Microsoft Entra ID Licensing Reference Guide
Complete Enterprise, Government, Education, Business & Add-On Breakdown
Microsoft Entra ID Licensing can be confusing because Features are included across Standalone SKUs and bundled Microsoft 365 Suites. This Guide Consolidates the Major Enterprise, Government, Education, and SMB Licensing Options in a Structured Format.
1. Core Microsoft Entra ID Plans (Standalone)
|
Feature Area |
Free |
Entra ID P1 |
Entra ID P2 |
|
User & Group Management |
Yes |
Yes |
Yes |
|
Basic Security Defaults |
Yes |
Yes |
Yes |
|
Conditional Access |
No |
Yes |
Yes |
|
Hybrid Azure AD Join |
No |
Yes |
Yes |
|
Self-Service Password Reset (on-prem writeback) |
No |
Yes |
Yes |
|
Dynamic Groups |
No |
Yes |
Yes |
|
Identity Protection |
No |
No |
Yes |
|
Privileged Identity Management (PIM) |
No |
No |
Yes |
|
Access Reviews |
No |
No |
Yes |
|
Risk-Based Conditional Access |
No |
No |
Yes |
Enterprise Rule
P1 is required for Conditional Access.
P2 is required for Identity Protection and PIM.
2. Enterprise Mobility + Security (EMS)
|
Suite |
Includes |
Entra ID Level |
|
EMS E3 |
Intune + Entra ID P1 + AIP P1 |
P1 |
|
EMS E5 |
Intune + Entra ID P2 + Defender + AIP P2 |
P2 |
EMS is often licensed separately for organizations not using full M365 E3/E5.
3. Microsoft 365 Enterprise Licensing
|
License |
Entra ID Included |
Identity Protection |
PIM |
Conditional Access |
|
M365 E3 |
P1 |
No |
No |
Yes |
|
M365 E5 |
P2 |
Yes |
Yes |
Yes |
Important
M365 E3 = Entra ID P1
M365 E5 = Entra ID P2
4. Office 365 Enterprise (Identity Only View)
|
License |
Entra ID Included |
|
Office 365 E1 |
Free tier only |
|
Office 365 E3 |
Free tier only |
|
Office 365 E5 |
Free tier only |
Office 365 plans do NOT include P1 or P2 by default.
You must add EMS or standalone P1/P2.
5. Microsoft 365 Business Licensing (SMB)
|
License |
Entra ID Level |
|
Business Basic |
Free |
|
Business Standard |
Free |
|
Business Premium |
P1 |
Business Premium includes:
- Entra ID P1
- Intune
- Conditional Access
It does NOT include:
- PIM
- Identity Protection
6. Government Licensing (GCC)
|
License |
Entra ID Level |
|
Microsoft 365 G3 |
P1 equivalent |
|
Microsoft 365 G5 |
P2 equivalent |
G5 includes:
- Identity Protection
- PIM
- Advanced compliance
Government tenants must validate feature parity per GCC High or DoD environments.
7. Education Licensing
|
License |
Entra ID Level |
|
A1 |
Free |
|
A3 |
P1 equivalent |
|
A5 |
P2 equivalent |
A5 includes:
- Identity Protection
- PIM
- Advanced security & compliance
8. Entra ID Governance Add-On
Entra ID Governance is licensed separately unless included in M365 E5.
|
Feature |
Requires |
|
Access Reviews |
P2 or Governance |
|
Entitlement Management |
Governance |
|
Lifecycle Workflows |
Governance |
If the organization uses:
Access packages or lifecycle workflows → Governance required.
9. External Identities Licensing (B2B / B2C)
B2B (Guest Users)
Billing Model:
Monthly Active Users (MAU)
You get the first 50,000 MAU free.
P1/P2 features apply proportionally based on host tenant licensing.
Azure AD B2C
Separate consumption-based pricing.
Not included in P1/P2.
10. Licensing Requirements for Common Enterprise Features
|
Feature |
Minimum Required License |
|
Conditional Access |
P1 |
|
Risk-Based CA |
P2 |
|
Identity Protection |
P2 |
|
PIM |
P2 |
|
Access Reviews |
P2 |
|
Dynamic Groups |
P1 |
|
Hybrid Identity Writeback |
P1 |
|
Password Writeback |
P1 |
|
Just-In-Time Access |
P2 |
|
Authentication Context |
P1 |
|
Continuous Access Evaluation |
P1 |
11. Common Enterprise Licensing Mistakes
- Deploying Conditional Access without P1 assigned to all scoped users
- Using PIM without P2 coverage for eligible users
- Mixing E3 and E5 users incorrectly in scoped policies
- Forgetting guest user licensing implications
- Over-licensing service accounts
12. Enterprise Licensing Design Strategy
Enterprise Recommendation Model:
Standard Users → M365 E3
Privileged Users → M365 E5
Executives / High-Risk Roles → M365 E5
Contractors → Business Premium (If Appropriate)
Guests → MAU Model
License Assignment Should Align With:
Risk profile
Privilege level
Regulatory requirements
13. Licensing Decision Matrix (Simplified)
|
Organization Size |
Recommended Baseline |
|
SMB (<300 users) |
Business Premium |
|
Mid-size Enterprise |
M365 E3 + Selective E5 |
|
Large Enterprise |
M365 E5 for Privileged Roles |
|
Regulated / Government |
G5 |
|
Education |
A3/A5 Depending on Risk |
Conclusion
Microsoft Entra ID licensing is not just a cost decision.
It directly impacts:
Security capability
Privileged access control
Identity protection
Compliance posture
Improper licensing results in:
Security Gaps
Audit Failures
Deployment Limitations
If you want to learn more about Microsoft cloud licensing structures and service capabilities, see the book “Comprehensive Microsoft Cloud Licenses Reference Guide.” It provides detailed explanations of Microsoft 365, Office 365, Microsoft Entra ID, Defender, Purview, EMS, Business, Education, and Government licensing models. The guide also includes feature comparisons, service limits, and architecture overviews for enterprise environments.
Available at ITCloudAcademy.net
0 comments