MICROSOFT LICENSING · MODULE 3 · ENTRA ID
Microsoft Entra ID: Free, P1, P2, or Entra Suite
Which licence do you actually need?
Microsoft Entra ID protects sign-ins and manages identities. This guide clearly explains when Free is enough, when P1 or P2 is required, and why governance, guests, and application identities follow different rules.
Short answer
The feature, identity, and scope decide—not the tenant alone.
One Premium licence may make settings technically visible, but it does not automatically license every user. Define the required capability first, then the affected people or identities, and only then calculate the correct licence quantity.
- 01Free provides the identity foundation and Security Defaults.
- 02Conditional Access requires at least Entra ID P1.
- 03Risk-based policies require P2; PIM works with P2 or ID Governance.
- 04Employees, guests, and application identities use different billing rules.
Explained simply · The essential terms
Three terms for secure access
Entra ID decides who signs in and under which conditions an application may be used.
Conditional Access
If-then rules for sign-ins—for example, requiring MFA when someone connects from an unfamiliar location.
PIM
A process that activates powerful administrator rights only when needed and for a limited time.
Identity Governance
Rules and workflows that grant access, review it regularly, and remove it again.
A practical example: An administrator needs a highly privileged role only for one change. With PIM, she activates it for one hour, completes MFA, and automatically loses the extra right afterwards.
Clearly explained
What is Microsoft Entra ID?
Microsoft Entra ID was previously called Azure Active Directory. In simple terms, it is the digital sign-in and access control for Microsoft 365, Azure, and many other applications.
Who is signing in?
Entra ID manages users, groups, guests, applications, and other digital identities.
What may they access?
Sign-in rules determine which applications and resources an identity can reach.
Under which conditions?
MFA, device, location, risk, and other signals can allow, limit, or block access.
Visible does not mean licensed
An administrator seeing or enabling a feature in the portal does not prove that the organisation owns sufficient rights.
Licence levels
Free, P1, P2, Governance, and Suite at a glance
Some levels build on each other. Identity Governance and the Entra Suite are separate products with prerequisites—not merely new names for P2.
| Product | Typical purpose | Important examples |
|---|---|---|
| Entra ID Free | Identity foundation | Users and groups, SSO, basic reports, Security Defaults, and basic MFA |
| Entra ID P1 | Targeted access control | Conditional Access, dynamic groups, App Proxy, and advanced identity management |
| Entra ID P2 | Risk protection and privileged access | Identity Protection, risk-based policies, and Privileged Identity Management (PIM) |
| Entra ID Governance | Lifecycle and access decisions | Access Reviews, Lifecycle Workflows, access packages, and further governance capabilities |
| Microsoft Entra Suite | Identity and network access together | P2 identity protection, ID Governance, Private Access, Internet Access, and Verified ID Premium |
Individual capabilities can have different prerequisites or scopes. Current Microsoft documentation, Product Terms, the exact SKU, and contract conditions remain decisive.
Already included?
Check the existing Microsoft 365 plan before buying more
Many organisations already own P1 or P2 through a suite. Buying the same standalone entitlement again would often mean paying twice.
Microsoft 365 E3 and Business Premium
Microsoft lists Entra ID P1 as included in Microsoft 365 E3 and Microsoft 365 Business Premium. Other eligible bundles can include it too.
Microsoft 365 E5
Microsoft 365 E5 includes Entra ID P2. That does not automatically mean every new governance capability is also part of P2.
Microsoft 365 E7
Microsoft lists the Entra Suite as included in Microsoft 365 E7. Availability, contract, and actual service plans still need checking.
Frontline, education, government, and step-ups
F plans, education, government, and existing P2 rights have dedicated variants and step-up products. The exact orderable SKU matters.
Billing > Licences in the Entra or Microsoft 365 admin centre shows which products and service plans are actually present in the tenant.
Sign-in rules
Security Defaults, Conditional Access, and risk-based policies are different
All three protect sign-ins, but their control and licensing differ significantly.
Security Defaults
A free security baseline with predefined protections. It is deliberately simple and less granular than Conditional Access.
Conditional Access
If-then policies based on user, group, app, location, device, or other signals. Every user to whom a Premium policy applies or who benefits from it needs the relevant entitlement.
Risk-based access
Sign-in Risk and User Risk from Identity Protection can trigger controls. Risk-based Conditional Access requires P2 or a suite containing that right.
If a Conditional Access policy protects 500 users, all 500 affected users need P1 or a higher included entitlement—not only the person who created the policy.
P2 and privileged rights
Identity Protection and PIM solve two different problems
Identity Protection evaluates risk. PIM limits highly privileged administrator rights in time. Both support security, but they are not licensed identically.
Is the sign-in or user risky?
Full risk details, alerts, and risk-based policies require Entra ID P2 or Entra Suite.
Must an admin role remain permanently active?
PIM activates roles for a limited period and can require MFA, justification, or approval. PIM is available with P2 or Entra ID Governance.
Who needs a licence?
The count includes eligible or time-bound role holders, approvers, and people performing or undergoing access reviews in the PIM context.
Microsoft explains that eligible assignments and ongoing reviews can be removed or stopped. Treat expiry as a planned security change, not a routine purchasing event.
Identity Governance
Governance follows the feature scope—not merely technical assignment
Identity Governance controls who receives access, reviews it regularly, and removes it automatically when appropriate.
| Example | Licences required | Why? |
|---|---|---|
| Access Review for 500 members, reviewed by 3 group owners | 503 member users | Reviewed people and reviewers are in the governance scope. |
| An access package can be requested by all 2,000 employees | 2,000 member users | Who can request it matters—not only who has already requested it. |
| PIM for 14 administrators plus 3 approvers | 17 users | Role holders and approvers need a valid P2 or Governance entitlement. |
| Governance for B2B guests | MAU billing | Guests use Monthly Active Users and a linked Azure subscription. |
The organisation must still own enough licences for every member user in scope of, or configuring, a Governance capability. A small quantity with a large policy scope is not a valid optimisation.
Entra Suite
When is the Suite useful—and when is it not?
The Entra Suite combines identity protection, governance, and identity-centric network access. It becomes attractive when several of these building blocks are genuinely needed.
P1 remains the foundation
The Entra Suite requires Entra ID P1 or a bundle containing P1. The Suite does not replace that prerequisite.
More than P2
The Suite includes ID Protection, ID Governance, Private Access, Internet Access, and Verified ID premium capabilities.
Consider existing rights
Step-up or special pricing may apply to P2 and Microsoft 365 E5 customers. Compare standalone products and Suite against the existing baseline.
Licence benefiting users
Determine which users benefit from each capability. A blanket tenant purchase is not automatically required—but underlicensing is not acceptable either.
Other identity types
Guests and applications are not licensed like employees
A common mistake is to treat every directory object as a conventional user.
Guests and customers
External ID uses a Monthly Active User model for external users. The first 50,000 monthly active external users currently receive core capabilities free; premium add-ons can create additional charges.
Governance actions for guests
Guest governance requires an Azure subscription for MAU billing. Guests with relevant governance actions in a month are included in the bill.
Apps, automation, and service principals
Conditional Access for service principals requires Workload Identities Premium. Existing user P1/P2 licences do not automatically cover them.
AI agents
Agents can additionally require Microsoft Agent 365, P1/P2, and other product rights. Preview and rollout rules need a separate check.
Decision guide
Which licence fits which need?
This table offers orientation for common situations. Mixed scenarios may require several products at once.
| Need | Typical minimum approach | Also check |
|---|---|---|
| Users, groups, SSO, and a simple security baseline | Entra ID Free | Are Security Defaults granular enough? |
| Targeted MFA and access policies for users | Entra ID P1 | Licence every user in policy scope |
| Risk-based policies and full risk details | Entra ID P2 or Entra Suite | Every protected user needs the entitlement |
| Time-limited admin roles with PIM | P2 or ID Governance | Role holders, approvers, and reviewers count |
| Lifecycle Workflows, Access Reviews, and advanced access packages | ID Governance or Entra Suite | P1/P2 prerequisite and full feature scope |
| Identity-centric private and internet access | Entra Suite or suitable standalone products | P1 baseline and benefiting users |
| Conditional Access for service principals | Workload Identities Premium | Number of protected workload identities |
| External guests or customers | External ID by MAU | Azure link and premium add-ons |
Cost examples
Public list prices make the scope visible immediately
Examples use Microsoft's public German list prices on 22 August 2026 with annual billing, excluding VAT. Contract pricing may differ.
| Product | List price | Example for 100 |
|---|---|---|
| Entra ID P1 | €6.10 / user / month | €610 monthly · €7,320 annually |
| Entra ID P2 | €8.70 / user / month | €870 monthly · €10,440 annually |
| Entra ID Governance | €6.10 / user / month | €610 monthly · €7,320 annually, plus prerequisite |
| Microsoft Entra Suite | €10.40 / user / month | €1,040 monthly · €12,480 annually, plus P1 baseline |
| Microsoft Entra Workload ID | €2.60 / workload / month | €260 monthly · €3,120 annually |
If Microsoft 365 E3, Business Premium, E5, E7, or another bundle already includes the entitlement, evaluate only the missing component. Existing P2 customers may have different step-up prices.
Before purchase and activation
The Entra licensing checklist
These questions turn a technical request into a defensible licensing decision.
- 01Which exact capability is required—not merely which product name?
- 02Are employees, guests, workload identities, or agents affected?
- 03Which users are fully inside the policy, review, or governance scope?
- 04Which Entra service plans already exist in Microsoft 365, EMS, or other bundles?
- 05Does the add-on require P1, P2, F2, or another active base plan?
- 06Must role holders, approvers, reviewers, or administrators be counted too?
- 07Is an Azure subscription linked for guest MAU billing?
- 08Are price, SKU, Product Terms, agreement, and purchase date documented?
Document the capability, scope, identity types, existing prerequisites, and licence quantity together. That connection makes the decision auditable.
Remember
Entra licensing follows the protected identity in the capability scope—not the switch in the portal.
Free provides the foundation, P1 controls access, P2 evaluates risk, Governance manages the access lifecycle, and the Suite connects identity with network access. Guests and application identities use their own models.
Official sources
Checked against current Microsoft documentation.
This article reflects the publicly documented position on 22 August 2026. Product names, feature mappings, prices, and prerequisites can change.
- 01Microsoft Learn: Microsoft Entra licensing↗Open source
- 02Microsoft Learn: Conditional Access licensing and capabilities↗Open source
- 03Microsoft Learn: Microsoft Entra ID Protection risk policies↗Open source
- 04Microsoft Learn: Microsoft Entra ID Governance licensing fundamentals↗Open source
- 05Microsoft Learn: External ID pricing and monthly active users↗Open source
- 06Microsoft Learn: Conditional Access for workload identities↗Open source
- 07Microsoft: Microsoft Entra plans and pricing↗Open source
Note: This article provides clear practical orientation and does not replace checking current Microsoft Product Terms, the specific agreement, orderable SKU, purchase date, and actual tenant configuration.