What each tier adds over Free, which Microsoft 365 plans already include it, and where the money is wasted.
Entra ID P1 adds Conditional Access and is included in Microsoft 365 Business Premium and E3. Entra ID P2 adds risk-based policies (Identity Protection), Privileged Identity Management and access reviews, and is included in E5. P2 is typically bought for the administrators who use PIM; for risk-based policies, every user the policy covers needs P2. Where P2 or P1 is bought on top of E5, you are paying twice.
Free, P1 and P2 are cumulative: P2 contains everything in P1. Microsoft's current product terms and your agreement are authoritative.
| Need | Licence | Note |
|---|---|---|
| Single sign-on, basic MFA via security defaults, basic reporting | Free | Included with any Microsoft cloud subscription. No Conditional Access. |
| Conditional Access (for example MFA only from untrusted locations, compliant device required) | P1 | Also group-based licensing, self-service password reset with writeback, hybrid and application proxy features. |
| Risk-based Conditional Access: block or step up sign-ins flagged by Identity Protection | P2 | Sign-in risk and user risk policies, risky-user reports. |
| Privileged Identity Management: just-in-time, approval-based admin roles | P2 | Needed for the administrators who hold eligible roles, and also for approvers and access-review reviewers. See the licensing caveat below. |
| Access reviews and entitlement management | P2 | Lifecycle workflows and the wider governance scope belong to Entra ID Governance, which is also part of the Entra Suite. |
| Identity governance beyond that, network access (Private and Internet Access) | Entra Suite | Requires P1 as a prerequisite and bundles Identity Protection, ID Governance and network access. Only relevant once the P1 and P2 features are in use. |
| Microsoft 365 plan | Includes Entra ID |
|---|---|
| Microsoft 365 Business Premium | P1 |
| Microsoft 365 E3 | P1 |
| Microsoft 365 E5 | P2 |
So a Business Premium or E3 estate already has Conditional Access, and buying P1 again is pure waste. Whether E5 is worth it for its Entra P2 alone is rarely the right question; the comparison of the whole plan is in our E3 vs E5 guide. The Entra Suite builds on P1 and bundles Identity Protection, ID Governance and network access; it is worth a look only when the features in this table are already in use.
Giving P2 to a few administrators and P1 to everyone else is cheaper than P2 for all, and it is a sound pattern for Privileged Identity Management, provided approvers and reviewers are licensed too. It breaks when a feature is switched on for a wider group than the P2 licences cover. Microsoft's principle is that each user who benefits from a P2 feature needs a P2 licence. A risk-based Conditional Access policy applied to all users, or an access review over all employees, puts those users in scope. Guests are the exception: they are billed under External ID monthly-active-user pricing. Decide the scope of each feature first, count the users it covers, and license that number. If the answer differs from your P2 count, the difference is either unlicensed use or an unused licence, and both are worth knowing.
The classic waste is a user who holds E5 and also a standalone P1 or P2, usually bought before the E5 rollout and never cancelled. E5 already contains P2, which contains P1, so the standalone licence adds nothing. The same applies to a user who holds both P1 and P2. The Zation Platform detects double-licensed accounts per user, so these overlaps show up as a list you can act on before the renewal rather than as a surprise in the true-up.
Per-user evidence of overlaps between E5 and standalone Entra licences.