# Microsoft Entra Suite vs Entra ID P2: what the bundle adds and who needs it > Entra ID P2 brings PIM, Identity Protection and access reviews. Entra Suite assumes P1 and bundles Private Access, Internet Access, ID Governance and Face Check. What each adds and who should buy the bundle. Canonical: https://o365hq.com/blog/microsoft-entra-suite-vs-entra-id-p2-what-the-bundle-adds-and-who-needs-it Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book Published: 2026-11-09 · IT Partner Microsoft Entra ID P2 and the Microsoft Entra Suite sit next to each other on the price list and get confused with each other constantly. They are not two tiers of the same product. P2 is the identity tier above P1: privileged role management, risk detection and access reviews. The Suite is a bundle of five separate products that assumes you already hold P1 and adds private network access, web filtering, lifecycle automation and identity verification on top. This article lays out what each contains, what the standalone add-ons require underneath, and which organizations should buy the bundle instead of one piece of it. ## What Entra ID P2 includes Entra ID P2 is everything in P1 plus three capabilities. Business Premium and Microsoft 365 E3 include P1; Microsoft 365 E5 includes P2; P2 is also sold standalone per user. Privileged Identity Management (PIM) makes Entra roles, Azure resource roles and group memberships eligible rather than permanent, so an administrator activates Global Administrator for a few hours with justification and approval instead of holding it around the clock. Identity Protection scores every sign-in and every user for risk (leaked credentials, anonymous IP addresses, impossible travel, token anomalies) and exposes those levels as Conditional Access conditions. Access reviews schedule recurring attestations of group memberships, application assignments and privileged role holders, and basic entitlement management bundles groups, applications and SharePoint sites into access packages behind a request-and-approve policy. That is the whole P2 delta; our Entra ID P1 vs P2 article goes through it feature by feature. P2 does not route network traffic, filter the web, automate a new hire's first day, or verify that the person asking the help desk for a password reset is who they claim. Those are the Suite's job. ## What Entra Suite bundles Microsoft Entra Suite is a per-user license that requires Entra ID P1 underneath and bundles five products. - **Microsoft Entra Private Access.** Zero Trust Network Access to private applications and on-premises resources through the Global Secure Access client and a Private Network Connector, with per-application Conditional Access and multifactor authentication on protocols such as SMB and RDP that never supported it. It is the VPN replacement, covered in our Entra Private Access vs VPN article. - **Microsoft Entra Internet Access.** An identity-aware secure web gateway: web content filtering by category and by fully qualified domain name, security profiles attached to Conditional Access policies, the Microsoft 365 traffic profile with its compliant-network check and universal tenant restrictions, and TLS inspection. - **Microsoft Entra ID Governance.** Lifecycle workflows for joiner, mover and leaver automation; advanced entitlement management (auto-assignment policies, custom extensions that call Azure Logic Apps, Verified ID requirements in access packages, sponsors for guests); machine-learning recommendations and multi-stage approvals in access reviews; and the governance dashboard. Governance also includes PIM. - **Microsoft Entra ID Protection.** The same risk engine P2 ships, so a P1 tenant with the Suite gets risk-based Conditional Access. - **Microsoft Entra Verified ID premium features.** Issuing and verifying credentials is free to any Entra ID tenant; the Suite adds Face Check, which matches a live selfie against the photo in a trusted credential during onboarding or help desk recovery. A P1 tenant plus the Suite therefore has every P2 capability (PIM and access reviews through Governance, risk through ID Protection) and four things P2 never had. ## The standalone add-ons and their prerequisites Each Suite component is also sold alone, and each assumes a base license. Entra Private Access and Entra Internet Access are per-user add-ons that require Entra ID P1 or higher. Microsoft also lists a combined Private and Internet Access license for tenants that want both network products without Governance or Verified ID. Both need the Global Secure Access client on the device, and Private Access needs at least one Private Network Connector (a Windows Server service) on the network that hosts the private applications. Entra ID Governance is a per-user add-on sold in two forms: one for tenants on Entra ID P1 and a step-up for tenants already on P2. Both reach the same feature set, which our Entra ID Governance article walks through; Microsoft also lists frontline editions of Governance and the Suite. Entra ID Protection on its own means buying Entra ID P2; there is no narrower license for risk-based Conditional Access. Face Check with Verified ID is sold outside the Suite as a metered add-on charged per verification. ## Who needs the bundle and who needs one add-on The Suite is the answer when three or more of its components are on your roadmap within the same budget year. The common profile is an organization of 100 to 500 people on Business Premium or E3 with a VPN appliance coming up for renewal, a web filter or secure web gateway subscription from another vendor, and a joiner-mover-leaver process still running on tickets. As the Suite they are one license per user, and the tenant also picks up PIM and Identity Protection it did not have on P1. The Suite is also the right call for a P1 tenant that wants P2's security features and a VPN replacement at the same time; P2 plus Private Access as two lines lands close to the Suite, which brings Internet Access, Governance and Face Check with it. One add-on is the answer when the need is narrow. An organization whose only problem is the VPN buys Private Access. An organization with an auditor asking for quarterly access attestation and automated deprovisioning buys Governance. An organization that already has a web filter it is satisfied with should not pay for Internet Access inside a bundle. And nobody should buy the Suite to get PIM alone; Entra ID P2 does that. ## Microsoft 365 E5 and Business Premium interactions Microsoft 365 E5 includes Entra ID P2 through Enterprise Mobility + Security E5. It does not include the Entra Suite or any of its network components. An E5 tenant that wants Private Access buys Private Access; the Suite would duplicate the ID Protection and PIM it already owns, so for E5 the arithmetic favors individual add-ons unless three of them are wanted. Microsoft 365 Business Premium includes Entra ID P1, which satisfies the Suite's prerequisite. Business Premium is capped at 300 users; the Suite carries no such cap, so a Business Premium tenant can add the Suite for every user or for a subset. Microsoft 365 E3 includes P1 and is the most common base for Suite purchases among 100 to 500 person organizations. E3 plus the Suite is a frequent alternative to E5 for organizations that want the identity and network pieces but not Defender for Office 365 Plan 2 or Purview's premium features. Mixing is allowed: Private Access for the eighty remote workers and Governance for every employee, provided each user who benefits from a feature holds the license that grants it. ## Licensing per user, the Global Secure Access client and the charges that are yours All Entra products are licensed per user, not per device or per connector. A Conditional Access policy that uses sign-in risk requires P2 or ID Protection for every user in scope; a lifecycle workflow requires Governance for every user it processes; the Global Secure Access client enforces Private Access or Internet Access only for users who hold the license. The client runs on Windows 10 and 11 (Entra joined or hybrid joined), macOS, iOS and Android. Entra registered Windows devices are not supported, which is why many Private Access projects start with a device enrollment cleanup. Branch offices connect without the client through remote network connectivity, an IPsec tunnel from the office router to Microsoft's edge; the bandwidth for that tunnel is a separate Microsoft license bought in units of bandwidth per month. The charges that are the customer's: every Entra per-user license at Microsoft's list price; remote network bandwidth; Face Check verifications bought outside the Suite; Azure Logic Apps consumption when Governance custom extensions call them; and Log Analytics ingestion if you keep Global Secure Access traffic logs beyond the portal's thirty days. IT Partner's fixed-price implementation covers the design, connectors, Conditional Access and traffic forwarding profiles, lifecycle workflows and knowledge transfer; it never covers Microsoft's licenses or metered consumption. ## Frequently asked questions ### Does Entra Suite include Entra ID P2? No. The Suite requires Entra ID P1 and includes ID Protection and, through ID Governance, PIM and access reviews, so a P1 tenant with the Suite has P2's capabilities without a P2 license. ### Can I buy Entra Suite if I have Microsoft 365 E5? Yes. E5 includes P2, which satisfies the prerequisite. You will hold ID Protection and PIM twice, which is why E5 tenants usually buy individual add-ons. ### Is Entra Private Access a full VPN replacement? For user access to private applications and servers over TCP and UDP, including RDP, SMB and SSH, yes. Site-to-site connectivity between offices and inbound connections from the internet are not what it does. ### What does Entra ID Governance add over the access reviews in P2? Lifecycle workflows, machine-learning recommendations and multi-stage approval in reviews, auto-assignment and custom extensions in access packages, Verified ID requirements on requests, and the governance dashboard. ## Sources - Microsoft Learn, "Microsoft Entra licensing" (Suite components and P1 prerequisite), https://learn.microsoft.com/entra/fundamentals/licensing, consulted November 2026. - Microsoft Learn, "Microsoft Entra ID Governance licensing fundamentals", https://learn.microsoft.com/entra/id-governance/licensing-fundamentals, consulted November 2026. - Microsoft Learn, "Global Secure Access client for Windows" (supported platforms, join requirement), https://learn.microsoft.com/entra/global-secure-access/how-to-install-windows-client, consulted November 2026. - Microsoft Learn, "Understand remote network connectivity", https://learn.microsoft.com/entra/global-secure-access/concept-remote-network-connectivity, consulted November 2026. - Microsoft Learn, "Using Face Check with Microsoft Entra Verified ID", https://learn.microsoft.com/entra/verified-id/using-facecheck, consulted November 2026. ## Key takeaways - Entra ID P2 adds PIM, Identity Protection, access reviews and basic entitlement management on top of P1; it does nothing for network access or lifecycle automation. - Entra Suite requires Entra ID P1 and bundles Private Access, Internet Access, ID Governance (which includes PIM), ID Protection and Verified ID Face Check. - Every component is sold alone on a P1 base; Governance also comes as a step-up for P2 tenants, and Face Check outside the Suite is metered per verification. - Microsoft 365 E5 includes P2 but not the Suite; E5 tenants usually buy individual add-ons, while Business Premium and E3 tenants with three or more needs buy the bundle. --- Send us your current Microsoft 365 plan, your VPN renewal date and whether you run a web filter today, and we will say whether the Suite or one add-on fits and price the implementation.