Microsoft Entra ID P1 — Pricing, Plans & What's Included

Microsoft Entra ID P1 is a standalone per-user identity and access subscription for Commercial organizations, because it adds paid workforce identity controls to a Microsoft Entra tenant. It is best suited for businesses that need Conditional Access, single sign-on, centralized app access management, hybrid identity support, and dynamic group-based access control.

Microsoft Entra ID P1 includes paid identity controls such as Conditional Access, single sign-on, self-service password capabilities, app access management, dynamic groups, and hybrid identity support. It also includes Microsoft Entra application proxy capabilities for publishing eligible on-premises web applications without a traditional VPN when the environment is properly configured.

Microsoft Entra ID P1 does not include Microsoft Entra ID P2-only capabilities, because features such as Privileged Identity Management and Identity Protection risk-based identity features require P2. It also does not include Microsoft Entra ID Governance, Microsoft 365 apps, Exchange, Teams, SharePoint, OneDrive storage, Intune device management, or Microsoft Defender products unless those are purchased separately or included in another suite.

Each user who uses or benefits from Microsoft Entra ID P1 capabilities should be licensed, because this is a per-user subscription. In practice, businesses usually license workforce users who are targeted by Conditional Access policies, dynamic group-based access, self-service password reset features, application proxy access, or other P1 capabilities.

Microsoft Entra ID P1 for Commercial customers is available as a monthly commitment billed monthly, or as an annual commitment billed either annually upfront or monthly. Annual upfront is the lowest listed per-seat rate in the current Commercial options, while annual paid monthly provides annual commitment with monthly billing and month-to-month provides the most flexibility.

No trial SKU is listed for this Microsoft Entra ID P1 Commercial offer, because the current source options only show paid Commercial subscription terms. If a buyer wants to test capabilities before production rollout, IT Partner should confirm whether any separate Microsoft evaluation path or tenant-level trial is available at the time of purchase.

Microsoft Entra ID P1 is enough when the main requirements are Conditional Access, single sign-on, self-service password capabilities, app access management, dynamic groups, hybrid identity support, and application proxy. Microsoft Entra ID P2 is needed when the organization requires P2-only features such as Privileged Identity Management or Identity Protection risk-based identity capabilities.

No, Microsoft Entra ID P1 does not include Microsoft Teams or Microsoft 365 productivity apps, because it is a standalone identity and access plan rather than a collaboration or productivity suite. A user still needs the appropriate Teams or Microsoft 365 license to use those services, while Entra ID P1 can help secure access to them with Conditional Access.

No, Microsoft Entra ID P1 by itself does not license Microsoft 365 Copilot, because Copilot requires eligible Microsoft 365 licensing and the relevant Copilot license. Entra ID P1 can support stronger identity controls around Copilot access, but it is not a Copilot entitlement and does not replace the required Microsoft 365 prerequisites.

Microsoft Intune is not included with Microsoft Entra ID P1, because P1 is an identity plan and Intune is device and app management licensing. Entra ID P1 can create Conditional Access policies that use device-related conditions, but organizations that need device compliance management, mobile device management, or app protection policies should confirm whether Intune is also required.

Yes, Microsoft Entra ID P1 includes self-service password capabilities, because P1 supports user password management features beyond the free identity tier. Password writeback for hybrid identity scenarios can be supported when the tenant and on-premises identity architecture are properly configured, so hybrid requirements should be validated before rollout.

Yes, Microsoft Entra ID P1 includes Microsoft Entra application proxy capabilities, because P1 supports publishing eligible on-premises web applications through Entra rather than a traditional VPN. The application, connector placement, authentication method, and network design should be reviewed before assuming every legacy app is suitable.

Microsoft Entra ID P1 improves sign-in security because it enables Conditional Access policies based on users, groups, devices, locations, applications, and sign-in conditions. It can support compliance programs by enforcing stronger identity controls, but it is not a complete compliance suite and does not replace Microsoft Purview, Defender, Intune, or Entra ID P2 features when those are required.

A safe rollout starts with assigning licenses to a pilot group, because Conditional Access and password policies can affect user sign-in immediately if deployed broadly. Businesses should test policies with break-glass admin accounts excluded, validate MFA and device requirements, and expand enforcement gradually after confirming that users can access critical apps.

Yes, a CSP transfer to IT Partner is normally a billing and partner relationship change rather than a tenant migration, because the Microsoft Entra tenant, users, policies, and applications remain in place. Entra ID access should continue without downtime as long as licensing remains active, and the Microsoft-published Commercial offer pricing does not change because the CSP partner changes; confirm any partner-specific terms before transfer.

Seats can generally be added during the term, because Microsoft CSP subscriptions support increasing license quantity when more users need access. Seat reductions depend on the commitment term and Microsoft CSP cancellation or reduction rules, so annual commitments usually limit reductions until renewal except within the applicable post-purchase adjustment window.

At renewal, the Microsoft Entra ID P1 subscription normally continues under the selected term unless it is changed or cancelled according to CSP rules, because Commercial subscriptions are term-based. Monthly commitments provide more frequent cancellation flexibility, while annual commitments trade flexibility for a longer commitment; cancellation or reduction after purchase is usually limited to Microsoft’s short CSP adjustment window, commonly 7 calendar days, and should be confirmed with IT Partner.

A Government customer should not assume the Commercial Microsoft Entra ID P1 offer is appropriate, because GCC, GCC High, and other government cloud requirements can involve different eligibility, compliance, and data residency expectations. If the organization requires a Government cloud environment or GCC High controls, IT Partner should validate the correct Government segment offer before any Commercial purchase.

An eligible nonprofit should check Charity or nonprofit licensing before buying the Commercial Microsoft Entra ID P1 offer, because Microsoft often separates nonprofit eligibility and offers from standard Commercial licensing. Grant availability and discounted nonprofit options can vary by product, country, and eligibility status, so IT Partner should confirm the best route before the organization commits.

A school should not default to the Commercial Microsoft Entra ID P1 offer, because Education licensing can distinguish between student and faculty or staff use and may have different eligibility and terms. IT Partner should confirm whether the users are students, faculty, staff, or commercial workers and then select the correct Education or Commercial segment licensing.