active billing relationship.

What is documented

Desktop application and Microsoft Graph

Register the application with Personal accounts only, or Any Entra ID tenant + Personal Microsoft accounts, and configure it as a public desktop client. Those supported-account selections explicitly include Hotmail and other personal Microsoft accounts.^3^

In Microsoft Entra admin center → Entra ID → App registrations → your app:

1. Open Authentication → Add a platform → Mobile and desktop applications.
2. Add the appropriate desktop redirect URI.^5^
3. Open API permissions → Add a permission → Microsoft Graph → Delegated permissions.
4. Add User.Read and Mail.ReadBasic.
5. Add Mail.Read later only when body access is needed.

User.Read, delegated Mail.ReadBasic, and delegated Mail.Read support personal Microsoft accounts. Mail.ReadBasic excludes the body, body preview, attachments, and extended properties.^6^

For a native desktop app, use authorization-code flow with PKCE and do not embed a client secret. Request offline_access explicitly when using the v2 endpoint if a refresh token is required.^7^

No separate Microsoft “approval” for changing from delegated Mail.ReadBasic to delegated Mail.Read is documented for this private personal-account scenario. The user must consent to the newly requested permission. That is distinct from publisher verification or organizational admin consent.

Refresh tokens and reauthorization

For ordinary native-client scenarios, the documented default refresh-token lifetime is 90 days. Refresh tokens rotate when used, so the application must securely persist the replacement token and delete the superseded one. Tokens can expire or be revoked earlier, and the application must fall back to interactive authorization.^8^

Azure subscription expiration is not listed as a refresh-token revocation event. That supports—but does not expressly guarantee—the conclusion that subscription expiry alone does not revoke existing tokens. Tokens and new interactive authorization will still fail if the tenant, application, billing account, or relevant service becomes inaccessible.

Likewise, no cited policy affirmatively guarantees that a personal Microsoft account can authorize again after the Azure subscription is disabled. Obtain written confirmation before treating that as a permanent service commitment.

Inactivity policies

Two different policies must not be conflated:

1. Billing-account inactivity: For MCA, MOSA, CSP, and EES billing accounts, an account is considered inactive only when, for at least 12 months, it has no usage, no sign-in activity, and no open or pending support requests. Microsoft then gives 30 days’ notice before blocking. Using a product/service, generating metered usage, or creating a support ticket are documented examples of activity.^9^
2. Tenant inactivity: If a tenant is blocked with AADSTS5000225, an administrator has 20 days to request reactivation; after that, the tenant is deleted and unrecoverable.^10^

An administrative sign-in is relevant to the billing-account test because that policy expressly counts sign-in activity. Microsoft does not publish a guaranteed sign-in interval for the separate tenant lifecycle, nor does the cited policy say that personal-account Graph token issuance or refresh counts as qualifying tenant activity. Periodic administrator sign-in is prudent but cannot be represented as a guaranteed preservation mechanism.

New tenant enrollment without PAYG

Primary Microsoft Learn guidance currently routes a free development tenant through an Azure free account; it does not establish a permanent standalone Entra-only enrollment entitlement.^11^ Current workforce-tenant documentation also says only paid customers can create additional workforce tenants in the admin center, directing free/trial users to Azure free-account signup.^12^

An accepted Microsoft Q&A answer separately describes selecting Try for free on the Microsoft Entra pricing page to create a tenant without an associated Azure subscription.^13^ Treat that as a potentially available support-described route, not a binding entitlement: availability can depend on the account or region and is not confirmed by the primary tenant-creation documentation.

For a durable written answer, open a Microsoft billing/subscription support request and ask Microsoft to confirm, for the resulting billing-account type:

• app-registration creation and editing after free-trial disablement;
• new personal-account consent and token issuance;
• whether consumer OAuth token activity counts as tenant activity;
• which billing record must remain active;
• whether the Try for free Entra-only route is available for the account and region.

Microsoft Q&A answers are support guidance, not contractual product-policy guarantees. The public support-request route is linked from Microsoft’s disabled-subscription guidance.^2^

References

1. Associate or add an Azure subscription to your Microsoft Entra tenant
2. Reactivate a disabled Azure subscription
3. Register an application in Microsoft Entra ID
4. Microsoft Entra ID Free
5. How to add a redirect URI to your application
6. Microsoft Graph permissions reference
7. Scopes and permissions in the Microsoft identity platform
8. Refresh tokens in the Microsoft identity platform
9. Keep your Microsoft business billing account active
10. Tenant inaccessible due to inactivity
11. Microsoft Entra Verified ID developer information
12. Quickstart: Create a new tenant in Microsoft Entra ID
13. How to detach my Azure subscription from someone else's Entra ID directory? - Microsoft Q&A