A cloud-based identity and access management service for securing user authentication and resource access
The Azure subscription and the Entra P2/Identity Governance trials must live in the same Microsoft Entra tenant to be used together. A subscription can’t span tenants, and cross-tenant access doesn’t replace the need for a subscription in the tenant where resources are managed.
From the provided information:
- The email used to sign up determines which Microsoft Entra tenant the subscription is associated with. When a personal account (Gmail, Yahoo, etc.) is used, Azure creates a new directory and tenant and makes that account the top-level admin for that tenant.
- When a different “work” tenant was created for P2/Identity Governance, that tenant ended up without an Azure subscription attached.
- Cross-tenant access (B2B / cross-tenant sync) is for collaboration between tenants, not for sharing a single subscription across tenants.
Given the context, the supported way to have Azure and Entra P2/Identity Governance together is to add the missing subscription into the tenant that already has the Entra P2/Identity Governance licenses, or to add the Entra P2/Identity Governance licenses into the tenant that already has the Azure subscription. The documentation describes that multiple cloud offerings (Microsoft 365, Azure, Dynamics 365) are combined by adding subscriptions into the same organization/Microsoft Entra tenant:
- If there is already an Azure-based organization/tenant, additional SaaS subscriptions (like Microsoft 365 or other services) are added into that same tenant.
- Conversely, if there is already a Microsoft 365/Entra tenant, an Azure subscription is added to that tenant from the Azure portal.
In practice, the fix is:
- Decide which tenant will be the “main” tenant for labs (either the original Azure Free Trial tenant or the P2/Identity Governance tenant).
- In that tenant, add the missing subscription or service so that both Azure and Entra P2/Identity Governance are in the same tenant:
- If the P2/Identity Governance tenant is the main tenant, sign in to the Azure portal with an admin account for that tenant and add an Azure subscription to that tenant (as described in the “Combining subscriptions for multiple Microsoft cloud offerings” section). This associates Azure with the same Microsoft Entra tenant where P2/Identity Governance is already present.
- If the Azure Free Trial tenant is the main tenant, add the Entra P2/Identity Governance licenses/subscription into that tenant via the appropriate admin center/Marketplace so that both capabilities exist in the same tenant.
Once both the Azure subscription and Entra P2/Identity Governance are in the same Microsoft Entra tenant, labs and real-world scenarios can be created without relying on cross-tenant access.
References: