Azure AD Premium P1 vs P2: Microsoft Entra ID P1 vs P2 Compared

Azure AD Premium P1 vs P2: Microsoft Entra ID P1 vs P2 Compared

Originally published 11 October 2020 · Reviewed 5 November 2026

Microsoft renamed Azure AD Premium P1 and P2 to Microsoft Entra ID P1 and P2 on 1 October 2023. The capabilities and licensing stayed the same; only the labels changed. This article explains what the paid tiers add over the free tier, where P2 goes beyond P1, and how to check which you already own. We do not quote prices, because they change and differ by agreement, currency and region. Use Microsoft's pricing page for those.

The three tiers in plain terms

• Microsoft Entra ID Free comes with Microsoft cloud subscriptions. It provides basic user and group management, single sign-on to applications, and security defaults.
• Microsoft Entra ID P1 adds the controls most organisations expect from a business identity platform: Conditional Access, password reset with writeback to on-premises Active Directory, and more administrative options for multifactor authentication.
• Microsoft Entra ID P2 includes P1 and adds identity risk detection and privileged access controls.

What P1 adds

According to Microsoft's licensing page, the features that need P1 or higher include:

• Conditional Access, the policy engine that combines user, device, location and application signals to decide whether to allow, block or challenge a sign-in.
• Self-service password reset with writeback, so a reset in the cloud updates the on-premises password. Basic cloud password reset is available without P1.
• Additional MFA options, including fraud alert, reports, trusted IPs, custom greetings and caller ID for phone calls, and MFA for on-premises applications.
• Microsoft Entra Application Proxy, which publishes internal web applications for external access.
• Custom roles and administrative unit administration, where each administrator needs a P1 licence.
• Microsoft Entra Connect Health reporting for hybrid environments.

What P2 adds

P2 includes the P1 features plus:

• Microsoft Entra ID Protection, which detects risky users and risky sign-ins and feeds risk-based Conditional Access policies. Microsoft states that risk policies, full security reports and notifications need P2.
• Privileged Identity Management (PIM), which makes privileged role assignments eligible and time-limited, with approval and activation controls.
• Access reviews and entitlement management for periodic recertification and request-based access. Microsoft's current licence table places several advanced governance features in the separate Microsoft Entra ID Governance add-on, so check which capabilities you need.

Which Microsoft 365 plans include them

Microsoft lists Entra ID P1 as included with Microsoft 365 Business Premium, E3 and several frontline plans, and Entra ID P2 as included with Microsoft 365 E5. Microsoft also sells P1 and P2 standalone. The practical consequence is that many small businesses already own P1 without having configured it. In the Microsoft Entra admin center, check the licences page to confirm what the tenant has, and in the Microsoft 365 admin center check which users the licences are assigned to.

When P1 is enough

P1 is enough when your goal is:

• requiring MFA for administrators, or for everyone, with exceptions managed by policy;
• blocking legacy authentication and risky locations;
• requiring compliant or hybrid-joined devices for sensitive applications;
• allowing self-service password reset with writeback;
• publishing a small number of internal web apps.

When to consider P2

Consider P2, or a plan that includes it, when you need:

• sign-in and user risk policies that respond automatically to leaked credentials or unusual sign-ins;
• just-in-time administrator roles, so nobody holds standing Global Administrator rights;
• scheduled reviews of who still has access to sensitive groups or applications;
• audit evidence of privileged activity for a regulator or customer.

If you only want fewer standing administrators, remember that a well-run break-glass process plus Conditional Access on admin roles on P1 is a real improvement before you buy P2.

Licensing traps

• Licences are per user. If only some users have P2, only those users are covered by the features that need it, and Microsoft's licence page lists which users must be licensed for features such as PIM.
• When a P2 or Governance licence expires, PIM features stop working, and eligible role assignments are removed. Plan renewals so that administrators are not locked out.
• Group-based licensing makes it easier to keep assignments in line with job roles.
• A trial can switch on features you cannot keep. Record what you enabled so that you can unwind it.

Frequently asked questions

Is Azure AD Premium the same as Entra ID P1? Yes. Microsoft changed the display name on 1 October 2023 and stated that the capabilities included did not change.

Do I need P2 to use Conditional Access? No. Conditional Access needs P1. Policies that use risk signals from ID Protection need P2, because that is where the risk detections come from.

Can I mix tiers? Yes, licences are assigned per user, but features that need a licence must be covered for the users they affect. Keep a short record of which groups hold which licence, and review it when you add staff.

Does the free tier include any protection? Security defaults give a baseline, including MFA registration, but they are not configurable policy. Move to Conditional Access when you need exceptions, device conditions or named locations.

Where do I see what we own? Use the licences view in the Microsoft Entra admin center and the Microsoft 365 admin center, then compare it with the feature list on Microsoft's licensing page before you plan a project.

Microsoft references

• Microsoft Entra licensing, reviewed 5 November 2026.
• New name for Azure Active Directory, including the 1 October 2023 plan renames, reviewed 5 November 2026.
• Microsoft Entra pricing, for current prices.

This article was first published on 11 October 2020, when it listed prices that are no longer current. It was rewritten on 5 November 2026 without prices and with current product names. Microsoft's live documentation takes precedence if it has changed.