Monthly Active Users

What Monthly Active Users Measures

Monthly active users, or MAU, is a billing and usage metric built around authentication, not continuous consumption. It counts each unique user who signs in at least once during a month, so it captures reach and engagement rather than how heavily a person or account used the service after logging in.

That makes MAU useful for simple subscription pricing and for broad adoption tracking, but it is a coarse proxy. A user who opens the product once counts the same as a user who authenticates every day, and a burst of one-off logins can inflate the month even when underlying workload or infrastructure demand stays modest.

Why MAU Can Diverge From Real Consumption

MAU is tied to identity events, so it behaves differently from meters that measure sessions, compute time, transactions, or bandwidth. If the same person logs in repeatedly, MAU still counts that person once; if many people log in briefly during a campaign or incident, MAU can rise sharply without a matching rise in steady-state service use.

This gap matters because the metric can overstate operational demand when access is intermittent. It is common in SaaS, digital products, and internal platforms where authentication is easy, but actual resource use varies widely after login.

In practice, MAU is best read alongside product telemetry, cost drivers, and user engagement patterns, not as a standalone indicator of load or value.

How MAU Is Counted and Where Ambiguity Appears

The simplest MAU rule is “one authenticated user, one count, per month,” but implementation details matter. Teams must decide whether the unit is a human user, a customer account, an email address, or some other identity record, and whether shared logins, service accounts, or duplicated profiles are included.

Those choices can materially change the number. If an organisation collapses multiple logins into one account, MAU may undercount actual people; if it counts every distinct credential or tenant record, MAU can overcount the real user base.

Because MAU is often used in billing, board reporting, and growth analysis, definitions should be explicit and stable over time. Otherwise the metric becomes difficult to compare month to month.

What MAU Does and Does Not Tell You

MAU is useful for understanding how many distinct users returned during a billing cycle, but it does not explain depth of use, feature adoption, retention quality, or cost pressure on its own. Two products can have the same MAU and very different infrastructure profiles, support burdens, and revenue efficiency.

It is also sensitive to calendar effects, product launches, seasonal activity, and authentication design. A month with a single spike can look stronger than a month with steadier value creation, even though the underlying economics are reversed.

For that reason, MAU is usually most meaningful when paired with frequency, stickiness, conversion, or revenue-per-user measures that show how much actual activity sits behind each authenticated user.

Risk and Threat Considerations

Because MAU depends on authentication events, it can be distorted by bot activity, duplicate identities, test accounts, or abnormal login spikes. That can mislead billing, capacity planning, or growth reporting when the count is treated as a precise measure of real customer activity.

Failure mechanism: inflated or noisy authentication events enter the monthly count, while the underlying user base, workload demand, or business value does not change in the same way.

Impact: organisations can overpay, overestimate adoption, or misread a product trend, which can delay corrective action and make later reporting less trustworthy.

Practitioner Guidance

Why practitioners should care: MAU is only reliable when the counting rule matches the business question. If the metric is used for billing, product analytics, or executive reporting, the definition must be consistent enough that month-to-month changes reflect real movement rather than tracking noise.

What to watch for: unusually large month-end spikes, repeated test logins, shared credentials, and account duplication are all signs that MAU may be measuring access activity more than genuine user demand. The safest interpretation is to treat MAU as a coarse reach metric unless the underlying identity population and counting rules are controlled.

Related resources from NHI Mgmt Group

• Who is accountable when SSO leaves users active after offboarding?
• What breaks when non-privileged users can create machine accounts in managed Active Directory?
• How should teams migrate active sessions without forcing users to log in again?
• How should security teams manage SaaS app access when many licensed users are not active users?