Microsoft Entra ID P1 vs P2: Which License Do You Actually Need?

The reseller blogs will list every feature in both tiers and let you sort it out. Here is the version I give people who have to sign the purchase order: buy P1 for everyone, buy P2 for the accounts that can hurt you, and stop paying for things the Free tier already does.

New to cloud? CAMPUX is a free, build-first course. Start here →

Buy P1 for your whole organization and P2 only for privileged accounts. That single sentence covers the decision for most companies, so if that is all you came for, you can leave now. P1 is the everyday access-control baseline — Conditional Access and self-service password reset. P2 adds the risk and governance layer: Identity Protection, Privileged Identity Management, and access reviews. Everyone touching your tenant should have P1. Only the people who can change other people's access need P2.

The rest of this note is the reasoning, the pricing, and the part nobody selling licenses wants to tell you: what the Free tier already covers, so you do not overbuy. If you are new to the product itself, read what Microsoft Entra ID actually is first, then come back for the license math.

What's in P1 (and what's already free)

P1 is the tier that turns Entra ID from a directory into an access-control system. The headline feature is Conditional Access — the policy engine that decides, on every sign-in, whether to allow it, block it, force multi-factor authentication, or require a compliant device. If you have ever written a rule like "require MFA for admins" or "block legacy authentication," that is Conditional Access, and it lives in P1. Note the trap here: Conditional Access needs P1, not P2. A lot of people assume the fancy security feature must be the expensive tier. It is not.

P1 also gives you the operational plumbing that makes a real tenant bearable:

• Self-service password reset writing back to on-premises Active Directory, so users reset their own passwords and your help desk stops doing it all day.
• Group-based licensing and dynamic groups, so membership and license assignment follow attributes instead of manual clicks.
• Application Proxy to publish internal web apps without a full VPN.
• Conditional Access for the everyday policies — device compliance, location, named MFA — everything except the risk-based ones.

Now the part the licensing blogs skip. The Free tier is not empty. Cloud user and group management, single sign-on to thousands of SaaS apps, and — importantly — security defaults, which switch on baseline MFA for everyone with no policy authoring at all, are all free. Free Entra ID even includes basic per-user MFA. So the honest framing is not "Free gives you nothing." It is "Free gives you sign-on and blunt-instrument MFA; P1 gives you the scalpel." You pay for P1 when you need targeted policy, not when you need MFA to exist.

What P2 adds (Identity Protection, PIM, Access Reviews)

P2 includes everything in P1 and stacks three capabilities on top. Each one answers a question P1 cannot.

Identity Protection is the risk engine. It scores every sign-in and every user for risk — impossible travel, leaked credentials, anonymous IP addresses — and lets you write risk-based Conditional Access: "if this sign-in looks risky, force a password change" or "if the user is high-risk, block until an admin clears them." That is the important line to get right in an interview: plain Conditional Access is P1, but Conditional Access that reacts to risk signals is P2, because the signals come from Identity Protection.

Privileged Identity Management (PIM) is just-in-time admin access. Instead of leaving someone as a standing Global Administrator, PIM lets them hold the role eligibly and activate it for a few hours, with an approval and a reason, and it expires on its own. It is the single strongest control you can put on the accounts that matter, and it is P2-only. If you care about who can become an admin and for how long, this is the feature you are buying P2 for. It pairs naturally with how you already think about scope in Azure RBAC roles like Owner, Contributor, and Reader.

Access reviews close the loop that every audit eventually asks about: does this person still need this access? Reviews send group memberships, app assignments, and privileged roles to a reviewer on a schedule, and strip access that nobody re-approves. It is how you keep entitlement sprawl from quietly accumulating.

P1 controls how people get in. P2 controls what happens to the people who can change how everyone else gets in.

Pricing and where these come bundled (M365 E3/E5)

Here are the numbers, with the usual caution that Microsoft moves list prices and you should confirm the live figure before you budget. As of the current list price, P1 is roughly 7 US dollars per user per month and P2 is roughly 10, both billed annually. Those rose from about 6 and 9 dollars after a mid-2026 price change, so if you are reading an older post quoting 6 and 9, that is why. Treat these as current list, not gospel.

The number most people miss is that you may already own these through a bundle. Microsoft 365 E3 includes Entra ID P1. Microsoft 365 E5 includes Entra ID P2. If your organization runs on E5, every one of those users is already licensed for P2 — PIM, Identity Protection, access reviews, all of it — and buying standalone P2 on top would be paying twice. Before you price anything, check what Microsoft 365 plan your users sit on. Half the "which tier do we buy" conversations end the moment someone says "wait, we're on E5."

The smart mix: P1 org-wide, P2 for privileged accounts

Entra ID licensing is per user, and Microsoft's rule is that any user benefiting from a paid feature needs the license. But in practice the buying pattern that gives you the most protection for the least money is a mix. Put P1 on everyone so the whole organization sits behind Conditional Access and self-service password reset. Then put P2 on the accounts that can do damage — admins, finance approvers, anyone holding privileged roles — because those are the accounts where PIM and risk-based policy earn their price.

A small company might have three hundred users on P1 and fifteen on P2, and that fifteen is where nearly all the breach risk concentrates. You are not trying to license the whole tenant at P2; you are trying to license the blast radius. This is the same instinct as scoping a managed identity instead of a broad service principal — give each thing exactly the access it needs and no more.

One caveat worth saying out loud: some features are enforced at the tenant level or count everyone who could be affected, so if you turn on a risk policy that evaluates all sign-ins, Microsoft's licensing guidance may expect P2 for those users. Read the licensing page for the specific feature before you assume a fifteen-seat P2 purchase covers a tenant-wide policy. The mix is the right strategy; just size it against the actual feature you are enabling.

The gap: what's actually in the Free tier so you don't overbuy

The reseller blogs have an obvious incentive not to dwell on the Free tier, so let me be specific about where the paid line actually falls. Free Entra ID gives you the directory, single sign-on to SaaS apps, self-service password change for cloud users, and security defaults — a one-switch policy that requires MFA registration and challenges risky sign-ins for the whole tenant. For a very small shop with no on-premises Active Directory and no need for granular policy, security defaults plus free MFA is a genuinely reasonable security floor, and you can run on it for a while.

You cross into P1 the moment you need targeted policy: MFA for admins but not kiosks, block legacy auth on some apps, require a compliant device for finance. Security defaults are all-or-nothing; Conditional Access is the moment you need "some, but not all." That is the real trigger for P1, and it is a much clearer buying signal than "we should probably get the paid tier." For the policy mechanics themselves, the Conditional Access basics field note walks through how the rules are built.

So the overbuy you want to avoid is jumping straight to P2 for everyone because it has the most checkmarks. Most of those checkmarks — PIM, Identity Protection, access reviews — only matter for privileged accounts. Pay for P1 broadly, P2 narrowly, and let the Free tier carry the users who genuinely need nothing more than sign-on and a blunt MFA switch.

Questions people also ask

What is the difference between Entra ID P1 and P2?

P1 gives you the everyday access-control baseline: Conditional Access, self-service password reset, group-based licensing, and Application Proxy. P2 includes everything in P1 and adds the governance and risk layer: Identity Protection with risk-based Conditional Access, Privileged Identity Management, and access reviews. P1 is the org-wide floor; P2 is what you buy for the accounts that can do damage.

Do I need Entra ID P2 for Conditional Access?

No. Conditional Access is a P1 feature, so P1 is enough to write policies that require MFA, block legacy authentication, or demand a compliant device. You only need P2 for risk-based Conditional Access, where the policy reacts to Identity Protection sign-in and user risk signals.

Is PIM included in Entra ID P1?

No. Privileged Identity Management is a P2-only feature. If you want just-in-time role activation, approval workflows, and time-bound admin access, you need Entra ID P2 on the accounts using it, not P1.

How much does Entra ID P2 cost?

As of the current Microsoft list price, Entra ID P2 is about 10 US dollars per user per month and P1 is about 7 US dollars per user per month, both billed annually. Those figures rose from roughly 9 and 6 dollars after a mid-2026 price change, so confirm the live number on Microsoft's pricing page before you budget.

Does Microsoft 365 E5 include Entra ID P2?

Yes. Microsoft 365 E5 includes Entra ID P2, and Microsoft 365 E3 includes Entra ID P1. If your users already sit on E5, they are licensed for P2 and you do not buy it separately.