Microsoft Entra ID P1 vs P2: Which License Do You Actually Need?

The reseller blogs will list every feature in both tiers and let you sort it out. Here is the version I give people who have to sign the purchase order: buy P1 for everyone, buy P2 for the accounts that can hurt you, and stop paying for things the Free tier already does.

New to cloud? CAMPUX is a free, build-first course. Start here →

Microsoft Entra ID P1 covers the core enterprise identity features — Conditional Access, self-service password reset, dynamic groups — while P2 includes everything in P1 plus risk-based protection (Identity Protection) and privileged access governance (PIM and access reviews). Most organizations need P1 for everyone and P2 only for admins and other privileged users. Licenses are assigned per user, so mixing the two tiers in one tenant is allowed — just verify current licensing terms for the specific feature you switch on, because a few of them count more users than you expect.

The rest of this note is the reasoning, where the licenses actually come from, and the part nobody selling licenses wants to tell you: what the Free tier already covers, so you do not overbuy. If you are new to the product itself, read what Microsoft Entra ID actually is first, then come back for the license math.

What's in P1 (and what's already free)

P1 is the tier that turns Entra ID from a directory into an access-control system. The headline feature is Conditional Access — the policy engine that decides, on every sign-in, whether to allow it, block it, force multi-factor authentication, or require a compliant device. If you have ever written a rule like "require MFA for admins" or "block legacy authentication," that is Conditional Access, and it lives in P1. Note the trap here: Conditional Access needs P1, not P2. A lot of people assume the fancy security feature must be the expensive tier. It is not.

P1 also gives you the operational plumbing that makes a real tenant bearable:

• Self-service password reset writing back to on-premises Active Directory, so users reset their own passwords and your help desk stops doing it all day.
• Group-based licensing and dynamic groups, so membership and license assignment follow attributes instead of manual clicks.
• Application Proxy to publish internal web apps without a full VPN.
• Conditional Access for the everyday policies — device compliance, location, named MFA — everything except the risk-based ones.

Now the part the licensing blogs skip. The Free tier is not empty. Cloud user and group management, single sign-on to thousands of SaaS apps, and — importantly — security defaults, which switch on baseline MFA for everyone with no policy authoring at all, are all free. Free Entra ID even includes basic per-user MFA. So the honest framing is not "Free gives you nothing." It is "Free gives you sign-on and blunt-instrument MFA; P1 gives you the scalpel." You pay for P1 when you need targeted policy, not when you need MFA to exist.

What P2 actually buys you

P2 includes everything in P1 and stacks three capabilities on top. Each one answers a question P1 cannot.

Identity Protection is the risk engine. It scores every sign-in and every user for risk — impossible travel, leaked credentials, anonymous IP addresses — and lets you write risk-based Conditional Access: "if this sign-in looks risky, force a password change" or "if the user is high-risk, block until an admin clears them." That is the important line to get right in an interview: plain Conditional Access is P1, but Conditional Access that reacts to risk signals is P2, because the signals come from Identity Protection.

Privileged Identity Management (PIM) is just-in-time admin access. Instead of leaving someone as a standing Global Administrator, PIM lets them hold the role eligibly and activate it for a few hours, with an approval and a reason, and it expires on its own. It is the single strongest control you can put on the accounts that matter, and it is P2-only. If you care about who can become an admin and for how long, this is the feature you are buying P2 for. It pairs naturally with how you already think about scope in Azure RBAC roles like Owner, Contributor, and Reader, and there is a whole field note on PIM best practices once you have the license.

Access reviews close the loop that every audit eventually asks about: does this person still need this access? Reviews send group memberships, app assignments, and privileged roles to a reviewer on a schedule, and strip access that nobody re-approves. It is how you keep entitlement sprawl from quietly accumulating. P2 also brings entitlement management — access packages that bundle groups, apps, and sites into something a user can request, with approvals and expiry built in.

When does P2 pay for itself? Three scenarios I keep seeing. One: you have standing Global Administrators — accounts that are domain-admin-equivalent every hour of every day — and a single phished admin credential is your worst-case incident; PIM converts that standing exposure into a few approved hours a week. Two: you operate under an audit regime (SOC 2, ISO 27001, a cyber-insurance questionnaire) that asks "how do you recertify access?" — access reviews are the answer that does not involve a spreadsheet. Three: your sign-in logs already show password-spray and impossible-travel noise, and you want policy that reacts to risk automatically instead of an analyst reading logs the next morning. If none of those describe you, P1 is probably where your money stops.

P1 controls how people get in. P2 controls what happens to the people who can change how everyone else gets in.

Where the licenses come from (standalone vs bundled)

You can buy P1 and P2 as standalone per-user licenses, but a lot of organizations never do — the license arrives inside a Microsoft 365 bundle they already own. As of 2026: Microsoft 365 E3 includes Entra ID P1, Microsoft 365 E5 includes Entra ID P2, and Microsoft 365 Business Premium includes P1. Bundle contents shift occasionally, so verify the current plan comparison before you sign anything. If your organization runs on E5, every one of those users is already licensed for P2 — PIM, Identity Protection, access reviews, all of it — and buying standalone P2 on top would be paying twice. Half the "which tier do we buy" conversations end the moment someone says "wait, we're on E5." (These SKU names are themselves a rename — Azure AD Premium P1/P2 became Entra ID P1/P2 in October 2023 with no change to features or entitlements; the full story is in Azure AD vs Entra ID: what actually changed.)

On price: both tiers are per-user, per-month subscriptions, with P2 costing more than P1, and Microsoft has moved list prices before. I am deliberately not printing dollar figures here because they go stale — check the official Microsoft Entra pricing page for the current numbers before you budget. The buying logic in this note holds regardless of what the list price is this quarter.

The mixed-licensing play: P1 org-wide, P2 for privileged accounts

Entra ID licensing is per user, and Microsoft's rule is that any user benefiting from a paid feature needs the license. But in practice the buying pattern that gives you the most protection for the least money is a mix. Put P1 on everyone so the whole organization sits behind Conditional Access and self-service password reset. Then put P2 on the accounts that can do damage — admins, finance approvers, anyone holding privileged roles — because those are the accounts where PIM and risk-based policy earn their price.

Here is how that maps to the actual configuration, because this is the part the official docs never say plainly. Your everyday Conditional Access policies — require MFA, block legacy auth, demand compliant devices — target everyone, and everyone has P1, so you are covered. Your risk-based policies you scope to a group containing only the P2-licensed accounts, not "all users." And in PIM, the people you make eligible for privileged roles are exactly your P2 list — eligibility is the P2 feature, so the license set and the PIM-eligible set should be the same names. If someone new needs an admin role, they get a P2 seat the same day they get the eligibility. Keeping those two lists aligned is the whole discipline.

A small company might have three hundred users on P1 and fifteen on P2, and that fifteen is where nearly all the breach risk concentrates. You are not trying to license the whole tenant at P2; you are trying to license the blast radius. This is the same instinct as scoping a managed identity instead of a broad service principal — give each thing exactly the access it needs and no more.

One caveat worth saying out loud: some features are enforced at the tenant level or count everyone who could be affected, so if you turn on a risk policy that evaluates all sign-ins, Microsoft's licensing guidance may expect P2 for those users. Read the licensing page for the specific feature before you assume a fifteen-seat P2 purchase covers a tenant-wide policy. The mix is the right strategy; just size it against the actual feature you are enabling, and verify current licensing terms — per-user mixing is allowed, but the fine print on who "benefits" from a feature is Microsoft's to define.

The gap: what's actually in the Free tier so you don't overbuy

The reseller blogs have an obvious incentive not to dwell on the Free tier, so let me be specific about where the paid line actually falls. Free Entra ID gives you the directory, single sign-on to SaaS apps, self-service password change for cloud users, and security defaults — a one-switch policy that requires MFA registration and challenges risky sign-ins for the whole tenant. For a very small shop with no on-premises Active Directory and no need for granular policy, security defaults plus free MFA is a genuinely reasonable security floor, and you can run on it for a while.

You cross into P1 the moment you need targeted policy: MFA for admins but not kiosks, block legacy auth on some apps, require a compliant device for finance. Security defaults are all-or-nothing; Conditional Access is the moment you need "some, but not all." That is the real trigger for P1, and it is a much clearer buying signal than "we should probably get the paid tier." For the policy mechanics themselves, the Conditional Access basics field note walks through how the rules are built.

So the overbuy you want to avoid is jumping straight to P2 for everyone because it has the most checkmarks. Most of those checkmarks — PIM, Identity Protection, access reviews — only matter for privileged accounts. Pay for P1 broadly, P2 narrowly, and let the Free tier carry the users who genuinely need nothing more than sign-on and a blunt MFA switch.

Questions people also ask

What is the difference between Entra ID P1 and P2?

P1 gives you the everyday access-control baseline: Conditional Access, self-service password reset, group-based licensing, dynamic groups, and Application Proxy. P2 includes everything in P1 and adds the governance and risk layer: Identity Protection with risk-based Conditional Access, Privileged Identity Management, and access reviews. P1 is the org-wide floor; P2 is what you buy for the accounts that can do damage.

Is Entra ID P2 worth it?

For privileged accounts, usually yes. PIM alone — just-in-time admin activation instead of standing Global Administrators — tends to justify the seat, and Identity Protection and access reviews stack on top. For ordinary users it is often not worth it, because P1 already covers the everyday controls. Most organizations do best buying P2 only for admins and other high-risk accounts.

Does Microsoft 365 E3 include Entra ID P1?

Yes. As of 2026, Microsoft 365 E3 includes Entra ID P1, Microsoft 365 E5 includes Entra ID P2, and Microsoft 365 Business Premium includes P1. Bundle contents change occasionally, so verify the current plan comparison before buying standalone licenses on top of a bundle you already own.

Do I need P2 for Conditional Access?

No. Conditional Access is a P1 feature, so P1 is enough to write policies that require MFA, block legacy authentication, or demand a compliant device. You only need P2 for risk-based Conditional Access, where the policy reacts to Identity Protection sign-in and user risk signals.

Can I mix P1 and P2 licenses?

Yes. Entra ID licenses are assigned per user, so the common pattern is P1 for the whole organization and P2 only for admins and other privileged accounts. Any user who benefits from a P2 feature needs a P2 license, and some tenant-wide risk policies can pull in more users than you expect, so verify current licensing terms for the specific feature you enable.