Microsoft Entra ID is Microsoft's cloud identity and access service: it handles sign-in, policies and protection for your users, devices and apps. If you pay for Microsoft 365, you already use it, because every Microsoft 365 tenant is automatically an Entra tenant with Entra ID Free included.
Here's the catch. The question most small firms face isn't whether to buy Entra ID, it's whether they need P1 on top of Free. And P1 is already included in Microsoft 365 Business Premium, so check your plan before you buy it separately.
You already have it
If you subscribe to Microsoft 365, Azure or Dynamics CRM Online, you're already using Entra ID. Every directory starts with an initial domain such as contoso.onmicrosoft.com, and you can add your own custom domains to it.
Entra ID is the foundational product of a wider Microsoft Entra family, but for most small businesses it's the only one that matters. User and group licence assignments for Entra are managed in the Microsoft 365 admin center, so it's not a separate system to learn from scratch.
Free, P1 and P2 side by side
| Tier | How you get it | What it gives you, as of October 2026 |
|---|---|---|
| Free | Included with Microsoft cloud subscriptions such as Microsoft 365 and Azure | Security defaults with multifactor authentication, prompted through Microsoft Authenticator only |
| P1 | Standalone, and included in Microsoft 365 Business Premium | Conditional Access, and Entra application proxy |
| P2 | Standalone, or in the Defender Suite for Business Premium and the Defender and Purview Suites for Business Premium | Everything in P1, plus risk-based Conditional Access |
The mobile app as a second factor is listed for every tier. What changes as you go up is how much control you get over who signs in, from where, and when.
The Free tier and the Authenticator limit
Entra ID Free includes security defaults, which switch on multifactor authentication for your tenant. The limit is in how people get the prompt: only Microsoft Authenticator can be used, not text messages or voice calls.
That's fine if everyone's happy to install the app. It's a problem if you can't be sure Authenticator is on your staff's personal phones, which is common in small teams where nobody has a work phone. Sort that out before you switch security defaults on.
What P1 adds: Conditional Access
Conditional Access sits in the licensing table for P1 and P2. It's the feature that lets you set rules for sign-in rather than one setting for everybody. P1 also brings Entra application proxy, which needs a P1 or P2 licence.
This is why Business Premium matters here. If you're on Business Premium, you already have P1, so Conditional Access is already paid for. If you're on a lower plan and want it, here's what each Microsoft 365 plan costs so you can compare.
What P2 adds: risk-based access
Risk-based Conditional Access appears only in the P2 column. It works with Entra ID Protection, which detects identity risks. Microsoft's example scenario is a policy that requires multifactor authentication when sign-in risk is medium or high.
In plain words, P1 lets you set rules, and P2 lets those rules react to how risky a sign-in looks. For most small businesses P1 is the useful step up, and P2 is for when you need that extra layer.
The rest of the Entra family
Beyond Entra ID, the family includes Private Access to reach internal apps without a VPN, Internet Access, ID Governance, Verified ID, External ID for guests, partners and customers, and Domain Services for older Kerberos, NTLM, group policy and LDAP needs. Entra Suite bundles Private Access, Internet Access, ID Governance, ID Protection and Verified ID, and it needs Entra ID P1 or a package that includes P1.
If you build on Azure, one more detail: managed identities for Azure resources have no licensing requirement and no extra cost.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Checking where you stand
- Sign in to the Microsoft 365 admin center and open Microsoft Entra from Admin centers.
- Check which plan your tenant holds. Business Premium includes P1.
- On Free, make sure everyone can install Microsoft Authenticator, then turn on security defaults.
- On P1 or above, set up Conditional Access rules instead.
- Only add P2 or Entra Suite if you need risk-based access or governance.
My verdict on Entra ID
I'd switch on security defaults today if you're on Free, as long as your team can use Authenticator, because it's already included and it switches on multifactor authentication for everyone. I'd move to Business Premium rather than buying P1 on its own if you're weighing it up anyway, since P1 comes inside it. And I'd skip P2 until you've outgrown simple Conditional Access rules. If you're still unsure what you get without paying, start with whether Microsoft 365 is free.
Sign-in security keeps your team safe. Getting that team working well with AI is where I come in. I run AI training and workshops for teams, and help businesses with AI enablement, AI automation and GEO, which is about getting your business seen and cited in AI answers. Most of that work is with SaaS marketing teams, telecom companies and small businesses. Here's how we can work together.
Frequently asked questions
Is Microsoft Entra ID included with Microsoft 365?
Yes. Every Microsoft 365 tenant is automatically an Entra tenant, and Entra ID Free is included with the subscription.
Does Microsoft 365 Business Premium include Entra ID P1?
Yes. As of October 2026, Entra ID P1 is included in Microsoft 365 Business Premium.
What is the difference between Entra ID P1 and P2?
Conditional Access is in both P1 and P2. Risk-based Conditional Access, which reacts to how risky a sign-in looks, is only in P2.
Can Entra ID Free use text messages for MFA?
No. Security defaults in Entra ID Free only allow Microsoft Authenticator for the prompt, not text messages or voice calls.
Where do I manage Entra licences?
User and group licence assignments for Entra are managed in the Microsoft 365 admin center.
What does Microsoft Entra Suite include?
Entra Suite bundles Private Access, Internet Access, ID Governance, ID Protection and Verified ID. It needs Entra ID P1 or a package that includes P1.
Do I need Entra ID P1 for application proxy?
Yes. Entra application proxy needs an Entra ID P1 or P2 licence.
Do managed identities for Azure resources need a licence?
No. Managed identities for Azure resources have no licensing requirement and no extra cost.
