The proliferation of test, demo, or employee-created tenants without IT validation is one of the most frequent blind spots in Microsoft Entra environments. Microsoft announces the general availability (GA) of Microsoft Entra Tenant Governance, an integrated capability that enables you to discover, secure, and monitor your entire tenant portfolio from a single control point. This article details the four pillars of the solution, what's new since public preview, two concrete scenarios, and an initial scripted approach to prepare your discovery phase.
Why tenant drift threatens your security posture
A tenant hosts an organization's identities, applications, data, and cloud/AI services. Its protection is no longer just a security requirement: it's a prerequisite for any reliable AI deployment, since these environments depend on a resilient and consistent foundation.
In reality, most large enterprises operate dozens, sometimes hundreds of tenants: primary, production, test, demo, and sometimes tenants created spontaneously by employees. Two risks accumulate over time:
- Configuration drift on the primary tenant, which progressively deviates from its baseline state without anyone noticing.
- Ghost tenants, invisible to central IT, which escape baseline policies like conditional access and expand the attack surface.
Microsoft Entra Tenant Governance was designed based on lessons learned from Microsoft's response to a sophisticated high-level incident, with a clear objective: to shift from reactive incident response to proactive, scalable governance across the entire tenant lifecycle.
The four pillars of Microsoft Entra Tenant Governance
The solution unifies four complementary capabilities, each addressing a distinct governance phase.
| Capability | Function | Primary Benefit |
|---|---|---|
| Related tenants | Identifies tenants linked to the organization and maps their relationship with business activities | Reduces blind spots before they become incidents |
| Governance relationships | Establishes cross-tenant delegated administration with least privilege | Also enables multi-tenant management of agents and Microsoft Defender XDR |
| Tenant configuration management | Defines configuration baselines for Defender, Entra, Exchange Online, Intune, Purview, and Teams | Continuous monitoring of drift from expected state |
| Secure tenant creation | Controls who can create a new tenant | Automatically establishes a governance relationship on day 1 |
To practically organize your tenant portfolio, Microsoft publishes a new Microsoft Entra tenant estate architecture guide, useful prior to any governance implementation project.
What's changed since public preview
Since the public preview, several notable improvements have been delivered:
- Increased limits for configuration monitors and snapshots per tenant. Customers with ID Governance, Entra Suite, or Microsoft E7 licenses now benefit from higher daily and monthly caps.
- Enhanced tenant discovery, with deeper visibility into tenants linked to the organization.
- Simplified configuration monitoring, via new administration portal experiences (currently in preview) making it easier to create monitors from snapshots.
- Strengthened delegated administration, to streamline switching between tenants and multi-tenant governance.
- Extended secure tenant creation to governed add-on tenants under historical billing models, including Enterprise Agreement and Pay-As-You-Go.
Field feedback
An Enterprise customer cited by Microsoft indicates that Tenant Governance "enables the establishment of least-privilege governance relationships and continuous monitoring of each tenant against our Golden Security Baseline, with consistent visibility across our entire tenant portfolio".
Two concrete scenarios to understand the added value
Scenario 1: Regaining control of a forgotten test tenant
An employee at fictional company Caldova creates a test tenant, Caldova-Test, to evaluate a feature before launch. This tenant escapes central IT control and enforces no conditional access policies.
Discover linked tenants
A shared billing account signal reveals Caldova-Test. Upon investigation, the team finds that several Caldova users are logging into administrative applications on this tenant.
Establish a governance relationship
A request/approval process places Caldova-Test under control, with a least-privilege governance relationship granting the Tenant Governance Administrator role, without creating a new identity.
Define the baseline
Rather than writing configuration from scratch, the team takes a snapshot of the primary Caldova tenant to use as the desired state.
Monitor drift
A continuous configuration monitor quickly reports deviations from the baseline.
Remediate and refine
Deviations are handled as they occur, with targeted fixes, and monitors are refined as the program matures.
Scenario 2: Detecting configuration drift on the primary tenant
Governing peripheral tenants is not enough: the primary tenant, on which every employee depends, must also remain compliant. During an audit, the Caldova team discovers that the tenant no longer meets device compliance requirements.
A monitor created from a snapshot taken during an approved compliance period automatically detects that an Intune device compliance policy has been modified. The drift report confirms this was an accidental change. With the expected state and exact deviation in hand, the team restores the approved Intune policy and brings the tenant back into compliance.
Without drift monitoring, the team would have had to sift through audit logs, guess whether the change was malicious or accidental, then reconstruct the intended configuration.
Extension to AI agents and the Microsoft security ecosystem
As organizations deploy AI agents across multiple tenants, multi-tenant governance becomes the foundation for their security. Multi-tenant agent management, a capability of Microsoft Agent 365 currently in preview and enabled by Tenant Governance, allows you to prioritize remediation of at-risk agents and ensure consistent deployment posture. Once the governance relationship is established in the Entra administration center, administrators can view the inventory and activity of agents, identify risky agents, then install or block them on the governed tenant from the Microsoft 365 administration center.
The governance relationship model also extends to Microsoft Defender and Sentinel: administrators can leverage the delegated access from the Defender multi-tenant management experience (preview) to centrally manage incidents, alerts, and configurations across governed tenants — a scenario particularly relevant for MSPs and MSSPs administering customer tenants without full admin access.
Required licenses
Establishing a governance relationship requires distinct licenses depending on the tenant's role:
| Tenant | Required License | What It Unlocks |
|---|---|---|
| Governing tenant | Microsoft Entra Tenant Governance license | Establishment of governance relationship and centralized management |
| Governed tenant | Microsoft Agent 365 license | Access to agent activity and insights on at-risk agents |
Consult the Microsoft Entra Tenant Governance licensing guide for exact details by edition, as well as the official deployment guide before any production deployment.
Licensing caps
The limits for monitors and snapshots per tenant vary by license (ID Governance, Entra Suite, Microsoft E7). Check your quotas before deploying baselines across a large number of tenants, otherwise you risk silent blocking of new monitor creation.
Implementation: Preparing your inter-tenant relationship inventory
At GA, creating governance relationships, baselines, and configuration monitors is managed from the Microsoft Entra administration center; no dedicated PowerShell cmdlets are documented for these objects at this time. However, you can now prepare your discovery phase with the Microsoft Graph PowerShell module, by inventorying existing inter-tenant access relationships (B2B parameters) and verifying assignments to the Tenant Governance Administrator role.
Required module: Microsoft.Graph.Identity.SignIns and Microsoft.Graph.Identity.DirectoryManagement (v2.x or later). Minimum permissions: Policy.Read.All and Directory.Read.All (read-only, no tenant-wide actions).
1# Install required Microsoft Graph modules (read-only)2Install-Module Microsoft.Graph.Identity.SignIns -Scope CurrentUser3Install-Module Microsoft.Graph.Identity.DirectoryManagement -Scope CurrentUser1# Connect with least privilege principle: read-only2Connect-MgGraph -Scopes "Policy.Read.All", "Directory.Read.All"3 4# Verify context and granted scopes5Get-MgContext | Select-Object -ExpandProperty Scopes1# Preparatory inventory script for Microsoft Entra Tenant Governance2# Output: a CSV file listing existing inter-tenant access relationships3# and current members of the Tenant Governance Administrator role (if any).4 5$exportPath = ".\Inventory-TenantRelationships_$(Get-Date -Format 'yyyyMMdd').csv"6$report = @()7 8# Step 1: List already-configured cross-tenant partners (B2B, synchronization)9# These relationships are a useful signal for spotting "linked" tenants before10# formalizing them under a governance relationship.11$partners = Get-MgPolicyCrossTenantAccessPolicyPartner -All12 13foreach ($partner in $partners) {14 $report += [PSCustomObject]@{15 Type = "Existing cross-tenant relationship"16 TenantId = $partner.TenantId17 IsServiceProvider = $partner.IsServiceProvider18 VerificationDate = (Get-Date -Format 'yyyy-MM-dd')19 }20}21 22# Step 2: Check if the Tenant Governance Administrator role already exists23# and list its members (indicates a governance relationship has been activated)24$role = Get-MgDirectoryRole -Filter "displayName eq 'Tenant Governance Administrator'"25 26if ($role) {27 $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id28 foreach ($member in $members) {29 $report += [PSCustomObject]@{30 Type = "Member of Tenant Governance Administrator role"31 TenantId = $member.Id32 IsServiceProvider = "N/A"33 VerificationDate = (Get-Date -Format 'yyyy-MM-dd')34 }35 }36} else {37 Write-Host "No Tenant Governance Administrator role detected: no active governance relationships at this time." -ForegroundColor Yellow38}39 40# Export report for transmission to security team41$report | Export-Csv -Path $exportPath -NoTypeInformation -Encoding UTF842Write-Host "Report exported to $exportPath" -ForegroundColor GreenTenant-wide impact in next step
This script is read-only and presents no risk. However, creating a governance relationship from the Entra administration center grants delegated administration on the governed tenant: validate the scope of the Tenant Governance Administrator role before approval, as its removal later requires manual portal action.
Common errors and points of caution
- "Insufficient privileges to complete the operation" when reading cross-tenant policies: the user account used for
Connect-MgGraphlacks the appropriate Entra role (Security Reader minimum) or admin consent was not granted for thePolicy.Read.Allscope. - Configuration monitor not created: verify that your license quota for monitors/snapshots (ID Governance, Entra Suite, E7) is not reached before opening a support ticket.
- No Tenant Governance Administrator role returned: either no governance relationship has been established yet, or the role display name differs slightly depending on your portal language — also check via
Get-MgDirectoryRoleTemplate. - Propagation delay: after approving a governance relationship in the portal, allow for propagation delay before monitors and role inventory reflect the change; rerun the inventory script a few minutes later to confirm.
Key takeaways before deploying Monday morning
Microsoft Entra Tenant Governance goes generally available with a simple objective: make visible the tenants that have escaped central IT's radar until now, then keep them in a compliant state without repeated manual effort. Concretely:
- Start with discovery: run the inventory of existing cross-tenant relationships to identify your "linked" tenants before formalizing a governance relationship.
- Snapshot your primary tenant in a compliant state to make it the reference baseline for your secondary tenants.
- Check your license quotas (ID Governance, Entra Suite, Microsoft E7) before deploying monitors at scale.
- If your organization plans to deploy multi-tenant AI agents, plan now for acquiring a Microsoft Agent 365 license for governed tenants.
For more information, consult the official Microsoft Entra Tenant Governance documentation and the tenant estate architecture guide.
