caf-billing-entra-tenant

Azure billing and Microsoft Entra tenant

Overview

This is the foundational design area: before any landing zone exists you must decide which Microsoft Entra tenant is the identity and security boundary for the environment and how Azure consumption is billed and organized. These choices are deliberately hard to reverse — the tenant is the root of trust and the billing hierarchy frames cost ownership for the whole estate. Most organizations should target a single production tenant and add tenants only for hard isolation requirements.

When to use this skill

• Deciding whether to use an existing Entra tenant or create a new one.
• Choosing and structuring the billing agreement (EA, MCA, or CSP) and its scopes.
• Planning the enrollment / billing hierarchy (departments, accounts, invoice sections).
• Evaluating a single-tenant vs multi-tenant strategy (e.g. dev/test isolation, M&A, sovereignty).
• Establishing ownership and emergency access for the tenant and billing accounts.

Key concepts

• Microsoft Entra tenant — the identity boundary. One tenant can contain many subscriptions and management groups; trust, users, and Conditional Access are tenant-scoped.
• Billing account — the top of the billing hierarchy, tied to the agreement type:
  • Enterprise Agreement (EA): Billing account → Department → Account → Subscription.
  • Microsoft Customer Agreement (MCA): Billing account → Billing profile → Invoice section → Subscription.
  • Cloud Solution Provider (CSP): subscriptions provisioned and billed via a partner.
• Billing roles are separate from Azure RBAC — they govern who can create subscriptions, view invoices, and manage the agreement.
• Tenant vs subscription: billing lives with the agreement; the subscription is the unit of consumption that is associated to one tenant at a time.
• Multi-tenant ALZ — supported but adds operational cost (identity, governance, and tooling must span tenants). Use only when isolation is a genuine requirement.