Microsoft Entra now displays a licensing overage warning when Conditional Access policies cover more users than a tenant’s Entra ID P1 entitlements allow. It isn’t a bill and nothing gets switched off, but the fix most administrators reach for is to remove people from the policy. Trouble is, that’s a security decision arriving through a billing channel.
What the Entra Licensing Overage Warning Says
Sometime in the first week of August, a large number of Microsoft 365 administrators opened the Conditional Access page and found a banner waiting for them. It flagged a licensing overage and reported that some of their policies were protecting more users than their current entitlements allow.
Nothing broke. No invoice arrived. Microsoft’s own documentation states that when required licenses expire, existing Conditional Access policies are not automatically disabled or deleted. Tony Redmond, who has been reading Microsoft licensing tea leaves longer than some of our clients have been in business, called it an informational notice rather than the opening move of automated billing. We think he’s right.
The interesting part is what happened next.
Is the Conditional Access Licensing Warning a Bill?
No. It is a visibility signal, and the distinction matters less than it sounds like it should.
Within days of the banner appearing, comment threads under every walkthrough of it filled with a version of the same question. Which users should come out of the policy? That’s a reasonable question for an administrator to ask, except that Microsoft’s own guidance recommends scoping Conditional Access to all users. Administrators are now holding two pieces of advice from the same vendor, but only one of them comes with a yellow banner attached.
Why the License Usage Number Understates the Gap
The math behind the warning deserves scrutiny. The figure comes from the license usage page under Billing, which reports what a tenant consumed last month. Consumption and policy scope are different numbers, and they can sit a long way apart. If administrators follow the practice everyone recommends, where a privileged account is kept separate from the account that answers email, the report may see two users where the licensing position sees one human being.
Several people who have worked through the calculation conclude that it understates real P1 exposure. So the banner announces a problem while declining to size it.
Microsoft is on defensible ground here. P1 has been the requirement for Conditional Access for years. Risk-based policies have always needed P2. Business Premium has included Conditional Access the entire time. None of this is new and none of it is hidden. A vendor is entitled to be paid for what gets used, and putting the gap on the page administrators work in every week is more honest than a true-up letter that arrives in year three with interest attached. If we ran that product line, we’d want the number visible, too.
What we’d want visible alongside it is the decision the number sets off, because it is currently being made by the wrong person.
What Happens When Users Get Excluded from Conditional Access
Picture a 60-person professional services firm. Forty people on Business Standard, twenty on Business Premium, which is an ordinary way to arrive at 2026 after several years of adding seats as the company hired. Conditional Access is scoped to everyone, because that’s the recommended configuration and because nobody wanted the policy to have holes in it. The banner appears. Two paths follow. Buy forty more licenses, or narrow the policy until the warning clears. The second path costs nothing this quarter and takes about eleven minutes.
Then comes the question of which forty names come off the list. In the tenants we inherit from other providers, exclusion lists fill from the bottom of the org chart upward, because that’s where the pushback is softest. The sales rep working from hotel wifi. The part-time bookkeeper on a home machine nobody manages. Those are the accounts an attacker shops for first, and they’re the ones most likely to be sitting outside the access policy by Friday.
Nobody in that story did anything wrong. The administrator saw a compliance warning and resolved it. The owner never heard about it, because from the outside nothing changed. The tenant looks the same, the dashboard stays green, and the protected population is a third smaller than it was on Monday.
How to Handle the Warning Without Shrinking Coverage
Two steps, in order.
First, establish the real number rather than last month’s. That means examining the actual scope of each policy and counting the identities it evaluates, including service accounts and separate administrative logins, since those are where the reported figure and the licensing requirement drift apart.
Second, price both paths and choose one deliberately. Licenses are a line item anyone can see. Exclusions are also a line item, and that invoice arrives later and from a different direction. When the next insurance renewal or client security questionnaire asks whether access controls apply to every user, an exclusion that was chosen and documented is a far better answer than one discovered during the phone call.
Today, the banner is just informational. Microsoft built the usage reporting, connected it to licensing data, and put the result where administrators look every week. But kind of plumbing doesn’t usually get built and then left as purely decorative. If (or when?) the word “informational” goes away, the companies that already know their true number will be prepared. Everyone else will spend it deciding whose name comes off the list. Who in your organization makes that call?
If you’d like someone to run the count, that’s a conversation worth having.
FAQ
Is the “Entra Conditional Access licensing overage warning” a bill?
No. It is an informational notice in the Entra admin center. Microsoft has not announced enforcement, and its documentation states that existing Conditional Access policies are not automatically disabled or deleted when required licenses expire.
Does Conditional Access require a license for every user?
Conditional Access requires Entra ID P1 for each user a policy protects. Risk-based policies require Entra ID Protection, which is a P2 feature. Microsoft 365 Business Premium includes Conditional Access.
Why does the license usage report differ from what the policies require?
The usage page reports consumption from the previous month rather than the scope of current policies. Separate administrative accounts, service accounts, and users who did not sign in during the reporting period can all cause the reported figure to run below the actual requirement.
Should users be excluded from Conditional Access to clear the warning?
Excluding users removes the warning and removes the protection at the same time. The exclusion may still be the right call for a specific account, but it belongs to whoever owns the organization’s risk rather than to whoever is in the admin console that afternoon.