Entra ID Licensing
Free · P1 · P2 · ID Governance · Entra Suite
Practice questions for this topic →
Editions and what includes them
| Edition | Included with | Unlocks |
|---|---|---|
| Free | Microsoft cloud subscriptions (Azure, Microsoft 365…) | Basic identity; security defaults |
| P1 | Standalone; Microsoft 365 E3, E5, E7, F1, F3; Enterprise Mobility + Security E3; Business Premium | Conditional Access (including authentication strengths); dynamic groups; application proxy |
| P2 | Standalone; Microsoft 365 E5, E7; Enterprise Mobility + Security E5; Microsoft Defender Suite | Adds ID Protection risk-based policies; PIM |
| ID Governance | Add-on for P1 and P2 customers (six products) | Entitlement management, PIM, access reviews plus advanced governance such as lifecycle workflows |
| Entra Suite | For P1 and P2 customers | Private Access, Internet Access, ID Governance, ID Protection and Verified ID in one SKU |
The six ID Governance products differ only in their prerequisites; each contains the entitlement management, PIM and access review capabilities that used to be in P2. Entra Suite requires a P1 subscription (or a package that includes P1).
| Feature | Minimum license (Microsoft Learn) |
|---|---|
| Dynamic membership groups | Entra ID P1 (or Intune for Education); up to 15,000 dynamic groups per tenant |
| Application proxy | Entra ID P1 or P2 |
| SSPR with on-premises password writeback | Entra ID P1 or P2, or Microsoft 365 Business Premium (standalone Microsoft 365 Basic and Standard don't support writeback) |
| Conditional Access | P1 |
| Risk-based Conditional Access / ID Protection | P2 or Entra Suite |
| PIM | P2 or ID Governance |
Security defaults
- Free, preconfigured protections: require all users to register for MFA, require admins to do MFA, require MFA when necessary, block legacy authentication, block device code flow, protect privileged activities such as Azure portal access.
- Aimed at organizations on the free tier. If you have P1 or P2, Microsoft says security defaults are probably not right for you; use Conditional Access. Tenants created on or after Oct 22, 2019 may already have it enabled (with a 24-hour grace period).
- To change security defaults you need at least the Conditional Access Administrator role.
Exam Tips
Tick each tip once you can answer it without looking.
“Require MFA only when users sign in from outside the office” → Conditional Access → Entra ID P1.
“Block or force password change when a sign-in looks risky” → Identity Protection risk-based CA → Entra ID P2. Trap: P1 can't use risk conditions.
“Just-in-time admin role activation with approval” → PIM → Entra ID P2 (or ID Governance).
“Quarterly review of guest access to a group” → Access reviews → P2 / ID Governance.
“Automatically add users to groups based on department attribute” → Dynamic groups → P1.
“Automate joiner/mover/leaver tasks (e.g. on hire date)” → Lifecycle workflows → Microsoft Entra ID Governance.
“Cheapest way to enforce MFA for all users, no conditions” → Security defaults (Free). Trap: Can't be combined with Conditional Access policies.
“Users with Microsoft 365 E5” → Already have Entra ID P2.
“Security defaults contents” → Free: MFA registration, admin MFA, block legacy auth, block device code flow, protect privileged activities. Trap: Orgs with P1 or P2 should use Conditional Access; changing it needs Conditional Access Administrator.
“ID Governance product variants” → Six products that differ only in prerequisites, each with entitlement management, PIM and access reviews plus advanced governance. Trap: Lifecycle workflows are in the advanced set.
“Entra Suite contents” → Private Access, Internet Access, ID Governance, ID Protection and Verified ID. Trap: For P1 and P2 customers.
“Which Microsoft 365 plans include P1 and P2” → P1: E3, E5, E7, Business Premium. P2: E5, E7. Trap: Business Premium includes P1 only.
“Dynamic membership groups” → Need Microsoft Entra ID P1 (or Intune for Education). Trap: A tenant can have up to 15,000 dynamic membership groups.
“Application proxy license” → A Microsoft Entra ID P1 or P2 subscription. Trap: Needs an Application Administrator account and synced or cloud identities.
“SSPR with on-premises password writeback” → Entra ID P1 or P2, or Microsoft 365 Business Premium. Trap: Standalone Microsoft 365 Basic and Standard don't support writeback.
“Which licenses include P1 and P2” → P1: standalone, M365 E3, E5, E7, F1, F3, EMS E3, Business Premium. P2: standalone, M365 E5, E7, EMS E5, Microsoft Defender Suite. Trap: Entra Suite needs a P1 subscription.