← cd ~/learn
azureblog.co.uk · cheat sheet
Entra ID licensing tiers
What Entra ID Free, P1, P2, ID Governance and the Entra Suite add, and which Microsoft 365 plans include them.
Fits on one A4 page. Checked 9 Oct 2026.
What each tier adds
| Tier | Key features |
|---|---|
| Free | Users, groups and devices; single sign-on to apps; security defaults (MFA for everyone); B2B collaboration; basic sign-in and audit logs |
| P1 | Conditional Access; dynamic groups; group-based licensing; password writeback for hybrid users; Application Proxy; sending logs to Log Analytics |
| P2 | Everything in P1, plus ID Protection (risk-based Conditional Access), Privileged Identity Management, access reviews and entitlement management |
| ID Governance | Add-on for P1 or P2 users: lifecycle workflows, more advanced access reviews and entitlement management, and governance features such as cross-tenant group sync and Account Discovery |
| Entra Suite | Bundles ID Governance and ID Protection with Internet Access, Private Access and Verified ID features |
Included in
- Microsoft 365 Business Premium: Entra ID P1
- Microsoft 365 E3: Entra ID P1
- Microsoft 365 E5: Entra ID P2
- Enterprise Mobility + Security E3 / E5: P1 / P2
Microsoft changes bundles from time to time, so check your agreement.
Who needs a licence?
- Generally, every user who benefits from a feature, such as being covered by Conditional Access or eligible in PIM.
- Guests are usually covered by monthly active user billing for External ID, which needs a linked Azure subscription.
- Some governance features for guests have their own meter.
Find out what you have
Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Select SkuPartNumber, ConsumedUnits, @{n="Enabled";e={$_.PrepaidUnits.Enabled}}Turn the part numbers into product names with the licence SKU lookup, and check a specific feature with the licence finder. Licensing changes often: confirm with Microsoft or your licensing partner before buying.