azureblog.co.uk
← cd ~/tools
// tools/licences

Which licence do I need?

Search for a feature to see which Microsoft licence includes it. Every entry links to Microsoft's licensing page.

  1. All tenants (Free)Entra ID

    Security defaults

    Basic MFA and protections for everyone, with no configuration. Source ↗

  2. Entra ID P1Entra ID

    Conditional Access

    Also included in P2, Entra Suite, Microsoft 365 E3/E5/E7 and Business Premium. Source ↗

  3. Entra ID P1Entra ID

    Terms of use (Conditional Access)

    Also in P2, ID Governance and Entra Suite. Source ↗

  4. Entra ID P2Entra ID

    Risk-based Conditional Access and Identity Protection risk policies

    Free and P1 get limited risky user and sign-in information only. Source ↗

  5. Entra ID P2 or ID GovernanceEntra ID

    Privileged Identity Management (PIM)

    Custom extensions for role activation need ID Governance or Entra Suite. Source ↗

  6. Entra ID P2 (basic) / ID Governance (advanced)Governance

    Access reviews

    Some capabilities work with P2; advanced ones need ID Governance or Entra Suite. Source ↗

  7. Entra ID P2 (basic) / ID Governance (advanced)Governance

    Entitlement management (access packages)

    Auto-assignment policies and custom extensions need ID Governance or Entra Suite. Source ↗

  8. Entra ID GovernanceGovernance

    Lifecycle workflows

    Also in Entra Suite. Not included in P1 or P2. Source ↗

  9. Entra ID Governance or Entra SuiteGovernance

    Account Discovery

    Reports accounts in connected apps, including orphaned ones. Source ↗

  10. Entra ID P1Entra ID

    Cross-tenant synchronisation (users)

    Each synced user needs P1 in the source tenant; the target needs at least one P1 for auto-redemption. Source ↗

  11. Entra ID GovernanceGovernance

    Cross-tenant group synchronisation

    Group and cross-cloud sync need ID Governance or Entra Suite. Source ↗

  12. All tenants (Free)Entra ID

    Self-service password reset (cloud users)

    Writeback to on-premises AD needs P1. Source ↗

  13. Entra ID P1Entra ID

    SSPR with password writeback

    Also in P2 and Entra Suite. Source ↗

  14. Entra ID P1Entra ID

    Application Proxy

    Also in P2. Source ↗

  15. Entra Suite or standaloneEntra ID

    Entra Private Access

    Also included in Microsoft 365 E7. Source ↗

  16. Entra ID P1 per AU administratorEntra ID

    Administrative units

    Members need Free; dynamic membership rules need P1 per member. Source ↗

  17. Entra ID P1Entra ID

    Custom roles

    Needed for every user with a custom role assignment. Built-in roles are free. Source ↗

  18. FreeHybrid identity

    Entra Connect (sync)

    Entra Connect Health needs P1. Source ↗

  19. Entra ID P1 or P2Entra ID

    Entra Backup and Recovery

    Workforce tenants only. One backup a day, kept for 7 days. Source ↗

  20. FreeEntra ID

    Verified ID

    Face Check is a paid add-on, included in Entra Suite. Source ↗

  21. Entra ID P1 or P2Entra ID

    Exporting sign-in logs to Log Analytics

    Diagnostic settings export for sign-in logs. Source ↗

  22. Microsoft 365 E3 (being added)Intune

    Remote Help

    Rolling into M365 E3 and E5 in commercial tenants; otherwise a paid add-on. Source ↗

  23. Microsoft 365 E3 (being added)Intune

    Advanced Analytics

    Rolling into M365 E3 and E5 in commercial tenants. Source ↗

  24. Microsoft 365 E3 (being added)Intune

    Intune Plan 2 (Tunnel for MAM, specialty devices, firmware updates)

    Rolling into M365 E3 and E5 in commercial tenants. Source ↗

  25. Microsoft 365 E5 (being added)Intune

    Endpoint Privilege Management

    Rolling into M365 E5 in commercial tenants; otherwise a paid add-on. Source ↗

  26. Microsoft 365 E5 (being added)Intune

    Enterprise Application Management

    Rolling into M365 E5 in commercial tenants. Source ↗

  27. Microsoft 365 E5 (being added)Intune

    Microsoft Cloud PKI

    Rolling into M365 E5 in commercial tenants. Source ↗

Licensing changes often and depends on your agreement. Treat this as a starting point and confirm with Microsoft or your licensing partner before buying.