How can I upgrade my customer facing Entra External ID Tennant

Hello Mike Dooney

Thank you for reaching out to Microsoft Q&A.

Below is a step‑by‑step path to enable MFA and Conditional Access for your customer‑facing Microsoft Entra External ID tenant:-

What you can (and cannot) upgrade in External ID

External ID (customer/CIAM) doesn’t use Entra ID P1/P2 per‑user licenses.

External ID is billed by Monthly Active Users (MAU). The core features are free for the first 50,000 MAU, and premium add‑ons (including MFA/Conditional Access enforcement for consumer flows) are charged per MAU. You don’t assign P1/P2 licenses like you do in a workforce tenant.

For your reference: https://learn.microsoft.com/en-us/entra/external-id/external-identities-pricing

Conditional Access for workforce vs. external tenants:

Workforce tenants use P1/P2 licensing to enable Conditional Access. External ID enforces policies within customer flows and charges via MAU (premium add‑ons).

For your reference: https://learn.microsoft.com/en-us/entra/fundamentals/licensing

SMS in External ID: SMS is not available as first‑factor/authentication or SSPR; it is available as second‑factor with additional per‑MAU cost.

For your reference: https://learn.microsoft.com/en-us/entra/external-id/customers/faq-customers

Resolution: enable MFA & Conditional Access in your External ID tenant

1) Link the External ID tenant to an Azure subscription (billing)

Sign in to Microsoft Entra admin center and switch to your External ID directory.

Go to Home → Billing and link the tenant to a subscription.

This enables usage‑based billing (MAU) and unlocks premium add‑ons.

Note: The tenant overview may still show “Microsoft Entra ID Free” even after linking—this is a known UI issue; billing status is visible under Billing.

For your reference: https://learn.microsoft.com/en-us/entra/external-id/external-identities-pricing

For your reference: https://learn.microsoft.com/en-us/entra/external-id/customers/faq-customers

2) Turn on MFA and Conditional Access for customer flows

For External ID (CIAM) tenants, you configure authentication and CA within the external user journeys:

Review how authentication & Conditional Access apply to external identities and when cross‑tenant claims/trusts are honored.

For your reference: https://learn.microsoft.com/en-us/entra/external-id/authentication-conditional-access

Plan Conditional Access similarly to workforce scenarios, but remember billing is MAU‑based in External ID.

For your reference: Plan Your Microsoft Entra Conditional Access Deployment - Microsoft Entra ID | Microsoft Learn

Typical steps in the External ID portal:-

In your External ID tenant, open the customer application (App registrations) you want to protect.

Configure the sign‑in user flows (or custom extensions) and then define Conditional Access policies that require MFA based on signals (app, location, user groups, etc.).

If you need SMS as second factor, enable it in the MFA methods—but note the additional per‑MAU charge.

3) If you instead meant workforce (internal) users in that tenant

If your “customer‑facing” tenant is actually being used to host workforce identities (admins, staff) and you want to use Conditional Access for them:

You do purchase Microsoft Entra ID P1/P2 per user and assign licenses; then configure Conditional Access policies.

Purchase options and activation steps are documented here:

https://learn.microsoft.com/en-us/entra/fundamentals/get-started-premium

https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-licensing

Why you were blocked “upgrading” to P1

The Microsoft 365 admin center is optimized for workforce licensing (assigning P1/P2 to internal users). For External ID, you won’t “see” a P1 SKU to buy for customers; you link to a subscription and enable MAU‑metered features instead.

For your reference: https://learn.microsoft.com/en-us/entra/fundamentals/get-started-premium

Please reach out to us in case of any further issue.

Thanks

I’ve dealt with this before, and the problem isn’t your setup.

Customer-facing Entra External ID tenants can’t be upgraded from inside the normal Azure portal. The “External ID” tenant type is treated differently, and the upgrade options you’re looking for (Premium P1 features like MFA and Conditional Access) only show up once you attach the correct billing plan to that tenant.

To answer your question, the fix is simple. You need to purchase the Entra External ID Premium P1 SKU specifically for that tenant through the Microsoft 365 admin center, not Azure portal.

Go to:

https://admin.microsoft.com Billing → Purchase Services Search for External ID P1

Once the license is assigned to the External ID tenant, the MFA and Conditional Access options appear instantly in that same tenant.

Nothing is wrong with your config. You’re just looking in the wrong portal. The upgrade is done through Microsoft 365 billing, not Azure.