Entra ID P1 vs P2 vs Entra Suite: What Each Adds, Who Needs It, and the Price

Prices are per user per month on an annual term, Commercial segment (Microsoft list price, October 2026 price list). The list carries the annual figure: Microsoft Entra ID P1 is $84.00 per user per year, and $84.00 ÷ 12 = $7.00 per user per month. The same arithmetic produces every figure below.

The inclusion column follows Microsoft's Entra licensing page (Microsoft Learn, Microsoft Entra licensing, June 2026); the prerequisites follow the same page and Microsoft's governance licensing article (Microsoft Learn, Microsoft Entra ID Governance licensing fundamentals, July 2026). Frontline and Government variants exist at other prices. Microsoft 365 E7, the only suite that carries the Entra Suite, is $1,188.00 per user per year, or $99.00 per month.

P1 is the tier that makes access conditional. Microsoft's Conditional Access documentation puts the license requirement at P1 and adds that Business Premium customers can use the feature too. Our Entra ID P1 page lists what rides with it: Conditional Access on user, group, device, location and application conditions; single sign-on to cloud apps; self-service password reset with writeback; dynamic groups; and Application Proxy.

What P1 does not do is react to risk. Risk-based policies, the ones that step up authentication when a sign-in looks like a password spray or a leaked credential, need Identity Protection, a P2 feature. When P1 licenses expire, Conditional Access policies keep running and can be viewed and deleted, but not updated; security defaults remain available to every tenant. Our Conditional Access Policy Implementation service builds the P1 baseline, and the design patterns article explains the choices inside it.

The $3.00 between P1 and P2 pays for two things. Identity Protection opens the risky users, risky sign-ins and risk detections reports fully and lets sign-in-risk and user-risk policies be enforced through Conditional Access; our Risky Users and Risky Sign-ins Monitoring service watches those reports for tenants without a security team.

Privileged Identity Management makes role assignments eligible rather than permanent: just-in-time activation, time-bound assignments, approval, MFA on activation, justification and an exportable audit history. Licensing is per person in scope, not per tenant: users with eligible or time-bound role assignments, members and owners in PIM for Groups, approvers, and the people assigned to or performing an access review. If the license expires, PIM features are no longer available in the directory (Microsoft Learn, July 2026). Our Microsoft Entra PIM and Privileged Access Hardening service is where most 20-to-500-seat organizations start with P2: a handful of administrators, not the whole company.

Microsoft's governance feature table (Microsoft Learn, March 2026) splits access reviews and entitlement management into capabilities previously generally available in P2, which P2 still covers, and newer capabilities that need Microsoft Entra ID Governance or the Entra Suite, and Microsoft states that no new identity governance features will be added to P2 (Microsoft Learn, July 2026). P2 keeps reviews of groups, applications and roles, and access packages with self-service requests, approvals, expiration and separation of duties. Governance-only: reviews scoped to inactive users alone, machine-learning-assisted certification, reviews of PIM for Groups, auto-assignment policies, custom extensions through Logic Apps, Verified ID and Insider Risk integrations, and the whole of Lifecycle Workflows. The Entra ID Governance deep dive walks through each.

The price depends on the base. On P1, Microsoft Entra ID Governance is $7.00 and brings the P2 governance features with it; on P2, the Governance add-on for Entra ID P2 is $4.00. Microsoft requires a tenant subscription carrying the P1 or P2 service plan for the former and P2 for the latter (Microsoft Learn, July 2026). Guests are billed per monthly active guest through an Azure subscription, and that meter is yours. The Entra ID Governance Implementation service scopes the add-on to the groups and packages you will actually review.

The Microsoft Entra Suite bundles five products: Private Access, Internet Access, ID Governance, ID Protection and the premium capabilities of Verified ID, including Face Check. Microsoft's licensing page states that an Entra ID P1 subscription, or a package that includes P1, is required, and that the Suite is sold standalone or included in Microsoft 365 E7 (Microsoft Learn, June 2026).

The arithmetic is simple. On a P1 base, Governance ($7.00), Private Access ($5.00) and Internet Access ($5.00) bought separately add up to $17.00; the Suite is $12.00 and adds ID Protection and Verified ID premium features. On a P2 base the Suite add-on is $9.00, because ID Protection is already paid for. Buy the Suite when at least two of the three paid products are on the roadmap, which in practice means lifecycle workflows and a VPN replacement in the same year.

Private Access is the piece that pulls most mid-size tenants in: per-app access through the Global Secure Access client and Conditional Access instead of a VPN concentrator. Our Entra Private Access vs VPN article covers the design, and the Microsoft Entra Private Access VPN Replacement service does the cutover at a fixed price.

Microsoft Entra Workload ID. Microsoft's FAQ describes a no-charge edition, included with services such as Azure and covering managed identities and workload identity federation, and Workload ID Premium, a standalone product not included in any other plan (Microsoft Learn, Workload ID FAQ, March 2025). Premium brings Conditional Access for workload identities, Identity Protection for service principals and access reviews for service principals in privileged roles. It is priced per workload identity, not per user: $36.00 per identity per year, or $3.00 per month. See the Microsoft Entra Workload ID page.

Microsoft Cloud PKI. Despite ranking in Entra searches, Cloud PKI is an Intune product. Microsoft's Intune pricing page lists it inside the Intune Suite and as a standalone add-on requiring Intune Plan 1 (Microsoft, Intune plans and pricing page, opened October 5, 2026), and Microsoft's 2026 packaging update put it inside Microsoft 365 E5 (Microsoft, Microsoft 365 pricing and packaging updates, February 2026), and Microsoft's pricing FAQ states that E5's packaging changes apply to E7. Standalone it is $2.00 on our Microsoft Cloud PKI page. Our Intune licensing guide covers the rest of the Suite.

Decide per population, not per tenant. Everyone on Business Premium, E3 or F3 already has P1, so MFA, Conditional Access, single sign-on and self-service password reset cost nothing more; enforced, they satisfy the access-control expectations of HIPAA, PCI DSS, cyber-insurance questionnaires and the CMMC Level 2 practices drawn from NIST SP 800-171. P2 goes to the people in scope of what P2 does: the administrators PIM will manage, their approvers and reviewers, and any group you target with a risk policy; it is what a SOC 2, ISO 27001 or NYDFS Part 500 program asks for on privileged access and periodic review. Governance or the Suite comes last and tenant-wide, when the joiner-mover-leaver process is actually automated or Private Access replaces something you pay for today. The Microsoft 365 Plan Optimizer prices P1 and P2 as add-ons against a plan change at list price; the E3 vs E5 article explains why whole-company E5 rarely wins on identity alone.

Does Microsoft 365 Business Premium include Entra ID P1 or P2?

P1, per Microsoft's Entra licensing page (June 2026). P2 arrives with the Defender Suite add-on for Business Premium or a standalone P2 license.

What is the difference between Entra ID P2 and the Entra Suite?

P2 is P1 plus Identity Protection and PIM at $10.00. The Suite is a $12.00 bundle on a P1 base that adds Governance, Private Access, Internet Access, ID Protection and Verified ID premium features; a P2 tenant adds it for $9.00.

Is Entra ID Governance included in P2?

No. Lifecycle Workflows, inactive-user reviews and auto-assignment need the Governance add-on ($7.00 on P1, $4.00 on P2) or the Suite.

How much does Entra ID cost per user?

On the October 2026 price list: P1 $7.00, P2 $10.00, Governance $7.00, Entra Suite $12.00, Private Access or Internet Access $5.00 each, per user per month on an annual term; Workload ID is $3.00 per workload identity.

Is Cloud PKI part of Entra?

No. It is an Intune add-on at $2.00, included in the Intune Suite and, since July 2026, in Microsoft 365 E5 and E7.

• Microsoft Learn, Microsoft Entra licensing (June 2026); Microsoft Entra ID Governance licensing fundamentals (July 2026); identity governance features by license (March 2026); Verified ID licensing note (March 2026); Workload ID FAQ (March 2025)
• Microsoft, Entra plans and pricing page and Intune plans and pricing page (opened October 5, 2026); Microsoft 365 pricing and packaging updates (February 2026)
• Microsoft Learn, What is Conditional Access? and What is Microsoft Entra ID Protection? (cited without a date)
• Commercial price list, October 2026

The compliance paragraph characterizes each framework's access-control expectations in general terms and does not cite control numbers.