Entra ID P1 or P2: do we need the upgrade?

Key facts

• P1 includes Conditional Access.
• P2 includes everything in P1.
• P2 adds ID Protection, Privileged Identity Management and access reviews.
• Business Premium and Microsoft 365 E3 include P1; Microsoft 365 E5 includes P2.
• Microsoft Entra ID Governance is a separate add-on for advanced lifecycle features.

The short comparison

P1 is the identity layer most businesses need: Conditional Access, dynamic groups, self-service password reset with on-premises writeback and hybrid identity features. P2 adds tools that use risk signals and limit standing privilege.

Check current Microsoft licensing documents before buying, since feature placement changes over time.

What P2 actually adds

ID Protection scores each sign-in and user for risk, such as leaked credentials, unfamiliar sign-in properties or impossible travel. With P2 you can use that risk in Conditional Access, for example requiring a password change when user risk is high or MFA when sign-in risk is medium.

Privileged Identity Management makes admin roles eligible instead of permanent. Admins activate a role for a limited time, with MFA, a reason and optional approval, and every activation is logged.

Access reviews ask owners or managers to confirm who should still have access to groups, apps and roles, and can remove access automatically when it is not confirmed.

When P1 is enough

A well-configured P1 tenant is far safer than a poorly configured P2 tenant. Get the P1 basics right first.

Some P2 value can be approached with P1 and good process. Keep admin accounts separate from daily accounts, limit Global Administrators to a small number, require phishing-resistant MFA for admins and review role assignments on a schedule. That will not give you automated risk response or time-bound role activation, but it closes the most common gaps.

• You have a small admin team and few privileged accounts.
• Your Conditional Access baseline covers MFA, legacy authentication, device compliance and admin protection.
• You use phishing-resistant MFA such as passkeys, which reduces the value of risk-based prompts.
• No auditor or insurer has asked for just-in-time admin access or periodic access reviews.

When P2 is worth it

• You have several Global Administrators or other high-privilege role holders.
• Auditors or regulators expect access reviews or just-in-time privileged access.
• You want automatic response to compromised accounts and risky sign-ins.
• You have many guests or frequent role changes that need regular review.
• You already plan to move to E5 for other security or compliance reasons.

Licensing only the users who need it

P2 does not have to be bought for everyone. Many organizations license P2 for admins and high-risk users and keep P1 for the rest, or buy E5 Security for a subset of users. Microsoft licensing rules expect each user who benefits from a feature to be licensed for it, so match policy scope to licenses.

Review the design once a year. Microsoft sometimes moves features between plans, and your needs change as you grow.

How Accred Consulting approaches it

Accred Consulting reviews your current Entra ID configuration, admin roles, guest access and audit needs before recommending any license change. If P1 is enough, Accred tightens Conditional Access and admin protection. If P2 fits, our US-based specialists set up risk-based policies, move admins to Privileged Identity Management and configure access reviews, piloting each change. The proposal sets a fixed price, scope and timeline, and handover includes documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions