Most small businesses need P1, not P2. P1 gives you Conditional Access, which is the control that actually stops the attacks you're worried about. P2 adds risk detection and just-in-time admin roles on top — real value, but a second layer, and only worth buying once the first one is switched on and tuned.
The wrinkle is that a lot of firms already own one of them and don't know it. Check before you buy anything.
What's the actual difference between P1 and P2?
P1 covers the rules you write: Conditional Access, role-based access control, dynamic groups, and advanced reporting. P2 adds the rules the system writes for itself — Microsoft Entra ID Protection scores every sign-in for risk, and you can block or step up authentication based on that score. P2 also unlocks Privileged Identity Management and access reviews.
Put another way: P1 knows who is signing in and from where. P2 knows whether that sign-in looks wrong.
What do P1 and P2 cost?
Microsoft lists Entra ID P1 at $7.00 per user per month and P2 at $10.00 per user per month, both on an annual commitment. Microsoft Entra Suite, which bundles P2 with Internet Access, Private Access and lifecycle workflows, runs $12.00.
So the P1-to-P2 step is $3 a user a month. For a 40-person firm that's $1,440 a year. Not nothing, not a budget fight either. The question is whether you'll use what it buys.
Do you already own one of them?
Probably. Microsoft's own documentation says "Entra ID P1 is also included in Microsoft 365 Business Premium for small to medium businesses," and that P1 also comes with Microsoft 365 E3, F1 and F3. P2 is included with Microsoft 365 E5, and with the Defender Suite add-on for Business Premium.
That matters more than the price list. If you're on Business Premium, you already paid for Conditional Access and you may not have turned it on. Buying P2 before configuring P1 is paying for the second lock while the first one sits in the box. Our Business Premium vs E3 comparison walks through what each plan carries.
What does P1 get you that Free doesn't?
Conditional Access, and that's the whole answer. Microsoft states plainly that "using this feature requires Microsoft Entra ID P1 licenses," and adds that Business Premium customers can use it too.
Conditional Access is where you say: no sign-ins from outside the countries we operate in, no access from an unmanaged device, MFA every time for anyone touching the admin center. Those rules close off most of the credential-theft playbook. If you do one thing with an identity license, do this. We covered the rollout in Microsoft 365 Conditional Access for small business.
When is P2 worth the extra $3 a user?
Three situations make it worth it.
You need risk-based policies. Microsoft's licensing table is blunt about this: sign-in and user risk policies are a "No" on Free and a "No" on P1. Full risky-user and risky-sign-in reports are also P2-only — P1 shows medium and high risk users with "no details drawer or risk history." If you want the tenant to force a password reset the moment a credential shows up in a breach dump, that's P2.
You have standing admin accounts. Privileged Identity Management requires Entra ID P2 or Microsoft Entra ID Governance. If four people hold permanent Global Administrator and one phish ends your company, PIM is the fix. See what PIM does and how to roll it out.
An auditor or carrier is asking. Microsoft's licensing documentation puts the baseline access-review capabilities at P2, with the more advanced ones behind Entra ID Governance. "Prove someone checked who has admin rights" is a standard line on security questionnaires and cyber insurance applications. With reviews running, the answer is an export instead of a scramble.
Can you buy P2 for just a few people?
Yes for PIM, no for risk policies. Entra licensing is per-user, so you can license only the admins who need just-in-time role activation and leave everyone else on P1. That's a common and sensible setup for a small firm.
Risk policies are different. Entra licensing is assigned to people, and risk-based protection only applies to the people holding the license — so covering five users leaves the other thirty-five unscored, and attackers don't check who's licensed before phishing them. If you're buying P2 for risk policies, buy it for everyone.
What P2 doesn't fix
A license isn't a configuration. P2 detects risk; someone still has to decide what happens when risk is detected, and then watch what the policy breaks in week one. Firms buy P2, leave every risk policy in report-only mode, and get the invoice without the protection.
P2 also doesn't cover the gaps outside identity — email filtering, endpoint detection, backups, patching. Identity is the front door, not the building.
How to decide this week
- Open the admin center and check what licenses you actually hold. Business Premium and E3 shops already have P1.
- If Conditional Access isn't configured, stop here. Configure it. That's the biggest security gain available to you, and you've already bought it.
- Count your permanent admin accounts. More than two, and P2 for those users pays for itself the first time someone gets phished.
- Ask whether anyone — an insurer, a client, a regulator — is going to ask you to prove access is reviewed. If yes, P2 for everyone.
- Otherwise stay on P1 and revisit in a year.
By Latoya Reed. The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.
Frequently asked questions
Does Microsoft 365 Business Premium include Entra ID P1?
Yes. Microsoft's licensing documentation states that Entra ID P1 is included in Microsoft 365 Business Premium for small to medium businesses. That means Conditional Access is available to you at no extra cost. P2 is available for Business Premium through the Defender Suite add-on.
Can I mix P1 and P2 licenses in one tenant?
Yes. Entra licensing is assigned per user, so a common setup is P2 for administrators who need Privileged Identity Management and P1 for everyone else. The exception is risk-based Conditional Access, which only protects licensed users — that one works properly only when everyone has P2.
Is Entra ID P2 the same as Microsoft Entra Suite?
No. Entra Suite is a larger bundle listed at $12.00 per user per month that includes P2 plus Microsoft Entra Internet Access, Private Access, lifecycle workflows and entitlement management with separation-of-duties checks. P2 on its own is $10.00. Most small businesses don't need the Suite.
What happens if a P2 license expires?
Privileged Identity Management stops working the way you configured it. Microsoft's documentation states that "eligible role assignments of Microsoft Entra roles are removed" while permanent assignments are unaffected — which quietly puts you back to standing admin rights. Plan renewals before they lapse.
Do I need P2 for multi-factor authentication?
No. MFA is available on the free tier. What P1 adds is control over when MFA is required through Conditional Access, and what P2 adds is triggering it automatically on a risky sign-in. Turn MFA on regardless of what license you hold.
Not sure what your tenant already has, or what's configured versus just licensed? See how we handle Microsoft 365 security, or contact The NetSys Group for a complimentary assessment and we'll tell you what you're paying for and what's actually switched on.
Discuss microsoft 365 management & backup for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.