Azure Active Directory pricing

¹ Default usage quota is 150,000 objects. An object is an entry in the directory service, represented by its unique distinguished name. An example of an object is a user entry used for authentication purposes. If you need to exceed this default quota, please contact support. The 500K object limit does not apply for Office 365, Microsoft Intune or any other Microsoft paid online service that relies on Azure Active Directory for directory services.

² With Azure AD Free and Azure AD Basic, end users who have been assigned access to SaaS apps can get SSO access to up to 10 apps. Admins can configure SSO and change user access to different SaaS apps, but SSO access is only allowed for 10 apps per user at a time. All Office 365 apps are counted as one app.

³ Multi-Factor Authentication is available for Azure AD Free and Azure AD Basic, when you create a Multi-Factor Authentication Provider by the 'per user' or 'per authentication' billing/usage model. Pricing for MFA per-user and per-authentication options is described here.

⁴ Microsoft Identity Manager Server software rights are granted with Windows Server licenses (any edition). Since Microsoft Identity Manager runs on Windows Server OS, as long as the server is running a valid, licensed copy of Windows Server, then Microsoft Identity Manager can be installed and used on that server. No other separate license is required for Microsoft Identity Manager Server.

⁵ Self-service integration of any application supporting SAML, SCIM, or forms-based authentication by using templates provided in the application gallery menu. For more details, please read this article.

⁶ First monitoring agent requires at least one license. Each additional agent requires 25 additional incremental licenses. Agents monitoring AD FS, AD Connect, and AD DS are considered separate agents.

⁷ Azure AD allows for B2B collaboration by enabling the use of a select set of Azure AD features to named guest users. A guest user is someone outside of your organization who is invited into your Azure AD tenant. Guest users are not employees, contractors, or onsite agents for you or your affiliates. While some features are free, for any paid Azure AD features, guest users must be licensed as follows: with each Azure AD edition license that you own for an employee or a non-guest user in your tenant, you will also be able to invite up to five named guest users to the tenant. The features you can extend to these named guest users will depend on the type of Azure AD edition you purchase. there is no charge for inviting a named guest user and assigning him/her to an application in Azure AD, for up to ten apps per named guest user. Other features of Azure AD ‘Free’ edition, such as, three basic reports, are also free for named guest users. For paid Azure AD features that are extended to named guest users, the inviting tenant will need the appropriate number of Basic or Premium P1 or Premium P2 licenses to cover named guest users, in the one license: five named guest users ratio as described above. For e.g. one Azure AD Basic license will allow for up to five named guest users to be set up for Group Based Access Management and Provisioning. For the 6th named guest user, you will need another Azure AD Basic license. Similarly, one Azure AD Premium P1 license will allow for up to five named guest users to use Multi-factor authentication feature (plus any Azure AD Basic features). For the 6th named guest user that uses MFA, you will need a second Azure AD Premium P1 license.

⁸ Advanced Group features include dynamic groups, group creation permission delegation, group naming policy, group expiration, usage guidelines, and default classification.

⁹ To access the cloud app discovery features go to https://portal.cloudappsecurity.com/ and log in with your Azure AD P1 credentials. Azure AD P2 customers will not need to enter credentials and will be automatically redirected.