Microsoft Entra ID P1 vs P2 vs Governance: licences, prices and what mid-market actually needs

For IT managers and CISOs at 50 to 500 employee companies on Microsoft 365 Business Premium or E3, deciding whether an audit or a renewal justifies P2 or Governance. On E5, P2 is already included.

Microsoft Entra ID P1 is the identity license that unlocks Conditional Access, MFA policies and single sign-on for $7.00 per user per month, and it is already included in Microsoft 365 Business Premium and E3. Entra ID P2 costs $10.00 and adds Identity Protection, Privileged Identity Management (PIM) and basic access reviews. Entra ID Governance is a $7.00 add-on on top of P1 or P2 that brings lifecycle workflows and the advanced review features. For most mid-market companies, the cost-efficient baseline is P1 for everyone and P2 for privileged admins; whether Governance is worth it depends on how many of your apps are actually connected to Entra.

Updated September 30, 2026. Prices checked on the Microsoft Entra pricing page and feature scope on Microsoft Learn the same day.

What are Entra ID Free, P1, P2 and Governance?

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity service, sold in stacked tiers where each tier includes the one below it. Free comes with any Microsoft cloud subscription. P1 and P2 are per-user licenses. Governance is not a tier above P2: it is an add-on that requires P1 or P2 as a prerequisite. If you need a refresher on the product itself, our Microsoft Entra ID glossary entry covers the basics.

Why do so many guides still say $6 and $9?

Because those were the prices until mid-2026. Microsoft's current pricing page lists P1 at $7.00 and P2 at $10.00, which is a $1 increase on each. The change arrived with the Microsoft 365 price update that took effect on July 1, 2026, as documented by Office 365 for IT Pros when it was announced.

Several well-ranked licensing guides published or updated in summer 2026 still quote $6 for P1 and $9 for P2, including the CyberDuo comparison (August 2026) and the SAMexpert licensing guide (updated June 2026). iC Consult keeps the old figures but flags the July increase. The ID Governance add-on did not move and stays at $7.00. When you build a budget, use the official pricing page, not a third-party table.

What is Entra ID P1 used for, and is it enough?

Entra ID P1 is used to make access conditional: it lets you require MFA, block legacy authentication, restrict sign-ins by device compliance or location, and assign apps by group. For a mid-market company that already has it through Business Premium or E3, P1 is usually the right baseline for every employee.

What P1 gives you in practice:

• Conditional Access policies (MFA, device compliance, location, session controls). Microsoft states that using this feature requires Microsoft Entra ID P1 licenses.
• Group-based access and dynamic groups, so that app access follows department or role attributes.
• Hybrid identity features for companies still syncing from on-premises Active Directory.
• Automated group provisioning to SaaS and on-premises apps. Note that user provisioning to SaaS apps is already available in the Free tier.
• An identity governance dashboard and terms-of-use attestation.

What P1 does not give you: risk detection on sign-ins, just-in-time admin roles, and any form of access review. Those three gaps are exactly what an auditor or a cyber insurer will ask about, which is why the P2 conversation usually starts at renewal time.

What are the key differences between Entra ID P1 and P2?

P2 adds three capabilities to P1: Identity Protection, Privileged Identity Management and basic identity governance. Everything in P1 remains included.

• Identity Protection scores each sign-in and user for risk (leaked credentials, impossible travel, anonymous IP addresses) and lets Conditional Access react, for example by forcing a password change.
• Privileged Identity Management (PIM) replaces permanent admin rights with time-bound, approval-based activation, so that a Global Administrator role is only active when someone actually needs it.
• Access reviews and entitlement management in their basic form: recurring reviews of group and app membership, access packages, expiration of assignments, separation of duties checks.

The price gap is $3 per user per month at list price, or 43% more than P1. On 200 users, that is $7,200 a year if you upgrade everyone.

Can I buy P2 for just my administrators?

Yes, and for most mid-market companies it is the most efficient move. Microsoft licenses PIM per user who benefits from it: in its own example, a tenant with 50 administrators of which 42 are managed through PIM, with five approvers and six reviewers, needs 53 licenses, not one per employee.

The limit of this approach is Identity Protection. Risk-based policies only protect the users who hold P2, so buying P2 for admins secures privileged accounts but leaves ordinary users on P1-level protection. For a 200-person company with ten admins, the difference is small: $17,160 a year for P1 everywhere plus P2 for the ten admins, against $24,000 for P2 across the board.

Are access reviews a P2 feature or a Governance feature?

Both, and that is the most common licensing mistake in this area. Basic access reviews and entitlement management are included in P2. The advanced review and lifecycle features require the separate Entra ID Governance license. A recurring question on Microsoft Q&A asks exactly this: whether P2 is sufficient for access reviews of groups.

Microsoft's own licensing table settles it. Of the 60 capabilities for employees listed in the ID Governance licensing fundamentals (page updated July 29, 2026), 28 require Entra ID Governance or Entra Suite and are not included in P2. P1 alone covers 8 of them.

The practical consequence: if your plan is to automate onboarding and offboarding with lifecycle workflows, P2 will not get you there. You need Governance for every user in scope of the workflow. Microsoft's example counts 401 licenses for a workflow covering 400 new hires plus the administrator who runs it.

How much does each licensing path cost for 200 users?

For a 200-person company, the realistic range goes from $16,800 to $45,600 a year at list price, depending on how far up the Entra stack you go. The table below applies Microsoft's September 2026 prices to six common scenarios.

Two licensing rules change these numbers in real life:

• You license users in scope, not the whole tenant. Microsoft counts 76 licenses for an access review of a 75-member group with one reviewing owner. If only 80 people are in scope of your reviews, you license 80, not 200.
• Guests are billed differently. ID Governance uses Monthly Active User (MAU) licensing for guest users, which requires an Azure subscription to be linked for guest billing.

The column that matters for most mid-market budgets is the last one. If you already pay for Business Premium or E3, P1 is sunk cost. The real decision is whether the next $1,200 or the next $16,800 a year buys you the evidence your auditor wants.

What Entra licenses cannot see: apps that are not connected to Entra

Every Entra tier, including Governance, governs the applications that are connected to Entra. Access reviews, PIM and lifecycle workflows act on groups, roles and apps that Entra knows about. An app bought on a credit card, used with a personal login, or never wired to SSO and SCIM is outside the scope of any license upgrade.

In mid-market companies, that blind spot is rarely small. When Satelia, a telemonitoring company specialized in cardiac disease, prepared for ISO and SOC 2 requirements, it uncovered more than 160 applications in use, over five times the 30 listed in its manual reports. Any review limited to the apps already known and connected would have started from the shorter list.

This is the point where the P2 versus Governance debate often turns out to be the wrong question. Paying $16,800 a year for Governance buys better reviews of the apps Entra already sees. It does not tell you which apps exist, who pays for them, or who still has an account after leaving. A governance layer that uses Entra as its identity source and extends reviews and offboarding to every SaaS app, connected or not, closes that gap. That is what Corma's automated identity governance is built for.

Which license does a NIS2 or ISO 27001 audit actually require?

No regulation requires a specific Microsoft license. Auditors ask for controls and evidence, and each Entra tier produces part of that evidence. The table maps the most common requirements to the tier that covers them.

Under the NIS2 Directive, Article 21(2) lists the risk-management measures entities must take, including "human resources security, access control policies and asset management" in point (i) and "the use of multi-factor authentication or continuous authentication solutions" in point (j). ISO/IEC 27001:2022 asks for comparable controls in Annex A, notably access rights (5.18), privileged access rights (8.2) and secure authentication (8.5).

The last row is the one most licensing guides skip: none of the five licensing guides we reviewed for this article mentions NIS2 at all. Yet asset management sits in the same NIS2 point as access control. For a step-by-step view of the review process itself, see our user access reviews roadmap for ISO 27001.

Which Entra plan fits your company?

Start from the license you already own and the evidence you need, not from the feature list. The grid below summarizes the most common mid-market situations.

If you are still choosing an identity provider rather than a license tier, our Okta vs Microsoft Entra ID comparison for mid-size companies covers that earlier decision.

How Corma works alongside Entra ID

Corma does not replace Entra ID: it uses Entra as the identity source and governs access across all your SaaS apps, including those Entra cannot see. The native Microsoft Entra integration syncs users and groups, then Corma adds the layers that no Entra tier provides on its own:

• SaaS discovery and license visibility across connected and unconnected apps, with the cost of each tool, through Corma's SaaS management platform.
• Access reviews across every app, not only those behind SSO, with audit-ready evidence from automated access reviews.
• Onboarding and offboarding automation for the whole stack. Skello has onboarded and offboarded more than 140 employees automatically with Corma.
• EU hosting and GDPR compliance, on a platform certified ISO/IEC 27001:2022, which matters when the governance tool itself holds your access map.

For many mid-market teams, the combination of P1 for everyone, P2 for admins and a governance layer like Corma costs less than Governance for all users and covers more applications. To see how Corma's identity and access management fits your Entra tenant, the fastest route is a walkthrough on your own stack.

FAQ

Is my Azure P1 or P2?

Open the Microsoft Entra admin center and look at the Overview page: the information bar shows the current Entra ID license plan. For the full list of products in your tenant, go to Billing, then Licenses, then All products. If you have Microsoft 365 E3 or Business Premium, you have P1; E5 includes P2.

Is Entra ID P2 part of E3?

No. Microsoft 365 E3 includes Entra ID P1, not P2. Entra ID P2 is included in Microsoft 365 E5 and E7 and in Microsoft Defender Suite. An E3 customer who needs P2 features buys standalone P2 licenses for the users concerned.

Does Entra P1 come with E3?

Yes. Microsoft 365 E3 includes Entra ID P1, as do Microsoft 365 Business Premium, E5 and E7. E3 customers therefore already have Conditional Access and do not need to buy P1 separately.

Is a P1/P2 Entra ID license per user or per tenant?

Entra ID P1 and P2 are licensed per user. Every user who is in scope of a premium feature, such as a Conditional Access policy, an access review or PIM, needs the corresponding license. Buying one license does not unlock the feature for the whole tenant.

Does Business Premium include Entra ID P1 or P2?

Microsoft 365 Business Premium includes Entra ID P1. Entra ID P2 is included in Microsoft Defender Suite for Business Premium, or can be bought as a standalone license at $10.00 per user per month for the users who need it.

How are guests licensed for governance?

Microsoft Entra ID Governance licenses guest users on a Monthly Active User basis, not per assigned seat. It requires an Azure subscription linked to the tenant for guest billing. Employees and other member users are licensed per user.