Microsoft Entra
Identity and access management licenses. Each row is a feature; the blue bar shows which plans include it.
| Feature | Entra ID FreeIncluded with Microsoft cloud subscriptions | Entra ID P1Per user | Entra ID P2Per user | Entra ID GovernanceP1 or P2 prerequisite | Entra SuiteP1 or P2 prerequisite | Workload IDPer workload identity |
|---|---|---|---|---|---|---|
| Core identity and access | ||||||
| Multifactor authentication (MFA)[1] | From the prerequisite license | From the prerequisite license | – | |||
| Single sign-on (SSO)[1] | Unlimited SaaS apps | From the prerequisite license | From the prerequisite license | – | ||
| On-premises directory synchronization[1] | – | – | – | |||
| Self-service password reset (SSPR)[3] | Password change for cloud-only users | Including reset and writeback | Including reset and writeback | – | – | – |
| Conditional Access[1] | – | From the prerequisite license | From the prerequisite license | – | ||
| Dynamic groups and advanced group management[1] | – | – | – | – | ||
| Global password protection (banned passwords)[1] | – | – | – | – | ||
| Authentication context and token protection[1] | – | – | – | |||
| Cross-tenant user synchronization[2] | – | Including groups and cross-cloud | Including groups and cross-cloud | – | ||
| Identity protection (ID Protection) | ||||||
| Risk-based Conditional Access[1] | – | – | – | – | ||
| Risky account detection and risk event investigation[1] | – | – | – | – | ||
| Identity governance | ||||||
| Automated user provisioning to SaaS apps[2] | – | |||||
| HR-driven and on-premises app provisioning[2] | – | – | ||||
| Terms of use and governance dashboard[2] | – | – | ||||
| Privileged Identity Management (PIM)[2] | – | – | – | |||
| Access Reviews[2] | – | – | Basic | Advanced | Advanced | – |
| Machine learning-assisted access reviews[2] | – | – | – | – | ||
| Entitlement Management[2] | – | – | Basic | Advanced | Advanced | – |
| Lifecycle Workflows[2]Automation of joiner, mover and leaver processes. | – | – | – | – | ||
| Custom extensions (Logic Apps)[2] | – | – | – | – | ||
| Account Discovery[2] | – | – | – | – | ||
| Network access and verified identity | ||||||
| Entra Private Access (ZTNA)[1] | – | – | – | – | – | |
| Entra Internet Access[1] | – | Partial | Partial | – | Full (URL filtering, cloud firewall) | – |
| Verified ID (credential issuance and verification)[1] | – | – | ||||
| Face Check (facial matching verification)[1] | – | – | – | |||
| Workload identities | ||||||
| Adaptive access policies for workload identities[1]For application identities and service principals. | – | – | – | – | – | |
| Risk remediation and health view for workload identities[1] | – | – | – | – | – | |
- Included
- Available as add-on
- Not confirmed in official sources
- Not included
- Entra ID Governance and Entra Suite cannot be used on their own; the tenant must have a subscription that includes P1 or P2 (such as Entra ID P1/P2, Microsoft 365 E3/E5, EMS E3/E5). MFA and Conditional Access come from this prerequisite license.
- Microsoft states that no new governance (IGA) features will be added to Entra ID P2. New governance features go to Entra ID Governance and Entra Suite.
- Entra Suite combines Private Access, Internet Access, ID Governance, ID Protection and Verified ID. It is included in Microsoft 365 E7.
- P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5.
- Governance for guest users is billed through an Azure subscription on a monthly active users (MAU) model.
- Workload ID is licensed per workload identity, not per user. External ID is a separate product; its core features are free for the first 50,000 monthly active users.
Sources
- Microsoft Entra plans and pricing
- Microsoft Entra ID Governance licensing fundamentals
- Licensing requirements for Microsoft Entra self-service password reset
Last updated: 16 October 2026