Microsoft Entra ID P1: capabilities and the P2 line
Microsoft Entra ID P1
per user per month, excluding VAT
Ask a questionNo markup on top of Pax8's suggested retail. My margin is the Pax8 wholesale discount.
Check whether your current plan already includes this: Licence Overlap Check, free, and nothing leaves your browser.
Microsoft Entra ID P1 is the paid identity tier that makes Conditional Access available. Alongside it come multifactor authentication, dynamic group membership, role-based access control, self-service password reset including writeback to an on-premises directory, Application Proxy for internal web applications, and single sign-on across cloud and on-premises resources. The boundary worth knowing is the one above it: Microsoft Entra ID Protection, risk-based Conditional Access, Privileged Identity Management, access reviews and entitlement management are all P2 features and are not in P1. P1 is included in Microsoft 365 Business Premium and in Microsoft 365 E3.
What it is
Microsoft Entra ID P1 is the first paid tier of Microsoft's identity and access management service. Its defining capability is Conditional Access, which the free tier does not have.
Who it is for
Organisations that need to control access to Microsoft 365 and other applications by conditions such as user, device state and location, and that operate either fully in the cloud or across cloud and on-premises directories.
Key capabilities
- Conditional Access policies
- Multifactor authentication
- Dynamic group membership and self-service group management
- Role-based access control for administrative roles, and administrative units
- Self-service password reset, including writeback to an on-premises directory
- Application Proxy for on-premises web applications
- Single sign-on across cloud and on-premises applications
What is not included
P1 does not include Microsoft Entra ID Protection, and therefore does not include risk-based Conditional Access. It also does not include Privileged Identity Management, access reviews, entitlement management or the wider identity governance features. Those are Microsoft Entra ID P2.
Where it is already included
Microsoft Entra ID P1 is part of Microsoft 365 Business Premium and Microsoft 365 E3. Buying it standalone applies to organisations on plans that do not carry it, such as Microsoft 365 Business Basic or Business Standard.
Do I need Entra ID P1 for Conditional Access?
Yes. Conditional Access requires Microsoft Entra ID P1. Customers with Microsoft 365 Business Premium licences can also use it, because Business Premium includes Entra ID P1.
Does P1 include risk-based Conditional Access?
No. Risk-based Conditional Access depends on Microsoft Entra ID Protection, which is a P2 feature. P1 covers Conditional Access policies based on conditions such as user, device and location.
What does P2 add over P1?
Microsoft Entra ID Protection with risk-based Conditional Access, Privileged Identity Management, access reviews, entitlement management and identity governance.
Is Entra ID P1 already included in my Microsoft 365 plan?
It is included in Microsoft 365 Business Premium and Microsoft 365 E3. It is not included in Microsoft 365 Business Basic or Business Standard, which is where the standalone licence applies.
Does P1 cover self-service password reset for hybrid users?
Yes. Password reset with writeback to an on-premises directory requires Microsoft Entra ID P1, P2 or Microsoft 365 Business Premium. It is not supported on Microsoft 365 Business Basic or Business Standard.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 1-Year, Monthly
- SKU
- MST-NCE-121-C100
- 1You request the licence, or add it to the cart.
- 2I confirm price, term and seats, and check your VAT number in VIES. Businesses in the EU only.
- 3You pay before we provision, under the CSP Marketplace Terms. The invoice comes from Michal Jatczak, a sole trader registered in Malta, trading as ITSailor. Reverse charge for an EU VAT number that validates in VIES.
- 4Your authorised signatory accepts the Microsoft Customer Agreement before activation.
- 5I place the order with Pax8 within one business day of payment.