Request for a Free Microsoft Entra ID IAM Learning Environment

If your current Azure trial is connected to your company directory, create an independent Azure free account with a personal Microsoft account; this provisions a separate Microsoft Entra ID Free tenant in which the tenant creator is Global Administrator.

Option 1: Separate Microsoft Entra ID Free tenant

1. Open the Azure free-account signup page.
2. Sign up with a personal Microsoft account, not your company account.
3. Complete the account verification and sign in to the Azure portal.
4. Open Microsoft Entra ID → Overview and verify that the displayed tenant is your new personal directory.
5. Open Roles and administrators and verify that your account is Global Administrator.

A tenant creator is automatically assigned Global Administrator, allowing that account to create users and groups and assign Microsoft Entra administrative roles.^1^

This is the documented free development route: an Azure free account provides a Microsoft Entra ID Free tenant. If the signup process determines that the account is ineligible for the free-account offer, use the developer-sandbox option below instead.^2^

Do not expect to create another Workforce tenant from inside your existing trial. Microsoft currently limits that operation to paid customers; free-tenant and trial-subscription customers cannot create additional Workforce tenants through the Entra admin center.^3^

Option 2: Microsoft 365 E5 developer sandbox

This is the better environment for testing P2 functionality, but it is available only to qualifying Developer Program members. Current eligibility paths include:

• Eligible Visual Studio Professional or Enterprise standard subscriptions
• ISV Success Program or eligible Microsoft AI Cloud Partner Program participation
• Premier or Unified Support customers

Learning alone does not guarantee eligibility. An existing production Microsoft 365 subscription also does not automatically qualify you.^4^

If eligible:

1. Join the Microsoft 365 Developer Program.
2. Complete the profile and any requested verification.
3. From the Developer Program dashboard, select Set up E5 subscription.
4. Choose the tenant region, administrator username, domain, and password.
5. Register multifactor authentication for the administrator.

The sandbox provides 25 E5 user licenses, including Microsoft Entra ID P2, plus sample users, groups, and Microsoft 365 data.^2^ It is intended only for development and testing, is short-lived, and continued access depends on maintaining program eligibility. The current instant-sandbox term is up to 90 days.^5^

What each environment lets you practise

With your own Entra ID Free tenant and Global Administrator account, you can practise core directory administration, including users, groups, authentication configuration, applications, service principals, and Entra role assignments.

Premium scenarios have separate licensing requirements:

• Conditional Access requires P1 or P2.
• Risk-based Conditional Access and Privileged Identity Management require P2 or another qualifying package.
• Several advanced access-review, entitlement-management, and lifecycle-workflow capabilities require Microsoft Entra ID Governance; P2 does not include every current Governance capability.^6^

If a P1/P2 trial offer is presented and your tenant is eligible, it can be activated for temporary testing. Do not assume that the offer will be available indefinitely or for every tenant.^7^

Azure RBAC requires a subscription as well

Microsoft Entra directory roles and Azure RBAC are separate permission systems:

• Entra roles control directory objects such as users, groups, applications, and directory administrators.
• Azure roles control Azure resources at management-group, subscription, resource-group, or individual-resource scope.^8^

An isolated tenant by itself is therefore insufficient for Azure RBAC practice. Before using your free-trial subscription:

1. In the Azure portal, switch to your personal directory.
2. Open Subscriptions → your subscription and confirm that the subscription appears there.
3. Open Access control (IAM) → View my access.
4. Continue only if you have Owner or User Access Administrator at the intended scope.
5. Create a test resource group, then open Resource group → Access control (IAM) → Add → Add role assignment.
6. Assign a low-privilege role such as Reader to a test user, verify its effect, and remove it afterward.

If the subscription remains associated with your company tenant, or you lack the required Azure role, do not use it for this lab.

Preventing unexpected charges

• Keep the Azure free-account spending limit enabled. It is enabled by default for new free accounts and prevents most spending beyond the included credit.^9^
• Avoid Marketplace products, Entra P1/P2 purchases, support plans, and third-party services: some can be billed separately even with a spending limit.
• Create a budget under Cost Management + Billing → Cost Management → Budgets. Budgets send notifications but do not stop resources or charges.^10^
• Delete lab resource groups after each Azure RBAC exercise. User, group, and role practice in the directory generally does not require deploying billable Azure resources.

References

1. Frequently asked questions about Microsoft Entra ID
2. Microsoft Entra Verified ID developer information
3. Quickstart: Create a new tenant in Microsoft Entra ID
4. Microsoft 365 Developer Program FAQ
5. Set up a Microsoft 365 developer sandbox subscription
6. Microsoft Entra licensing
7. Sign up for Microsoft Entra ID P1 or P2 editions
8. Azure roles, Microsoft Entra roles, and classic subscription administrator roles
9. Azure spending limit
10. Tutorial: Create and manage budgets