Microsoft Entra ID P2: PIM, Identity Protection, reviews
Microsoft Entra ID P2
per user per month, excluding VAT
Ask a questionNo markup on top of Pax8's suggested retail. My margin is the Pax8 wholesale discount.
Check whether your current plan already includes this: Licence Overlap Check, free, and nothing leaves your browser.
Microsoft Entra ID P2 contains everything in Entra ID Free and P1 and adds the two capabilities that define it: Microsoft Entra ID Protection, which brings risk detection and risk-based Conditional Access, and Privileged Identity Management, which makes administrative roles eligible and time-bound rather than permanently assigned. It also adds access reviews, entitlement management and the wider identity governance features. P2 is included in Microsoft 365 E5 and E7, in Microsoft Defender Suite, and in Enterprise Mobility plus Security E5. The standalone licence is for organisations on E3, Business Premium or another plan that carries only P1.
What it is
Microsoft Entra ID P2 is the top tier of Microsoft's identity and access management service. Where P1 gives you Conditional Access, P2 gives you risk as an input to it, and time-bound privilege as an output.
Who it is for
Organisations that need to remove standing administrative access, detect compromised identities from signals rather than reports, or evidence periodic access review to an auditor or regulator.
Key capabilities
- Everything in Microsoft Entra ID P1, including Conditional Access, multifactor authentication, dynamic groups, self-service password reset with on-premises writeback and Application Proxy
- Microsoft Entra ID Protection: risk detection on users and sign-ins, and risk-based Conditional Access policies
- Privileged Identity Management: eligible rather than permanent role assignment, just-in-time elevation, approval and time limits on administrative access
- Access reviews: periodic recertification of who holds what
- Entitlement management: access packages and lifecycle for granting and removing access
- Identity governance features built on the above
Why this matters beyond the feature list
Two of these map directly onto controls that EU operators are asked to evidence. Privileged Identity Management is how you demonstrate that administrative rights are limited in scope and in duration rather than standing. Access reviews are how you demonstrate that entitlement is checked rather than assumed. Both are far easier to evidence from a product that records them than from a spreadsheet.
Check whether you already have it
Entra ID P2 is included in Microsoft 365 E5 and E7, in Microsoft Defender Suite, and in Enterprise Mobility plus Security E5. It is also included in the Defender Suite add-ons for Microsoft 365 Business Premium. The standalone licence is for tenants on Microsoft 365 E3 or Business Premium, both of which carry P1 only.
Requirements
Risk-based Conditional Access depends on Entra ID Protection and therefore on P2. When P2 licences lapse, existing Conditional Access policies are not deleted; they remain visible and can be removed, but not updated.
What does P2 add over Microsoft Entra ID P1?
Microsoft Entra ID Protection with risk detection and risk-based Conditional Access, Privileged Identity Management, access reviews, entitlement management and the wider identity governance features. P1 has none of these.
Do I need P2 for risk-based Conditional Access?
Yes. Risk-based Conditional Access depends on Microsoft Entra ID Protection, which is a P2 feature. Conditional Access itself, based on user, device and location, is available with P1.
Which plans already include P2?
Microsoft 365 E5 and E7, Microsoft Defender Suite, Microsoft Defender Suite FLW, Defender plus Purview Suite FLW, and Enterprise Mobility plus Security E5. Microsoft 365 E3 and Business Premium include P1 only.
What happens to policies if P2 licences lapse?
Conditional Access policies are not automatically disabled or deleted. You can view and delete the remaining policies but you cannot update them, which is a deliberate grace state so security posture does not change suddenly.
What does Privileged Identity Management actually change?
Administrative roles become eligible rather than permanently assigned. A user activates the role when needed, optionally with approval and always for a limited time, so there is no standing administrative access to steal.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- Monthly, 1-Year
- SKU
- MST-NCE-122-C100
- 1You request the licence, or add it to the cart.
- 2I confirm price, term and seats, and check your VAT number in VIES. Businesses in the EU only.
- 3You pay before we provision, under the CSP Marketplace Terms. The invoice comes from Michal Jatczak, a sole trader registered in Malta, trading as ITSailor. Reverse charge for an EU VAT number that validates in VIES.
- 4Your authorised signatory accepts the Microsoft Customer Agreement before activation.
- 5I place the order with Pax8 within one business day of payment.