Who needs the Entra license? The rule is per feature

Microsoft documents the licensing requirements feature by feature on one page in the Entra documentation, and it is considerably more precise than the pricing page. Two principles run through all of it:

The license attaches to the user account

Not to the tenant and not to the person. If an employee has two accounts that both sign in, they count as two.

Whoever benefits from the feature needs the license

That is why a single Conditional Access policy covering the whole organization requires P1 for the whole organization.

The base level comes with the plan. Entra ID P1 is in Microsoft 365 E3, E5, E7, F1, F3, Enterprise Mobility + Security E3 and Business Premium. Entra ID P2 is in E5, E7, Microsoft Defender Suite, Defender Suite FLW, Defender + Purview Suite FLW and EMS E5. On Business Premium, P2 only arrives if you add Defender Suite.

Without a plan that includes them, list price is $7 for P1 and $10 for P2 per user per month. Entra ID Governance is $7 and Entra Suite is $12. The Suite requires P1 underneath it, so for a user without a plan that includes P1 it comes to $19 in total.

Security defaults are free for everyone and need no P1. In return they cannot be scoped to particular groups or customized, which is exactly why most organizations end up in Conditional Access.

Privileged Identity Management requires P2 or Entra ID Governance, and Microsoft names exactly which users the license has to cover. The list is longer than "the people with privileged roles":

• •Users with eligible or time-bound assignments to Entra ID roles or Azure roles managed through PIM
• •Users with eligible or time-bound assignments as members or owners of PIM for Groups
• •Users able to approve or reject activation requests
• •Users assigned to an access review
• •Users who perform an access review

The last three are the ones that move the arithmetic. The approver does not use a privileged role, and the person reviewing someone else's access gains no new access. They still need the license. Put a department head in charge of approving activations because it is sound separation of duties, and you have extended the licensing requirement into management.

The same pattern applies to access reviews, entitlement management and Lifecycle Workflows. Microsoft writes that these require an Entra ID Governance license for the organization's member users, and for access reviews it says explicitly that this includes all employees who are reviewing access or having their own access reviewed.

Microsoft itself adds that some capabilities in those three areas may work with P2 alone. Which ones it does not say. That caveat is worth carrying with you if you build an audit control on top of P2 and assume it holds.

And the license is not always enough on its own. Since January 30, 2026, Entra ID Governance requires a linked Azure subscription if you use governance features on guest users. Without one, creating or updating policies scoped to guests is blocked, and access reviews for guests were brought into enforcement in March 2026. You hold the license, but the feature stays shut until an Azure subscription sits behind it.

Two Entra features behave in opposite ways here, and the difference matters if you are considering a downgrade or a plan change.

Conditional Access: the policies stay. Microsoft does not automatically disable or delete them, precisely so you can migrate away from Conditional Access without your security posture dropping overnight. You can view the policies and delete them, but you cannot update them. A rule set you can no longer edit is a different thing from a rule set that is gone, and it is worth knowing before someone discovers it in the middle of an incident.

PIM: things disappear. Permanent role assignments are unaffected, but eligible role assignments are removed, because nobody can activate a privileged role any more. Ongoing access reviews end, the PIM configuration is removed, and PIM stops sending mail about role assignment changes.

Requirements that appear in no plan comparison, because they follow the feature rather than the plan:

And a newer one: Conditional Access for AI agents requires a Microsoft Agent 365 license. You get it with Microsoft 365 E7, or as an add-on on top of at least Entra P1 or Microsoft 365 E3.

Four questions that uncover most of it in a morning:

• •Which Conditional Access policies do you have, and who do they cover? Count the users the policies apply to, not the users you have assigned a license. The gap is your exposure.
• •Who can approve in PIM, and who reviews access? Those names belong on the license list, even if they never activate a role themselves.
• •Do you have custom roles or dynamic administrative units? Both extend the P1 requirement to users nobody had in mind.
• •Do you have service accounts, or a second admin account per person? They count as user accounts.

Microsoft reserves the right to have an auditor verify that licensing covers actual use, and the terms set out the consequences when it does not. That is the real reason to know the rules per feature and not only per plan.

Sources: Microsoft Entra licensing (Microsoft Learn) and Microsoft Entra plans and pricing (Microsoft).