Microsoft Entra ID Governance: coverage, licensing and the mid-market gap

This guide is for IT managers at companies of 50 to 500 employees who already run Microsoft 365 and are deciding whether the Entra ID Governance add-on is worth the spend. Running a 5,000-seat tenant with a dedicated IAM team? Microsoft's own documentation will serve you better.

Microsoft Entra ID Governance is an add-on for Entra ID P1 and P2 tenants that adds lifecycle workflows, advanced access reviews and entitlement management on top of the directory. It lists at $7 per user per month on an annual commitment, and it must cover every member user in scope of a governance feature, not only the people who use it. It governs applications connected to Entra through single sign-on or provisioning, so SaaS tools that never pass through Entra stay outside its reach unless someone uploads their access data by hand.

Last reviewed on 28 September 2026. Prices and licensing rules checked against Microsoft's pricing page and Microsoft Learn on that date.

What is Microsoft Entra ID Governance?

Microsoft Entra ID Governance is Microsoft's identity governance and administration (IGA) product for Entra ID: it controls who gets access to what, for how long, and proves that the access was reviewed. It is sold as an add-on to an existing Entra ID tenant, not as a separate directory, and it builds on governance features that used to live in Entra ID P2.

In practice, it groups four families of capabilities:

• Lifecycle workflows: automated joiner, mover and leaver tasks triggered by HR attributes, with up to 50 workflows and 100 custom task extensions.
• Access reviews: recurring certification campaigns in which managers, owners or users confirm or remove access, with machine-learning recommendations and reviews focused on inactive users. Our access review definition covers the control itself.
• Entitlement management: access packages that bundle groups, Teams, applications and SharePoint sites, with approval policies, expiry dates and separation of duties checks.
• Privileged Identity Management (PIM): just-in-time activation of admin roles instead of standing privileges.

Entra ID Governance does not replace your identity provider. If you are still choosing one, start with our Okta vs Microsoft Entra ID comparison for mid-size companies, then come back to the governance question.

What does it add on top of Entra ID P1 and P2?

The dividing line matters because many tenants already pay for part of it. The table keeps the capabilities that change a mid-market decision, taken from Microsoft's feature-by-license table on Microsoft Learn. Microsoft Entra Suite includes every Entra ID Governance feature.

Read the P2 column carefully. It keeps basic access reviews, access packages and PIM, but the automation that removes manual work for a small IT team (lifecycle workflows, auto-assignment, account discovery) only exists in the Governance column.

How is Microsoft Entra ID Governance licensed?

Entra ID Governance is licensed per member user, on an annual commitment, and it only works if the tenant already holds a product that contains Entra ID P1 or P2. Guests are billed separately, per monthly active user, through an Azure subscription.

Which Microsoft plans qualify as a prerequisite?

Microsoft sells the governance capabilities as six products that differ only by prerequisite. For a commercial mid-market tenant, three of them matter:

• Microsoft Entra ID Governance: requires a product with the P1 or P2 service plan, such as Entra ID P1, Microsoft 365 Business Premium, Microsoft 365 E3 or Enterprise Mobility + Security E3.
• Microsoft Entra ID Governance Step Up for Microsoft Entra ID P2: for tenants that already own P2, for example through Microsoft 365 E5. Its price is not listed on Microsoft's public pricing page, so it goes through a partner or Microsoft sales.
• Microsoft Entra Suite: the same governance capabilities plus Private Access, Internet Access, ID Protection and Verified ID, at $12 per user per month. It requires P1, and Microsoft offers special pricing to P2 and E5 customers.

The prerequisite has to stay active. Microsoft warns that if it expires, "Microsoft Entra ID Governance scenarios might not function as expected" (licensing fundamentals, updated 29 July 2026).

Who needs a license: the "in scope" rule

Microsoft does not count the people who click. It counts the member users a feature applies to. The tenant needs at least as many licenses as governed member users, "including those users that have or can request access to the applications, approve, or review access to the applications" (Microsoft Learn). Licenses do not have to be assigned to individual users, but the count has to match the scope.

This is where most forum threads go wrong. "How does licensing work with entitlement management?" keeps coming back on r/entra because the answer depends on scope, not on usage. Microsoft's own examples settle it:

For a mid-market company, the consequence is simple: a company-wide quarterly access review, or a leaver workflow that applies to everyone, puts the whole workforce in scope.

Guests are billed separately

Employee licenses do not cover business guests. Governance actions on guests are billed per monthly active user (MAU) through the Microsoft Entra ID Governance for guests add-on, which requires linking the tenant to an Azure subscription. Microsoft began enforcing that link in January 2026, and the guest billing applies to every governed guest, even within the first 50,000 MAU that External ID gives away for free. P2 features used on guests are not billed (guest licensing page, updated 23 September 2026).

Is Microsoft Entra ID Governance part of E5?

No. Microsoft 365 E5 includes Microsoft Entra ID P2, and P2 is not Entra ID Governance. E5 tenants keep the governance features that were already in P2 (basic access reviews, access packages, PIM), but they need the Step Up for Microsoft Entra ID P2 to unlock lifecycle workflows, machine-learning review recommendations, account discovery and the other Governance-only capabilities.

Microsoft is explicit about the direction. All generally available P2 features remain, "but no new Identity Governance & Administration (IGA) features or capabilities will be added to the Microsoft Entra ID P2 SKU." Every new governance capability now ships in the Governance add-on or in Entra Suite. At the top of the range, Microsoft Learn states that Microsoft 365 E7 includes all ID Governance features through Entra Suite and Agent 365.

What does Entra ID Governance cost a 100 to 500 employee company?

At list price, a company that already has P1 pays $84 per user per year for Entra ID Governance, so about $21,000 a year for 250 employees in scope. Without P1, the entry ticket doubles, because P1 has to be bought first.

Check the figures you are quoted. Many guides and forum answers still use the older P1 and P2 prices: one r/AZURE thread weighs "Entra ID P2 at $9 or Microsoft Entra ID Governance at $7 per user and month." Microsoft's US pricing page, checked on 28 September 2026, lists P1 at $7.00, P2 at $10.00, Entra ID Governance at $7.00 and Entra Suite at $12.00 per user per month, paid yearly. Budget on the current figures and recheck them before signing.

Two details move these numbers. Partner discounts and enterprise agreements lower the list price. Scope lowers the headcount: if governance only covers a 40-person finance team requesting three apps, only those users and their approvers need licenses. The catch is that the controls auditors ask about, such as company-wide access reviews and leaver automation, apply to everyone.

And this budget only covers the applications Entra can see. If that trade-off is hard to justify for a lean IT team, compare it with identity governance built for mid-market IT teams, which sits on top of Entra ID instead of replacing it.

Which apps can Entra ID Governance actually govern?

Entra ID Governance fully governs an application when one of two conditions is met: Entra ID is the app's only identity provider, so only users assigned in Entra can sign in, or Entra provisions and deprovisions the app's accounts, through SCIM, Microsoft Graph or Active Directory groups. Outside those conditions, Microsoft's documentation says identity governance "can still be used", adding that "there may be some limitations" (Microsoft Learn).

Those limitations are the whole story for a mid-market SaaS stack. The matrix maps typical app types to what the add-on does with them.

What happens to apps without SCIM or SSO?

Microsoft's answer for disconnected applications is the custom data provided resource, still in preview (documentation dated 12 March 2026). It lets you include an app in an access review by uploading its access data, with four constraints:

• up to 10 CSV files per review, uploaded by hand, through Microsoft Graph or through a Logic App;
• a two-hour window to complete the upload once the review enters the Initializing state;
• single-stage reviews only, with the users' managers as reviewers;
• an Entra ID Governance or Entra Suite license for the users in scope.

It works for a handful of sensitive apps. It does not scale to the long tail, and it does nothing for apps nobody has registered. That long tail is bigger than most inventories suggest. When Satelia, a 70-person cardiac tele-monitoring company, connected Corma while preparing its ISO 27001 and SOC 2 certifications, it surfaced 160 applications, against the 30 listed in its manual reports.

So the real question is not whether you will have ungoverned apps. You already have them. For the offboarding mechanics of those tools, see our guide to managing identity lifecycle for apps that don't support SCIM, SAML or SSO.

Where the mid-market gap opens

The gap is not in the feature list. It opens where Microsoft's design assumptions (an IAM team, a mostly integrated app estate, a license budget that scales with headcount) meet a company of 50 to 500 people run by a small IT team.

1. License math on the whole workforce. Company-wide controls put every member in scope, so the cost scales with headcount, not with the number of risky apps.
2. A long tail of apps without SCIM. Every app that lacks SCIM on the plan you actually bought lands in rows three and four of the matrix, where the work stays manual.
3. No view of license spend. Entra knows who is assigned to an enterprise app. It does not know which paid seats inside that app go unused, or which contract renews next month.
4. Audit evidence with a 30-day memory. Microsoft Entra keeps audit events for up to 30 days, and Microsoft recommends routing them to Azure Monitor to keep history (Microsoft Learn). That is one more Azure component to configure and pay for before an ISO 27001 or NIS2 audit, as our user access review roadmap for ISO 27001 explains.
5. Design and upkeep. Catalogs, access packages, lifecycle workflows and Logic Apps extensions are powerful, but someone has to design them and keep them current as the company changes.

Héloïse Rozès, co-founder and CEO of Corma, described the pattern when the company announced its seed round on 8 December 2025:

"We see teams everywhere that are overwhelmed by the number of apps they need to manage every day. They lose money left and right, spend their day on operational tasks instead of strategic initiatives."Héloïse Rozès, co-founder and CEO, Corma (PR Newswire, December 2025)

What do IT teams report after trying it?

Public threads point to three recurring frictions: licensing confusion, implementation effort, and coverage beyond Microsoft. They are individual accounts, not a survey, but they match the questions mid-market teams bring to a governance project.

• Which SKU? "Could you clarify whether we need to purchase P2 licenses, Microsoft Entra ID Governance, or Microsoft Entra Suite?" asks an admin on r/AZURE.
• Effort. "Currently implementing Entra ID Governance and it's a nightmare," writes a practitioner comparing IGA tools on r/IdentityManagement.
• Coverage. Threads such as "CMV: Why do I need Microsoft Entra AND Sailpoint?" show that some teams still pair Entra with a second governance tool to reach the apps outside Microsoft.

Entra ID Governance add-on vs a governance layer on top of Entra ID

The choice is not Entra or something else: Entra ID stays your identity provider either way. The choice is whether governance lives inside Entra, licensed per member user in scope, or in a layer that reads Entra and also covers what Entra cannot see.

When is the Microsoft add-on the right call? When most of your critical access lives in Microsoft 365, Azure and Entra-integrated apps, when you need just-in-time admin roles or SAP business roles in access packages (in preview), and when someone on the team can own catalogs and workflows. Some teams run both: PIM and Microsoft-side access packages in Entra, and a cross-app layer for everything else.

How Corma closes the gap on top of Entra ID

Corma connects to Entra ID as the source of identities and extends governance to every app your teams use, including the ones Entra never sees. It combines SaaS management and identity governance in one platform, so the same inventory drives access reviews, offboarding and license decisions.

• A complete app inventory. Discovery through Entra ID and the browser extension brings shadow IT into view before an auditor asks about it.
• Access reviews across every app. Automated access review campaigns include tools without SCIM, and produce the audit trail that ISO 27001, SOC 2 and NIS2 expect.
• Joiner, mover and leaver automation beyond Microsoft. When HR sets a departure date, every account is disabled, including the ones Entra cannot deprovision.
• License and spend control. See which seats are unused, who holds them and what renews next, then reclaim them.
• European by design. Data hosted in the EU, ISO/IEC 27001:2022 certification, and recognition in the 2025 Gartner Magic Quadrant for SaaS Management Platforms.

"Without having those details, we couldn't move forward with the ISO 27001 and SOC2 certifications."Eriel Cruz, Technical Project Manager, Satelia

"Corma helps me enormously with all aspects of application detection and automatic management."Jean-Marie Drucot, IT Manager and CISO, APGAR

FAQ

Is Microsoft Entra ID free to use?

Yes, at its base tier. Microsoft Entra ID Free comes with Microsoft cloud subscriptions such as Microsoft 365 and Azure, and covers SSO, multifactor authentication and user management. Basic access reviews start with P2, and lifecycle workflows or advanced reviews require the Entra ID Governance add-on.

What are the different types of Microsoft Entra ID licenses?

Microsoft Entra ID comes in Free, P1 ($7 per user per month) and P2 ($10). Governance is sold on top, as Microsoft Entra ID Governance ($7) or inside Microsoft Entra Suite ($12). P1 is included in Microsoft 365 Business Premium and E3, and P2 in Microsoft 365 E5 (US list prices, September 2026).

What is Microsoft Entra ID P2 license used for?

Entra ID P2 adds risk-based protection through Microsoft Entra ID Protection, Privileged Identity Management, and the basic access review and entitlement management features. It does not include lifecycle workflows or the newer governance capabilities, which require Microsoft Entra ID Governance.

What kind of companies use Entra ID?

Every organization on Microsoft 365 or Azure already uses Entra ID, because the Free tier comes with those subscriptions. Whether a company also needs the governance add-on depends less on its size than on how much of its access lives outside Microsoft.

Is there a free trial of Microsoft Entra ID Governance?

Yes. A Global Administrator can start a trial from the Microsoft 365 admin center, under Billing and Purchase services, if the tenant already owns a prerequisite such as Entra ID P1 and has never trialed Entra ID Governance. Tenants with P2 start the trial of the Step Up product instead.

The short version

Microsoft Entra ID Governance is the right tool for access that lives inside Microsoft. For a company of 50 to 500 people, the decision turns on two numbers you can check this week: how many member users a company-wide review would put in scope, and how many of your apps Entra can actually see. If the second number sits far below your real app count, governance has to start with discovery.