Set up your Microsoft tenant and Azure subscription

Last checked against Microsoft documentation: 5 November 2026 (account requirements, free-offer terms, tenant-creation rules, spending limits, and budgets). Microsoft may change page layouts, button names, verification requirements, and available offers; portal menu names in particular change often. Use the English names below to identify the corresponding options if your pages use another language.

By the end of this guide, you should have an organization account you can sign in with, a Microsoft tenant, and an active Azure subscription in that tenant. You will also know where to find the details needed for installation and how to monitor your Azure costs.

Do this before you buy. Benedict App is installed by you, with the Benedict App installer, into an existing Microsoft tenant and Azure subscription. The license does not include creating or administering them. If you would rather have us do it, we offer that as a separate service, quoted and invoiced separately from the license.

On this page: Before you begin · Create what is missing · Prepare your account · Billing and alerts · Record your details · Final checklist · Troubleshooting

Choose where to start

Part 1 — Before you begin

1. Understand the three things you need

A tenant can have more than one Azure subscription. Your Microsoft 365 business subscription and your Azure hosting subscription serve different purposes; having Microsoft 365 does not mean you already have Azure hosting available. [1]

For Benedict App, you are preparing the Microsoft environment in which the Benedict App installer will deploy the application. This guide covers that preparation; the installer then deploys Benedict App itself. The full list of what the installer needs is in the Benedict App requirements.

2. Check whether your organization already has a tenant

If your organization uses Microsoft 365 for business, it normally already has one. Reuse it unless your administrator has a reason to keep Benedict App in a separate environment. [2]

Ask the person who manages your company email or Microsoft 365:

Do we already have a Microsoft Entra tenant and an Azure subscription we can use for Benedict App? Who can approve the installation and manage the Azure billing?

To check yourself:

1. Open the Microsoft Entra admin center.
2. Sign in with your organization's work or school account.
3. Look for the organization name near your account menu.
4. Open Entra ID → Overview → Properties and find Tenant ID. Copy it into a private setup note. [3]

If you see “Access denied,” this does not prove that your company has no tenant. Your account may lack permission to view the page. Ask your administrator before creating a separate environment.

3. Keep personal and business accounts separate

A personal Microsoft account and a work or school account are different identities, even if they use the same email address. When Microsoft asks which type to use for your existing company environment, choose Work or school account. [4]

A new user such as alex@examplestudio.onmicrosoft.com can be a valid organizational sign-in without having an email inbox. A mailbox is a separate service. Keep a working contact email address for billing, receipts, and recovery. [26]

For Benedict App, decide which account will run the installer before you buy. Enter that account's sign-in name as the license email at checkout: the license is linked to your organization the first time someone signs in to the installer with it. Your invoice email and your Microsoft sign-in name may be different. Our license confirmation is sent to the license email, so if that account has no mailbox (see above), contact us before buying.

4. Have these items ready

• A computer with a current web browser.
• Your business name, address, country or region, and contact details.
• Access to the email address used during registration.
• A phone that can complete Microsoft's verification process.
• An accepted payment card and its correct billing address.
• A phone or other supported method for additional sign-in verification.
• Permission from your organization to create cloud resources and incur hosting charges.

Microsoft's Azure account page lists current card and country requirements. Prepaid cards are not accepted for the standard sign-up described there; requirements can vary by country. A temporary card verification hold may appear. [5]

Use a separate browser profile for this setup if you regularly sign in to several Microsoft accounts. Before submitting a form, check which account is shown at the top of the page.

5. Understand the costs

The Benedict App license and Microsoft Azure hosting are separate purchases. Your organization pays Microsoft, or its Microsoft partner, for the Azure services used in your subscription.

Microsoft Entra ID has a free tier. You do not need to buy Microsoft 365 merely to obtain that basic directory service. Microsoft may display a billing product called Microsoft Entra ID Free; this is not the Azure hosting subscription you need to select for deployment. [6]

Do not assume that Microsoft's free allowances will cover every resource created by the installer. The installer shows the resources it will create and their estimated monthly cost before it creates anything.

Part 2 — Create what you are missing

Route A — You do not have a tenant or Azure subscription

Use Azure sign-up to get started. A tenant is established when a new organization begins using services such as Azure. You do not need to purchase a Microsoft 365 email plan first. [2]

A1. Open Microsoft's Azure account page

Go to Create an Azure account.

Choose the offer that suits your plans:

Review the offer displayed by Microsoft before accepting it. For an ongoing installation, pay-as-you-go avoids making the application's availability depend on an introductory offer. If you start with the free account, upgrade to pay-as-you-go before the 30 days or the credit end (see Part 4), or the installed application can be shut down. This is a setup recommendation, not a guarantee of a particular monthly cost. [5]

A2. Sign in or create the account requested by Microsoft

1. Select the sign-up button for your chosen offer.
2. If Microsoft asks you to sign in, use an account whose credentials and recovery methods you control.
3. If you have no suitable Microsoft account, select Create one. Follow the prompts to register an existing email address or create a new address, set your sign-in credentials, and verify your details.
4. Return to the Azure sign-up process if registration takes you away from it.

Microsoft also lets you sign up with a GitHub account. For Benedict App, use a Microsoft account (or an existing work or school account) instead, so that the identity matches the organizational-account steps in Part 3.

A personal Microsoft account can be used to start Azure registration. Creating that personal account alone does not create your complete business setup; finish Azure registration and then check the tenant. [7]

If Microsoft recognizes your address as belonging to an existing organization, check with that organization's administrator. Use Route B if it is the tenant you intend to use.

A3. Complete the Azure registration form

Microsoft's standard sign-up flow asks for information about you, phone verification, card verification, and agreement acceptance. [8]

1. Enter the details of the person authorized to set up the account and the business details requested.
2. Choose the country or region that matches the billing address.
3. Use an email address you actively monitor for billing and account notices.
4. Complete phone verification using the method offered.
5. Enter the payment details requested and match the billing address to your bank's records.
6. Review the offer, payment terms, and Microsoft agreement before accepting.
7. Finish registration and open the Azure portal.

If registration is refused, check the information entered and use Microsoft's billing support if the issue continues. Repeatedly creating new accounts is not a reliable way to resolve verification problems.

A4. Confirm that the tenant and subscription exist

In the Azure portal:

1. Search for Microsoft Entra ID using the search bar at the top.
2. Open it and record the organization name and tenant ID.
3. Search for Subscriptions.
4. Open the subscription created during registration.
5. Record its name and subscription ID. [9]

The tenant may initially have a generic name, such as Default Directory, or a Microsoft-generated onmicrosoft.com domain. Verify that this is the environment you just created rather than a different organization you can access.

Do not create another tenant simply because its initial name is unfamiliar. First confirm the tenant ID and the subscription associated with it.

Checkpoint: You can open Microsoft Entra ID and see an Azure hosting subscription. Continue to Part 3.

If you see a separate “Create tenant” option

You normally do not need it after completing the route above. Microsoft restricts creation of additional workforce tenants through the admin-center flow to paid customers. At the time of checking, Microsoft's documentation also requires that your home tenant has at least one paid, license-based Microsoft product (free and trial licenses do not qualify), and that your account holds a tenant-creation role such as Tenant Creator (or sufficient billing permissions). The creation page may also offer a Governed Workforce option, which sets up a governance relationship with your home tenant; choose it only if your administrator wants that. A disabled option does not automatically mean that your Azure sign-up failed. [10]

If your administrator deliberately creates a separate tenant, select the ordinary Microsoft Entra ID / workforce option. Consumer identity tenants, such as External ID external tenants or Azure AD B2C, are a different type of environment.

For an eligible paid customer who needs an additional tenant:

1. In the Azure portal, open Microsoft Entra ID → Overview → Manage tenants → Create.
2. Choose Microsoft Entra ID for a workforce tenant.
3. Enter the organization name and an available initial domain prefix.
4. Choose the correct country or region; do not leave an unrelated default.
5. Review and create the tenant, then switch into it.
6. Follow Route B to obtain an Azure subscription in that tenant. Creating the tenant alone does not create the hosting subscription. [10]

Route B — You already have a tenant but need an Azure subscription

Use an account from the tenant that will host Benedict App. If the company has a Microsoft partner or centrally managed Azure billing, ask them to create or provide the subscription in that tenant.

B1. Check for an existing subscription

1. Sign in to the Azure portal with your organization's work or school account.
2. Open Settings → Directories + subscriptions.
3. Confirm that Current directory is the intended organization. Switch if needed.
4. Search for Subscriptions and check the list.
5. Check the subscription filters before concluding that there are no subscriptions. [11]

An empty list only tells you that no subscription is visible to your current account with the current settings. Your administrator may need to grant access.

B2. Add an Azure subscription

Start with Subscriptions → Add while signed in to the intended organization.

If this is your organization's first Azure subscription: the page may show a list of offers or direct you to registration. Choose the appropriate Azure offer, then complete the payment details and agreement. Check that you remain signed in with the intended organizational account. [1]

If your organization already has Azure billing: you may instead see the subscription-creation form below.

If your organization already has a Microsoft Customer Agreement billing account and you have the necessary billing permission:

1. Open Subscriptions → Add.
2. Enter a recognizable name, such as Benedict App.
3. Select the organization's Billing account, Billing profile, and Invoice section.
4. For an ongoing business installation, select Microsoft Azure Plan, rather than a DevTest plan.
5. Open Advanced and confirm the Subscription directory is the intended tenant.
6. Select the appropriate subscription owner and any organization-required management group or tags.
7. Select Review + create, review the details, and create it. [12]

If no suitable offer or billing account is available, ask your administrator, Microsoft billing support, or your Microsoft partner to help establish Azure billing for the existing tenant. If registration asks you to create a personal account, clarify the route before proceeding. Check the resulting subscription's directory before deployment.

Being a Microsoft 365 administrator does not automatically give you permission to create an Azure subscription under every billing account. Billing permissions, Azure resource permissions, and directory administrator permissions are separate. [12][13]

Checkpoint: Your Azure hosting subscription appears in the intended tenant. Continue below.

Part 3 — Prepare the account that will manage the installation

1. Choose the organizational account

If you already have an appropriate work or school account, use it and skip the account-creation steps below.

If you registered Azure using a personal Microsoft account (for example Outlook.com or Hotmail), create a separate organizational account and use it to run the Benedict App installer and as the license email at checkout. Give it a clear name, such as alex-admin@yourtenant.onmicrosoft.com. Keep its credentials under your organization's control and record who is responsible for it.

To create it, while signed in as an administrator allowed to create users:

1. Open the Microsoft Entra admin center.
2. Go to Entra ID → Users → New user → Create new user.
3. Enter the User principal name: the sign-in name before @.
4. Select your tenant's domain from the list after @.
5. Enter a display name and use the generated initial password or set one.
6. Keep the account enabled and use Member for an internal organizational account.
7. Select Review + create, then Create.
8. Save the full sign-in name and initial password securely. [14]

2. Give the account the permissions it needs

Microsoft uses separate permissions for identities and hosting:

Global Administrator does not automatically grant Azure subscription ownership, and Azure Owner does not automatically grant directory administration. [13]

For an existing company environment: ask your administrator to grant or approve the permissions listed in the Benedict App requirements. They may perform directory approval separately. Do not give every app user administrator permissions.

For a new environment you own: the following steps explain how to give a designated administrator broad management access. These are administrative roles, not roles needed for ordinary daily use of Benedict App.

Make a designated account a directory administrator, if needed

Use the original tenant administrator or another account authorized to assign directory roles:

1. In the Entra admin center, open Roles & admins.
2. Open Global Administrator.
3. Select Add assignments and select the designated organizational administrator.
4. Complete the assignment. [15]

Use this role only for a trusted person responsible for administering your tenant. In a managed company environment, your administrator should choose the appropriate permissions rather than following this broad-access example automatically.

Give the designated account access to the Azure subscription

Use an account authorized to assign Azure roles:

1. In the Azure portal, open Subscriptions and choose the intended subscription.
2. Open Access control (IAM) → Add → Add role assignment.
3. Find Owner; it may be under Privileged administrator roles.
4. Under Members, select User, group, or service principal.
5. Choose Select members, find the designated account, and select it.
6. Complete any applicable assignment settings, then Review + assign. [16]

This grants broad access to the selected subscription. A dedicated subscription can make that scope easier to understand. Company administrators may use narrower roles or temporary access that meets the installer's requirements.

Do not remove the original administrator before you have successfully tested the new account and arranged recovery access.

3. Test sign-in and complete security setup

Open a separate browser profile or private window, then sign in using the account you intend to use for installation. Change its initial password if asked and complete Microsoft's additional verification setup.

For Microsoft Authenticator, install Microsoft's app on your phone and follow the on-screen instructions to add a Work or school account, scan the setup code, and approve the test prompt. Keep the phone available for future sign-ins. [27]

New tenants use Microsoft's security defaults to help protect accounts. Follow the registration prompts; do not turn off those protections just to get past a setup error. [17]

Confirm that you can open the right tenant and subscription using this account. In the subscription, open Access control (IAM) → Check access → View my access to inspect your Azure roles. If your organization uses temporary administrator roles, activate the required role through its approved process before installation. [18]

Part 4 — Check billing and protect against surprises

1. Check the subscription status

Open Subscriptions → your subscription → Overview. Confirm the status is Active or Enabled. A disabled or expired subscription is not ready to deploy the application. Resolve any billing warning before continuing. [19]

2. If you started with Azure free credit

For an ongoing installation, arrange the move to pay-as-you-go before the introductory offer ends.

1. Open your free-account subscription in the Azure portal.
2. Select Upgrade subscription or the upgrade banner.
3. Review the payment method and support-plan selection.
4. Read the chargeable-usage terms, then confirm the upgrade. [20]

Use the existing subscription's upgrade process rather than creating a replacement subscription just to continue the installation.

Free-credit subscriptions can have services disabled when their credit limit is reached. Pay-as-you-go subscriptions do not offer the same built-in spending limit. [21]

3. Create a monthly budget alert

1. Open Subscriptions → your subscription → Budgets. It may be inside the subscription's Cost Management menu.
2. Select Add.
3. Name the budget Benedict App monthly monitoring.
4. Choose a monthly reset period and an appropriate end date.
5. Enter an amount based on your planned Azure configuration.
6. Add email alerts, for example at 50%, 80%, and 100% of that amount.
7. Use an email address you monitor, then save. [22]

If the subscription is new, Cost Management features can take up to 48 hours to become available. Return to create the budget if necessary. [22]

A budget alert is a notification, not a spending cap. It does not automatically stop the application or prevent additional charges. Cost and usage data typically arrives 8–24 hours after use, and budgets are evaluated against it about every 24 hours, so an alert can trail real spending by roughly a day. [22][23]

After deployment, open Cost Management → Cost analysis at the subscription scope and review the costs regularly, especially during the first few days. Check that the date range and subscription are correct. [24]

Part 5 — Record your details and continue to installation

Keep a private setup record with these items:

Find the tenant ID under Microsoft Entra ID → Overview or Properties. Find the subscription ID under Subscriptions → your subscription → Overview. Use the copy buttons to avoid typing mistakes. [3][9]

You do not need to buy your own domain to use an onmicrosoft.com organizational sign-in. A custom domain can be added and verified later. [25]

Final readiness check

• I know which tenant will host Benedict App.
• My Azure hosting subscription belongs to that tenant and is active.
• I can sign in with the account intended for installation.
• I can complete that account's additional sign-in verification.
• The installer permissions have been checked or approved by the administrator.
• My installer account matches the applicable purchase and activation instructions.
• The payment details and billing contact are correct.
• I understand that Azure hosting is billed separately from the Benedict App license.
• I have configured a budget alert, or recorded that I must return when it becomes available.
• I have saved the tenant ID, subscription ID, and recovery details securely.

You are ready to buy Benedict App and run the installer. Keep your installation account and verification device available.

Troubleshooting

If you need help, record which step failed and the exact error message. A screenshot can help, but hide passwords, verification codes, payment details, and unrelated personal information. Never send an Authenticator QR code or recovery code.

Contact Microsoft or your Microsoft partner for registration, verification, payment, or subscription-activation problems. Contact Benedict Corp. for questions about the Benedict App installer or license activation. Setting up or administering your Microsoft environment for you is a separate paid service.

Frequently asked questions

Do I need to move my company email to Microsoft?

No. You can use organizational sign-in accounts under the tenant's onmicrosoft.com domain. Custom-domain verification is optional for this initial setup. Do not change your existing email-routing records just to prepare Azure. [25]

Do all Benedict App users need administrator access?

No. The account used to install and administer cloud resources has a different purpose from an ordinary app user's account. People who only use Benedict App need an ordinary work account in your tenant.

Should I create a new tenant if I already use Microsoft 365 for business?

Usually, reuse the existing tenant. A separate tenant is an organizational design choice that your administrator should make deliberately. It also requires separate user and access management.

Can I use an existing Azure subscription?

Yes, if your organization approves its use and it meets the current installer requirements. A separate subscription is an option for keeping hosting access and costs easier to identify; it is not automatically necessary.

Is it enough to see “Microsoft Entra ID Free” in billing?

No. That is the directory-related billing product. Confirm that you also have an Azure hosting subscription available for deployment. [6]

Will closing the browser stop Azure charges?

No. After installation, Azure resources run independently of your browser. Use the installer's Remove this installation function if you decide to remove the application, and review the subscription for remaining chargeable resources. Avoid cancelling a shared subscription that hosts other company services.

Microsoft references

These official resources explain the Microsoft account and subscription procedures used in this guide.

1. Subscriptions, licenses, accounts, and tenants
2. Set up a Microsoft Entra tenant
3. Find your tenant ID
4. Personal Microsoft accounts and work or school accounts
5. Azure account options and sign-up requirements
6. Microsoft Entra ID Free billing product
7. Create an Azure account
8. Azure sign-up walkthrough and troubleshooting
9. Find subscription and tenant IDs in the Azure portal
10. Create a new tenant and check eligibility
11. Switch directories and manage subscription filters
12. Create a Microsoft Customer Agreement subscription
13. Microsoft Entra and Azure roles: frequently asked questions
14. Create users in Microsoft Entra ID
15. Assign Microsoft Entra administrator roles
16. Assign Azure resource roles
17. Microsoft Entra security defaults
18. Check your Azure access
19. Azure subscription status
20. Upgrade an Azure free account
21. Azure spending limits
22. Create and manage budgets
23. Cost alerts
24. Review Azure costs with Cost Analysis
25. Initial and custom tenant domains
26. Administrator accounts and service licensing
27. Add a work or school account to Microsoft Authenticator