Microsoft Entra ID P1, P2 and Governance

Entra ID P1: policy-based access

Conditional Access is the core P1 decision point. It allows an organisation to evaluate signals such as user, group, application, device state, location, and authentication context, then require controls or block access.

• P1 is appropriate when the organisation wants policies such as requiring multifactor authentication for defined applications,
• requiring compliant devices, blocking unsupported authentication flows, or applying conditions to specific roles and groups.
• Conditional Access is not the same as risk-based Identity Protection. P1 policies can use the conditions available to P1; policies driven by Microsoft Entra user-risk or sign-in-risk detections require the applicable P2 entitlement.
• P1 also appears inside other suites. Microsoft 365 Business Premium and Microsoft 365 E3 include it, so always check existing service plans before buying a standalone licence.

Entra ID P2: risk and privileged identity

Entra ID P2 is included in Microsoft 365 E5 and is available separately or through other eligible bundles. Two common reasons to require it are Identity Protection and Privileged Identity Management. Identity Protection uses Microsoft’s risk detections to identify risky users and sign-ins and supports risk-based remediation policies. This is materially different from a static rule such as “require MFA outside the office”. Privileged Identity Management provides just-in-time and time-bound access for supported Microsoft Entra, Azure, Microsoft 365, and group scenarios. It can require approval, MFA, justification, and access reviews and can alert on privileged role changes. Microsoft’s PIM guidance requires Entra ID P2 or Entra ID Governance licences for the people whose assignments and actions benefit from PIM. The count can include eligible users, approvers, reviewers, and other participants described in the current licensing examples—not just the administrator who configures PIM.

Entra ID Governance: lifecycle and access governance

Microsoft Entra ID Governance is an advanced set of identity-governance capabilities for P1 or P2 customers, with product variants and

• prerequisites. It brings together entitlement management, access reviews, privileged identity management, and additional governance capabilities such as lifecycle workflows.
• Use it when the requirement is not only to protect a sign-in but to govern how access is requested, approved, reviewed, changed,
• and removed over time. Typical scenarios include joiner-mover-leaver automation, access packages for employees or partners, recurring recertification, and governance of privileged identities.
• Do not assume that P2 and ID Governance are permanently identical. Microsoft’s 2026 documentation describes Governance products, step-up

Practical checks

offers, frontline variants, Entra Suite inclusions, and prerequisites that need to be checked against the exact scenario.

Four common decisions

Start with P1, then verify every

• user in policy scope has
• an eligible licence. Design exclusions
• and emergency access before enforcement.
• and emergency access before enforcement.

“We need Conditional Access”

Start with P1, then verify every user in policy scope has an eligible licence. Design exclusions and emergency access before enforcement. “We want policies based on sign-in or user risk” Evaluate P2 because the risk detections and risk-based policy controls are Identity Protection capabilities. Confirm the benefiting user population. “Administrators should activate privileged roles only when needed” Evaluate P2 or ID Governance for PIM. Count eligible assignees, approvers, and reviewers according to Microsoft’s current examples. “Managers should approve and periodically recertify application access” Evaluate Entra ID Governance or the applicable Entra Suite entitlement. Access reviews and entitlement-management scenarios have their own participant and guest licensing rules.

Guest users and workload identities

Guest governance can use a separate monthly-active-user billing model linked

• to an Azure subscription. Workload identities and service principals
• may require Microsoft Entra Workload ID Premium for advanced scenarios,
• even when human users already have P2 or Governance.
• Do not count only employees and assume every non-human or external identity is covered.

Practical checks

Build separate populations for workforce users, guests, privileged accounts, service principals, and agents.

Common mistakes

Using a P1 licence for risk-based Conditional Access. Buying P2 only for the administrator who configures a tenant-wide control.

• Treating permanent admin assignments as equivalent to PIM.
• Assuming P2 includes every newer Governance capability.
• Ignoring approvers and reviewers when counting governance licences.
• Applying Conditional Access without emergency accounts and staged testing.

Practical checks

Forgetting guest, workload-identity, or agent-specific rules.

Build the entitlement map

For each identity control, record the Microsoft feature, target identities, licence prerequisite, participants who benefit, policy

• configuration, exclusion, evidence source, and owner. Reconcile this map with group membership and assigned service plans.
• A small number of well-designed controls is more valuable than a
• premium licence deployed without policy ownership. For help mapping identity risk
• and governance to existing Microsoft 365 suites, contact Axeti . The

Practical checks

wider operating model belongs in an ongoing licensing governance process .

Sources and scope: This article uses Microsoft’s Entra licensing overview , ID Governance licensing fundamentals , and PIM requirements . Microsoft is actively evolving Entra offers; revalidate prerequisites, included capabilities, and participant counts for the current tenant and publication date. Product Terms and the customer agreement prevail.