Microsoft Entra Workload ID [New Commerce Experience]
Microsoft Entra Workload ID
Microsoft Entra Workload ID Premium secures the identities that are not people: applications, services, containers and service principals. It brings Conditional Access for workload identities, Microsoft Entra ID Protection risk detection for them, and access reviews on service principals holding privileged roles. Two licensing facts decide how it is bought. It is a standalone product and is **not** included in any other premium plan, so no Microsoft 365 or Entra plan covers it. And licence assignment is not per identity: one licence in the tenant unlocks the features for all workload identities, with the quantity based on how many are eligible.
What it is
Microsoft Entra Workload ID is the identity and access management product for workload identities, meaning applications, services and containers that authenticate in their own right rather than on behalf of a person. It comes in a Free edition included with commercial online services, and a Premium edition, which is what this licence is.
Who it is for
Organisations that have brought human identities under Conditional Access and risk policy and then realised the service principals were never covered. A typical trigger is a GitHub Actions workflow or an automation account holding standing access to a subscription.
Key capabilities
- Conditional Access for workload identities, on single-tenant applications
- Microsoft Entra ID Protection risk detection for single and multitenant applications under enterprise apps and service principals
- Access reviews on service principals assigned to privileged roles, including managed identities
- Adaptive policies and custom security attributes on workload identities
Two licensing facts worth knowing before you quote
It is never included. Microsoft states plainly that Workload ID Premium is a standalone product and is not part of another premium product plan. No Microsoft 365 plan and no Entra ID plan covers it, so this is one of the few products where the overlap question has a flat answer.
One licence unlocks the tenant. Licence assignment to individual workload identities is not required; one licence in the tenant enables the features for all of them. Quantity is based on how many workload identities are eligible for premium features, which are the enterprise apps and service principals listed on the Workload ID page in the Microsoft Entra admin centre.
What is out of scope
Microsoft applications and managed identities are not eligible for Conditional Access and ID Protection. Access reviews do apply to service principals in privileged roles including managed identities, and that case needs Microsoft Entra ID P2 for the reviewers as well as Workload ID Premium for the service principals being reviewed.
Before you buy
A 90-day free trial is available, and 30 days in the modern channel. The free trial is not available in Microsoft Azure Government clouds.
Is it included in Microsoft 365 E5 or Microsoft Entra ID P2?
No. Microsoft states that Workload ID Premium is a standalone product and is not part of another premium product plan. All subscribers require a licence to use its features, so no Microsoft 365 or Entra plan covers it.
Do I license each application separately?
No. Licence assignment to individual workload identities is not required: one licence in the tenant unlocks the features for all of them. Quantity is based on how many identities are eligible for premium features.
Does it cover managed identities?
Partly. Microsoft applications and managed identities are not eligible for Conditional Access and ID Protection. Access reviews do apply to service principals in privileged roles including managed identities, and that scenario also needs Entra ID P2 for the reviewers.
Can I see which licences are assigned to workload identities?
There is no dashboard for that. Microsoft suggests tracking enabled Conditional Access policies targeting workload identities through the insights and reporting area instead.
Is there a trial?
Yes, a 90-day free trial, or 30 days in the modern channel. It is not available in Microsoft Azure Government clouds.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 3-Year, 1-Year, Monthly
- Unit price
- €2.70 /mo
- SKU
- MST-NCE-EWI-C100
Attachable SKUs from the same category. Check each add-on's prerequisites for base-licence eligibility.
- 1You prepay through ITSailor (Malta). VAT handled, reverse-charge for valid EU VAT IDs.
- 2We provision through Pax8 wholesale into your Microsoft tenant, with no third-party MSP markup.
- 3You keep the tenant. Sovereign by default: every engagement closes with an Exit Kit.
Pax8 wholesale, margin in the price
Microsoft Defender Vulnerability Management Add-on (Education Student Pricing) [New Commerce Experience]
Microsoft Defender Vulnerability Management add-on is available to Defender for Endpoint Plan 2 customers to access continuous asset visibility, in-depth vulnerability assessments, and risk-based prioritization to help teams address critical vulnerabilities and misconfigurations.
Microsoft Entra ID P1 (Education Student Pricing) [New Commerce Experience]
Microsoft Entra ID P1 provides single sign-on to thousands of cloud (SaaS) apps and access to web apps you run on-premises. Built for ease of use, Microsoft Entra ID P1 features multi-factor authentication (MFA); access control based on device health, user location, and identity; and holistic security reports, audits,
Microsoft Entra ID P2 (Education Student Pricing) [New Commerce Experience]
Microsoft Entra ID P2 includes all the capabilities of P1 plus advanced identity protection features such as Identity Protection, which helps detect potential vulnerabilities affecting your organization’s identities, and Privileged Identity Management, which helps manage, control, and monitor access within your organiz
Microsoft Defender Vulnerability Management (Education Student Pricing) [New Commerce Experience]
Microsoft Defender Vulnerability Management standalone is a comprehensive vulnerability management solution to access continuous asset visibility, in-depth vulnerability assessments, and risk-based prioritization to help teams address critical vulnerabilities and misconfigurations.