Entra ID P1 vs P2: what the extra $3 buys you
By Michal Lampe Sørensen · 7 min read · 1 October 2026
Verified against Microsoft Learn, September 2026
Contents
In short
Microsoft Entra ID P1 is $7/user/month and P2 is $10/user/month, both on an annual commitment. P1 gives you Conditional Access, SSPR with writeback and MFA for on-premises apps. P2 adds four things: risk-based Conditional Access, Entra ID Protection, Privileged Identity Management and access reviews. If you have Microsoft 365 Business Premium, E3, F1 or F3 you already have P1. Among the Microsoft 365 plans, only E5 and E7 include P2. And you rarely need P2 for everyone: for PIM, Microsoft counts only the users who are eligible, approvers or reviewers.
The price, and what you may already have
Microsoft's list prices are $7/user/month for P1 and $10/user/month for P2. Both are stated as "user/month, paid yearly (annual commitment)".
Many organizations pay neither price, because one of the editions is already bundled into a Microsoft 365 plan. Microsoft's licensing documentation is explicit about which:
| Edition | Included in |
|---|---|
| Entra ID P1 | Microsoft 365 E3, E5, E7, F1, F3, Business Premium, Enterprise Mobility + Security E3 |
| Entra ID P2 | Microsoft 365 E5, E7, Microsoft Defender Suite (formerly E5 Security), Enterprise Mobility + Security E5 |
Note that Business Premium includes P1, not P2. Business Premium gives you Conditional Access, but not the risk-based version, and not PIM.
If you run Business Premium and want P2, Microsoft names a route other than the standalone license: Defender Suite for Microsoft 365 Business Premium includes P2.
Entra ID Governance is $7/user/month and Entra Suite is $12/user/month. The Suite requires a P1 license or a package that includes P1, and it is included in Microsoft 365 E7.
What P1 adds over the free edition
Entra ID Free comes with Microsoft's cloud subscriptions, Microsoft 365 and Azure among them. It can do MFA through Authenticator and SSPR, but it cannot apply conditions.
What P1 unlocks is access control:
- Conditional Access
- The policy engine that decides who may sign in, from where, and on which device. Absent from Free entirely.
- SSPR with writeback
- Password resets written back to an on-premises Active Directory. Relevant if you run hybrid.
- MFA for on-premises applications
- MFA in front of apps that are not in the cloud.
- Trusted IPs, fraud alert and MFA reports
- The operational side of MFA that Free lacks.
- Application Proxy
- Publishing on-premises web apps without a VPN.
- Custom roles
- Role management beyond the built-in roles. Requires P1 for each user holding a custom role assignment. Administrative units can be created on Free, but each unit administrator needs P1.
- Logging and insight
- Provisioning logs, Graph activity logs, Health, and the usage and insights reports, all require P1 or P2.
If access control is what you need, P1 covers it.
What P2 adds over P1
P2 adds four things, and all of them are about risk and privilege rather than access.
Entra ID Protection. Microsoft describes this as a P2 feature. It scores risk on users and sign-ins and can act on it.
Risk-based Conditional Access. Ordinary Conditional Access is P1. Policies that react to *risk* require ID Protection, and therefore P2.
Privileged Identity Management. Time-bound, approval-gated admin rights instead of permanent ones. Covers PIM for Groups too.
Access reviews and entitlement management. Recurring checks on whether people still need the access they hold, and access packages users can request themselves.
| Feature | Free | P1 | P2 |
|---|---|---|---|
| Conditional Access | no | yes | yes |
| Risk-based Conditional Access | no | no | yes |
| Entra ID Protection, risk policies | no | no | yes |
| Privileged Identity Management | no | no | yes |
| Access reviews | no | no | yes |
| SSPR with writeback | no | yes | yes |
| MFA for on-premises apps | no | yes | yes |
What P1 can actually see of risk
ID Protection is listed as a P2 feature, but Microsoft's own table shows P1 gets limited access to parts of it. The difference matters if you are weighing staying on P1:
| Report | Free and P1 | P2 |
|---|---|---|
| Risky users | Only medium and high risk users. No details drawer, no risk history. | Full access |
| Risky sign-ins | Shown without risk detail or risk level. | Full access |
| Risk detections | Free: no. P1: limited, no details drawer. | Full access |
On P1 you get a signal without the detail, and without the option of having a policy react to it automatically.
The second detail: some things that used to be P2 now require Entra ID Governance ($7/user/month). For entitlement management and access reviews, Microsoft writes that they require an ID Governance subscription, and that "some capabilities within this feature can operate with a Microsoft Entra ID P2 subscription". Lifecycle Workflows require ID Governance and are not in P2 at all. If you are buying P2 purely for access reviews, read that page first.
You rarely need P2 for everyone
P2 is a per-user license, but for PIM it only applies to the users actually involved.
Microsoft states you need P2 or ID Governance for: users with eligible or time-bound role assignments, users who can approve or reject activations, users assigned to an access review, and users who perform reviews.
Microsoft's own examples from the documentation:
10 administrators, 5 made eligible
Five licenses. The other five hold permanent assignments and do not count.
25 administrators, 14 managed through PIM, 3 approvers
17 licenses. 14 eligible plus 3 approvers.
50 administrators, 42 through PIM, 5 approvers, 6 external reviewers
53 licenses.
Access reviews work differently: there everyone whose access is reviewed counts, plus the reviewers. Microsoft's example is a review of a group with 75 members and 1 owner as reviewer, so 76 licenses.
For an organization with 200 users and 8 administrators, the gap between licensing everyone and licensing the eight is $23,040 a year. $24,000 against $960.
How to choose, and what happens if you stop
Work out what you already have
Business Premium, E3, F1 or F3 means you have P1. E5 or E7 means you have P2 and need to buy nothing.
Decide whether the need is access or risk
If you need to control who signs in from where, P1 is enough. If the system should react to suspicious behavior, or admin rights should be temporary, that is P2.
Count only the users in scope
For PIM that is the eligible users plus approvers plus reviewers. Not the whole organization.
Check whether ID Governance is the right buy instead
If the point is access reviews and automated lifecycles, ID Governance at the same $7 may be the correct product.
Compare against moving up a plan
E3 at $39 plus P2 at $10 is $49. E5 at $60 includes P2 and a great deal more. If you are close to needing E5 anyway, the jump can cost less than the sum of add-ons.
Microsoft states that Conditional Access policies are not automatically disabled or deleted when the license expires, so you can migrate away without your security posture collapsing overnight. Remaining policies can be viewed and deleted, but no longer updated.
PIM behaves differently: when the license expires, eligible role assignments are removed, ongoing access reviews end, and PIM configuration is dropped. Permanent role assignments are unaffected.
Sources: Microsoft Entra licensing (Microsoft Learn, updated 18 June 2026), Microsoft Entra pricing, What is Microsoft Entra ID Protection (Microsoft Learn) and Privileged Identity Management (Microsoft Learn).
See which Entra edition your plan includes
Compare all 10 Microsoft 365 plans and see what each one includes.
Compare plansFrequently asked questions
What is the difference between Entra ID P1 and P2?+
P1 gives you access control: Conditional Access, SSPR with writeback, MFA for on-premises apps, Application Proxy and custom roles. P2 adds four things on top: risk-based Conditional Access, Entra ID Protection, Privileged Identity Management and access reviews. The price difference is $3/user/month, $7 against $10 on an annual commitment.
How much do Entra ID P1 and P2 cost?+
Microsoft's list price is $7/user/month for P1 and $10/user/month for P2, both on an annual commitment. Entra ID Governance is also $7/user/month, and Entra Suite is $12/user/month and requires P1 already in place.
Is Entra ID P2 included in Microsoft 365 Business Premium?+
No. Business Premium includes P1. The confusion arises because Business Premium has Conditional Access, which many associate with premium identity. To get P2 alongside Business Premium, Microsoft names Defender Suite for Microsoft 365 Business Premium as the route, and the standalone license is $10/user/month.
Which licenses include Entra ID P2?+
Among the Microsoft 365 plans, E5 and E7. Beyond those, Microsoft Defender Suite (formerly Microsoft 365 E5 Security), Defender Suite FLW, Defender + Purview Suite FLW and Enterprise Mobility + Security E5 also include P2. P1, by contrast, ships with E3, E5, E7, F1, F3, Business Premium and EMS E3.
Does every user need Entra ID P2?+
Not for PIM. Microsoft requires a license only for users with eligible or time-bound role assignments, users who can approve activations, and users who are in or perform an access review. Microsoft's own example: 25 administrators of which 14 are managed through PIM plus 3 approvers needs 17 licenses, not 25. For access reviews, everyone whose access is reviewed does count.