Every Microsoft 365 tenant uses Microsoft Entra ID for accounts and sign-ins. The basic features are included in Microsoft 365 subscriptions. Anyone who wants to tie sign-ins to conditions, limit permissions in time or assess risks automatically needs the P1 or P2 tier. They are available individually or as part of larger packages.
What does Entra ID P1 offer?
- Conditional Access: allow sign-ins depending on person, device, location and application, require multi-factor authentication or block them.
- Dynamic groups: memberships are created automatically from attributes such as department or location.
- Self-service password reset with writeback: users reset their own password, including for accounts from on-premises Active Directory.
- Administrative units: administrative permissions can be limited to parts of the organization, for example to one site.
What does Entra ID P2 add?
- ID Protection and risk-based Conditional Access: Microsoft rates sign-ins and accounts by risk. Policies respond to this, for example with an additional check or a password change.
- Privileged Identity Management (PIM): administrative roles are activated only when needed and for a limited time, with justification and logging. This is a central building block of privileged access management.
- Access reviews: owners confirm at intervals whether memberships and access are still needed.
Prices and packages
Individually, Entra ID P1 costs €6.10 and Entra ID P2 costs €8.70 per user and month, billed annually and excluding VAT.
The tiers are already included in packages:
- P1: in Microsoft 365 E3, E5, F1, F3 and Microsoft 365 Business Premium.
- P2: in Microsoft 365 E5.
Since January 2026, step-up licenses have been available through Microsoft CSP that let organizations move from E3 to Entra ID P2 without changing the whole package.
Which tier fits?
For most companies, P1 is the foundation, because tiered sign-in rules are not possible without Conditional Access. P2 is mainly worthwhile for accounts with high privileges and for organizations that regularly have to prove access, for example because of NIS2.
P1 and P2 can be mixed. Licenses are needed for the people who use a feature or are protected by it. Anyone using PIM for administrators needs P2 for those administrators, not for the entire workforce.
What companies should keep in mind
- Before buying, check which packages already include P1 or P2 to avoid duplicate licenses.
- Exclude emergency access accounts from Conditional Access policies and secure them separately.
- Test new policies in report-only mode first and then enable them step by step.
- Assign administrative roles through PIM instead of permanently as soon as P2 is available.
Introducing Entra ID with TOMORIS
The TOMORIS offering Intune and Entra rollout describes the prerequisites and scope. Which license fits which user group is covered under Microsoft licensing.