Entra ID P1 vs P2
Entra ID is Microsoft's identity service, the thing that decides who can sign in and under what conditions. P1 covers the essentials. P2 adds the parts that watch for risk and lock down your most powerful accounts.
What P1 gives you
Entra ID P1 is where the practical security lives. Conditional access lets you set rules like "require multifactor authentication from outside the office" or "block sign-ins from unmanaged devices." Self-service password reset takes reset calls off your help desk. Dynamic groups keep access lists current automatically. For most small and mid-sized businesses, P1 covers the day-to-day.
What P2 adds
P2 is about risk and privilege. Identity Protection uses Microsoft's signals to score each sign-in and can automatically require a stronger check, or block, when a login looks risky. Privileged Identity Management, or PIM, means an admin is not permanently an admin: they request elevated rights just in time, for a limited window, with approval and an audit trail. Access reviews make someone confirm, on a schedule, that people still need the access they have.
Those are the controls auditors and cyber-insurance questionnaires increasingly ask about, especially around standing admin access.
Side by side
| Entra ID P1 | Entra ID P2 | |
|---|---|---|
| Conditional access | Yes | Yes |
| Self-service password reset | Yes | Yes |
| Dynamic groups | Yes | Yes |
| Risk-based Identity Protection | No | Yes |
| Privileged Identity Management (PIM) | No | Yes |
| Access reviews and entitlement management | No | Yes |
| Included with | Business Premium, E3 | E5 |
| List price if bought alone (per user / month) | About $6 | About $9 |
List prices are estimates in USD on an annual commitment and change over time. Confirm current pricing with your Microsoft partner.
Which one you need
If you have Business Premium or E3, you already have P1, and for many organizations that is the right level. Move to P2 when you have privileged accounts to protect, a compliance or insurance requirement for just-in-time admin access and access reviews, or you want sign-in risk handled automatically rather than by hand. P2 is included in E5, so if you are heading to E5 anyway, you get it there.
Answer four questions and get your exact licenseFree. No sign-up. Real prices and when to upgrade.Common questions
What is the main difference between Entra ID P1 and P2?
P1 gives you conditional access, self-service password reset, and dynamic groups. P2 adds risk-based Identity Protection, Privileged Identity Management for just-in-time admin access, and access reviews. P2 is about protecting risky sign-ins and privileged accounts.
Which Microsoft 365 plans include Entra ID P1 and P2?
Entra ID P1 is included with Microsoft 365 Business Premium and E3. Entra ID P2 is included with Microsoft 365 E5. Both can also be bought as standalone add-ons.
Do I need P2 if I already have P1?
Not always. Move to P2 when you need automatic handling of risky sign-ins, just-in-time privileged access with an audit trail, or scheduled access reviews, which are common compliance and cyber-insurance requirements.
How much do Entra ID P1 and P2 cost?
Bought alone, P1 lists at about $6 per user per month and P2 at about $9. Most organizations get them included with Business Premium, E3, or E5. Confirm current pricing with your Microsoft partner.