Microsoft Entra ID P1 vs P2: the identity add-on you weigh after the bundle

Almost everyone searching this phrase is already licensed for the lower edition and does not realise it. That makes the decision an upgrade question about identity alone, not a bundle question — which bundle to stand on is the step before this one, and we argue it out in Microsoft 365 Business Standard vs Premium. Assume that decision is behind you. What follows is only about the identity edition sitting inside it.

First, find out which edition you are already paying for

Microsoft's Entra licensing documentation (opens in new tab) lists P1 as included in Microsoft 365 E3, E5, E7, F1 and F3, in Enterprise Mobility + Security E3, and — the line that matters for a small business — in Microsoft 365 Business Premium. P2 arrives with Microsoft 365 E5 and E7, Enterprise Mobility + Security E5 and the Microsoft Defender Suite; the same page notes that for small and medium businesses, P2 also comes inside the Defender Suite for Microsoft 365 Business Premium. Both editions are sold standalone as well.

So the practical starting point is not a feature table, it is your own tenant. Open the licences page in the Microsoft 365 admin centre and read what is assigned. A surprising number of upgrade conversations end there, because the capability someone wanted turns out to be sitting in the tenant already, unconfigured. Finding that pattern across a whole estate — entitlements owned, never enabled, sometimes duplicated by a third-party tool bought to fill the same gap — is the job of our advisory Microsoft 365 license optimization review.

What the higher edition actually gates

Two capabilities account for nearly all of the difference. Everything else in the identity stack — Conditional Access itself, self-service password reset with writeback, custom roles, administrative units, application proxy, Entra Connect Health, provisioning logs — is already yours at P1.

Microsoft Entra ID Protection. This is the risk engine: leaked-credential matches, password-spray patterns, anonymous-IP sign-ins, scored in real time. Microsoft's ID Protection documentation (opens in new tab) states the licence requirement plainly and then draws the line in detail: sign-in-risk and user-risk policies, the Overview report, at-risk alerts and the weekly digest are P2 only. P1 is not blind — it shows risky users at medium and high risk, and risk detections — but Microsoft describes that view as limited information with no details drawer and no risk history. You can see that something happened; you cannot work it.

Privileged Identity Management. PIM is what turns “four people hold Global Administrator permanently” into “four people can activate it for two hours, with approval and an audit trail.” Microsoft's licensing page lists PIM, PIM for Groups and PIM Conditional Access controls under P2 (or an Entra ID Governance licence). For most small businesses this, rather than the risk engine, is the capability that justifies the line item — standing admin rights are the exposure you can describe to a board in one sentence.

The third capability everyone expects to get — risk-based Conditional Access — is really the first one wearing a different hat. Microsoft's Conditional Access documentation (opens in new tab) confirms both halves: Conditional Access requires P1 and Business Premium customers can use it, while sign-in-risk and user-risk policies require ID Protection, a P2 feature. In other words, P1 lets you write the rule “finance must use a compliant device”; P2 lets you write “anyone whose sign-in looks compromised right now must re-authenticate.”

Line by line, on the rows that differ

Only the rows where the two editions genuinely diverge, plus the two rows people most often get wrong. Capability detail was checked against Microsoft's own documentation on 14 September 2026; list prices were read the same day from Microsoft's Entra pricing page and they do move, so treat them as a starting point rather than a quote.

Those two figures come from Microsoft's Entra pricing page (opens in new tab), which is where you should confirm them before you commit to anything — we publish no prices of our own for Microsoft licences, and we do not sell them. Microsoft Made Easy is not a reseller or a Cloud Solution Provider: you buy in your own tenant or through whoever bills you today, and we advise on what to buy.

The arithmetic is per user, not per company

The gap between the two editions is three dollars a seat a month at list. That number is almost never the real cost, because the honest question is how many seats need the upgrade at all, and the answer differs by capability.

For privileged-role work, Microsoft publishes a count you can actually apply: its PIM guidance says licences are needed for users with eligible or time-bound role assignments, members and owners of PIM for Groups, people who approve activation requests, and people who perform or are subject to access reviews. A fifty-person company with six administrators and two approvers is looking at a single-digit number of seats, not fifty.

Risk policies are the opposite shape. A sign-in-risk policy is only worth writing if it covers the people who are actually targeted, which in a small business is everyone with a mailbox. Microsoft's licensing article states the feature requires P2 without publishing a comparable per-user worked example, so price that scenario for every user the policy would cover and confirm the count against Microsoft's product terms before purchase rather than after. Getting this wrong in the optimistic direction is the most common way an identity upgrade ends up costing several times what was budgeted.

When P2 is not worth paying for

Four patterns where we tell companies to leave it alone. The first and most common: nobody has configured what P1 already carries. If Conditional Access is at defaults, if there is no named-location rule, if self-service password reset is off, then the identity edition is not your constraint — the configuration is, and a Microsoft 365 tenant security assessment reads which of those settings your tenant is running today and what it would take to close them.

The second: there is no one to act on what P2 produces. Risk detections, at-risk alerts and a weekly digest are inputs to a person, and a licence that generates alerts nobody has been made responsible for is a compliance artefact, not a control. The third: there is nothing privileged to manage — one or two administrators, both trusted, both already on strong authentication, with no third party holding standing rights. PIM adds process where there is no delegation problem to solve. The fourth: the exposure you are actually worried about is a device, not an identity. Data on unenrolled laptops and personal phones is an endpoint-management problem, and buying a higher identity edition does not touch it; Intune deployment services for small business teams is the work that does.

When P2 earns its place

Four patterns where the upgrade is the cheaper answer. Standing administrative rights held by several people, or by an outside IT provider, where the honest fix is just-in-time activation with approval rather than trust. A written obligation — an insurer's questionnaire, a customer security review, a regulator — that asks specifically about privileged access controls or risk-based sign-in, which is a question P1 cannot answer with a screenshot. A credential-exposure event already behind you: if staff passwords have appeared in a breach dump, the ability to act automatically on leaked-credential risk is worth more than the ability to read about it afterwards. And a workforce with high turnover or contractors cycling through, where identifying risky accounts quickly matters more than it would in a stable ten-person office.

In all four cases, buy P2 for the users the capability will actually cover, and put the rollout in the same decision as the purchase. An unconfigured risk policy protects nobody.

The governance line that catches people out

Access reviews and entitlement management have historically been sold as the P2 governance story, and that is no longer a complete description. Microsoft's licensing page now shows those features against a separate Microsoft Entra ID Governance column: the capabilities previously generally available in P2 continue to work with P2, while the feature as a whole is scoped to a Governance subscription for member users, and Lifecycle Workflows — the automated joiner-mover-leaver tasks people usually mean when they say “identity governance” — are Governance-only. If the business case for the upgrade is automated onboarding and offboarding, P2 is not the product you are looking for, and finding that out after the purchase order is a bad afternoon.

Deciding it in an afternoon

Three steps, in order. First, read the tenant: which identity edition is assigned today, and which of the P1 capabilities are switched on. Second, count the privileged identities — every account with a standing admin role, including partner and service accounts. If that number is larger than the number of people who should hold those roles at 2am on a Sunday, PIM has a job to do. Third, decide who a risk policy would cover, and price that group honestly rather than pricing the admins and hoping.

Then write down who will configure it and when, because nothing on the P2 side of the table does anything on its own. If the answer is “nobody, yet,” buy the licences later and the rollout at the same time. One pointer for completeness: if your question turns out to be about the plan family rather than the identity edition — a different decision with a different answer — that one is worked through in Microsoft 365 Business Premium vs E3. We scope identity reviews and the configuration work that follows them as fixed-fee projects with the deliverables agreed in writing before any work starts; see how the fixed-fee process works.