Entra ID P2 for SMBs: the pricing trap nobody mentions

Microsoft 365 Business Premium ($22/user/mo, up to 300 users) includes Entra ID P1. P1 is what gives you Conditional Access, the rules engine where you can require MFA, block legacy authentication protocols and allow only managed devices. For most SMBs, P1 is a perfectly defensible foundation.

Entra ID P2 ($10/user/mo list price) adds two things that genuinely matter in an organization without its own security team:

Entra ID Protection. Microsoft scores every sign-in and every account for risk. A sign-in from a new device in another country gets one risk score; an account whose password shows up in a breach dump gets another. With P2 you can write Conditional Access policies that react to that score: require MFA every time on medium or high sign-in risk, and require remediation (typically a password change plus revoking all sessions) on high user risk. With P1 you can see the dashboard, but the detail on individual risk detections is hidden, and you cannot use the risk level as a condition in a policy.

Privileged Identity Management (PIM). Instead of leaving an admin role permanently attached to someone's everyday account, you make the role *eligible*. The user activates it when needed, with MFA and a business justification, and it expires automatically. That removes standing privilege from exactly the accounts most likely to get phished.

P2 also includes Access Reviews and Access Packages. Those are built for organizations with many guest users, contractors and project-based access, and they're rarely the deciding factor for an SMB.

This is where Microsoft's licensing model gets lopsided, and it's worth understanding before you negotiate.

Both Microsoft 365 Business Premium and Microsoft 365 E3 include Entra ID P1. You'd expect the upgrade to P2 to cost the same for both. It doesn't.

The E3 step-up is a programmatic upgrade: you pay only the difference between P1 and P2. It doesn't exist for Business Premium. As an SMB you buy the full P2 license, even though you're already paying for P1 inside Business Premium.

The math for 100 users on an annual commitment:

• •E3 organization: 100 × $3 × 12 = $3,600 a year
• •Business Premium organization: 100 × $10 × 12 = $12,000 a year

That's $8,400 extra per year for identical functionality, purely because you're under 300 users.

Microsoft sells an add-on available only for Business Premium: Microsoft Defender Suite for Business Premium. It sits at the same price level as the bare Entra ID P2 license, but per Microsoft's own documentation it contains:

• •Microsoft Entra ID P2 (Identity Protection, PIM, Access Reviews)
• •Microsoft Defender for Endpoint Plan 2 (threat hunting, live response, six months of device data retention)
• •Microsoft Defender for Office 365 Plan 2 (automated investigation and response, attack simulation training, threat explorer)
• •Microsoft Defender for Identity (ITDR, identity monitoring across the organization)
• •Microsoft Defender for Cloud Apps (shadow IT discovery and app governance)

So if you have a concrete need for risk-based Conditional Access or PIM, and the price lands around $10/user/mo either way, there's no good reason to buy P2 on its own. You get four additional security products for the same money.

Not using every feature from day one isn't an argument against it. Defender for Endpoint P2 and Defender for Office 365 P2 upgrade protection you're already running at P1 level in Business Premium, so they work the moment the license is assigned.

P2 is not a substitute for a properly configured P1. If Conditional Access isn't in place, MFA coverage has gaps, or several people share an admin account, fix that first. It costs nothing but time, and it buys more security than any add-on.

P2 starts making sense when:

• •You want permanent admin rights gone from ordinary user accounts, and PIM is the only built-in way to do that
• •Nobody is watching sign-in logs during the day, so automated response to suspicious sign-ins is the only realistic monitoring you'll get
• •You need to document identity security to a cyber insurer, an auditor or a customer, and P1 doesn't cover it
• •You're working on NIS2 and need access control that can be audited, not just configured

And conversely: 12 employees, one person who touches Admin Center, no regulatory requirements? Business Premium with a tight Conditional Access setup is a perfectly sensible place to stop.

Two policies deliver almost all the value, and both can be set up in a morning.

1. Sign-in risk: require MFA every time. Target all resources, set the condition to medium and high sign-in risk, require MFA under Grant, and set sign-in frequency to "every time" under Session. If you run Intune, require a compliant device as well. The user isn't challenged because they signed in, but because Microsoft found something unusual about that particular sign-in.

2. User risk: require remediation. Target high user risk and choose "require risk remediation" as the Grant control. For a password-based account that means a secure password change plus revoking all sessions. The point isn't just that Entra spots a compromised account, but that it gets acted on without anyone having to notice the alert first.

Three things that go wrong every time if you don't plan for them:

• •Exclude your emergency accounts. Break-glass accounts must never depend on Conditional Access, PIM approvals or MFA methods that can fail. Exclude them explicitly and monitor them instead.
• •Run in report-only mode first. Put the policy in report-only or target a pilot group before it hits everyone. You'll see the effect in the sign-in logs without locking anyone out.
• •Don't make Global Administrator a PIM-eligible role just because it's just-in-time. Pick the least-privileged role that does the job. PIM limits when the privilege is active, not how much damage it can do while it is.

If you use third-party MFA such as Duo, it must be configured as an External Authentication Method in Entra, and the policy should require "MFA" rather than a specific authentication strength. External MFA methods don't currently satisfy any authentication strength.

Sources: Microsoft Entra plans and pricing, Add Microsoft Defender Suite for Business Premium to your subscription (Microsoft Learn), Sign-in risk-based multifactor authentication (Microsoft Learn) and Entra ID P2 for SMBs: Is it Worth It and Which License to choose? (SMBtotheCloud, 25 August 2026).