Microsoft Entra Workforce Tenant Creation Requires Paid License — Free Test Tenant Options?

Thipparaboina, Suresh (Cognizant) 0 Reputation points
2026-10-17T06:12:50.48+00:00

Hello Microsoft Entra Support Team and Community,

I am developing a multitenant enterprise healthcare SaaS application hosted on Microsoft Azure. I need to validate customer authentication, tenant isolation, role-based authorization, and API access across independent Microsoft Entra Workforce directories.

My current environment:

  • Microsoft Entra ID Free

Active Azure Pay-As-You-Go subscription

Global Administrator and Azure subscription Owner access

Tenant creation policy enabled

Existing application uses Microsoft Entra authentication and supports multitenant customer identities

Issue:

When I attempt to create an additional Microsoft Entra Workforce tenant through the Azure portal, I receive a message stating that a paid license is required.

The portal currently offers Governed Workforce and External tenant options, but the standard Workforce creation option is unavailable.

I need two independent Workforce test directories, each with an ordinary customer user, to validate tenant isolation and authorization before releasing a commercial SaaS product.

Could you please clarify:

Is a paid Microsoft Entra license mandatory to create additional Workforce tenants, even with an active Pay-As-You-Go Azure subscription?

Is there any Microsoft-supported way to create two Workforce test tenants without purchasing additional licenses?

Are there developer programs, sandbox environments, or free testing options suitable for multitenant SaaS authentication testing?

If standard Workforce tenant creation is unavailable, what supported alternative would you recommend for testing independent customer directories and cross-tenant isolation?

I would prefer not to purchase additional licenses solely for temporary development and security acceptance testing.

Thank you for your guidance.Hello Microsoft Entra Support Team and Community,

I am developing a multitenant enterprise healthcare SaaS application hosted on Microsoft Azure. I need to validate customer authentication, tenant isolation, role-based authorization, and API access across independent Microsoft Entra Workforce directories.

My current environment:

Microsoft Entra ID Free

Active Azure Pay-As-You-Go subscription

Global Administrator and Azure subscription Owner access

Tenant creation policy enabled

Existing application uses Microsoft Entra authentication and supports multitenant customer identities

Issue:

When I attempt to create an additional Microsoft Entra Workforce tenant through the Azure portal, I receive a message stating that a paid license is required.

The portal currently offers Governed Workforce and External tenant options, but the standard Workforce creation option is unavailable.

I need two independent Workforce test directories, each with an ordinary customer user, to validate tenant isolation and authorization before releasing a commercial SaaS product.

Could you please clarify:

Is a paid Microsoft Entra license mandatory to create additional Workforce tenants, even with an active Pay-As-You-Go Azure subscription?

Is there any Microsoft-supported way to create two Workforce test tenants without purchasing additional licenses?

Are there developer programs, sandbox environments, or free testing options suitable for multitenant SaaS authentication testing?

If standard Workforce tenant creation is unavailable, what supported alternative would you recommend for testing independent customer directories and cross-tenant isolation?

I would prefer not to purchase additional licenses solely for temporary development and security acceptance testing.

Thank you for your guidance.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments
Answer accepted by question author
Palanikumar Annamalai 0 Reputation points
2026-10-17T11:51:47.1933333+00:00

Hi Suresh,

Your Azure Pay-As-You-Go subscription and your Entra tenant's licensing eligibility are separate requirements.

Why the portal asks for a paid licence

Microsoft's current Governed Workforce creation guidance requires:

  • A paid, licence-based Microsoft product in the home tenant, such as Entra ID P1/P2, Microsoft 365 or Windows Enterprise E3. Free and trial licences do not qualify.
  • A paid EA or Pay-As-You-Go Azure subscription.
  • The Tenant Creator role, plus the required Azure Resource Manager permissions.

Therefore, PAYG plus Entra ID Free does not meet all the documented prerequisites for that flow. It does not necessarily have to be an Entra P1/P2 licence specifically; the prerequisite includes other qualifying Microsoft products.

The newly created directory gets an Entra ID Free billing asset. Eligibility to create it is separate from licensing premium features inside it.

Create a governed workforce tenant

Options without buying new licences solely for testing

  1. Check whether your organisation already has a qualifying paid home tenant and can provision authorised non-production Workforce directories there. If using Governed Workforce, review the default governance template: it can provision cross-tenant access, delegated administration and service principals. Account for those relationships in your isolation tests.
  2. Check existing eligibility for the Microsoft 365 Developer Program. Eligible Visual Studio Professional/Enterprise standard subscribers and qualifying partner/support customers have documented paths. Joining alone does not guarantee a sandbox, and one membership provides only one developer subscription, so this cannot automatically supply two additional directories.

Developer Program eligibility and limits

  1. Microsoft's tenant-creation quickstart also points customers who cannot create additional tenants to Azure free-account signup. That is subject to signup eligibility; it is not a promise of two free directories for an existing customer.

Tenant-creation quickstart

For your stated environment, I cannot point to a documented, unconditional option that supplies two new Workforce tenants at no additional cost. If you have no existing qualifying entitlement, ask Azure subscription support to confirm the supported provisioning route for your billing account before purchasing anything.

Keep the security test representative

An External tenant is not a like-for-like substitute for testing organisational customer Workforce sign-ins. Use separate directory IDs and native test members; guests in one directory do not reproduce two independent customer directories. Test that a valid token from directory B cannot access directory A's data, including when object IDs or application roles are manipulated. Validate issuer, audience and tenant authorisation on the API as well as in the UI.

These are documentation-based recommendations; I have not reproduced your portal issue.

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.