Many organizations rely on Microsoft to meet their Identity and Access Management (IAM) needs, with Microsoft Entra ID being a popular tool to manage user identities, streamline access, and enhance security across digital environments. Since we first published this guide, Microsoft has reshaped the Entra licensing landscape with a new Microsoft 365 E7 bundle, a dedicated identity governance tier, and, for the first time, a licensing path for AI agent identities. This update walks through Entra ID’s license models (P1, P2, and the Entra Suite) and how they now relate to Microsoft 365 E7, so you can maximize the value of your Microsoft investment.
Do You Need to Pay for Microsoft Entra ID?
The good news is you don’t necessarily need a license to start using Microsoft Entra ID. When you create a Microsoft tenant, you can access basic Entra ID Free features at no cost. However, for organizations seeking enhanced functionality, Microsoft offers P1 and P2 licenses that unlock more advanced features. Additionally, the Microsoft Entra Suite provides a unified solution with advanced security, governance, and identity features, and can now also be obtained as part of Microsoft 365 E7. Let’s dive into each license model to see what they offer.
Microsoft Entra ID Free
Entra ID Free is a great starting point, providing essential identity management functionalities. However, for organizations with more complex IAM requirements or a need for greater customization, it may not be well-suited for large-scale deployments.
Entra ID Free features:
- Cloud Authentication: Supports Pass-through Authentication or Password Hash Synchronization for users to log in with their existing credentials.
- Users & Groups: Basic user management for static groups and rule assignments.
- Multi-Factor Authentication (MFA): MFA and policies can only be enabled or disabled at the tenant level without more granular control.
- Self-Service Password Reset (SSPR): Available only for cloud users.
- Single Sign-On (SSO): Unlimited SSO, but limited capabilities to publish or integrate certain applications.
- Federated Authentication: Supports federation with Active Directory Federation Services (AD FS) or third-party identity providers.
Microsoft Entra ID P1
P1 builds on the free tier with additional automation and management features, making it a solid choice for organizations needing more control. P1 is included with Microsoft 365 F1/F3, Microsoft 365 E3, E5, and E7, Office 365 E3, EMS E3, and Microsoft 365 Business Premium. If you have one of these licenses, you already have access to the features outlined below. As a standalone product, P1 costs roughly $6 per user, per month.
Key P1 features:
- Users & Groups: P1 introduces dynamic groups and assignments for applications and conditional access, automating user management without manual intervention.
- Multi-Factor Authentication (MFA): P1 allows for group-based MFA, offering more flexibility by assigning different MFA options for specific users or departments.
- Self-Service Password Reset (SSPR): Extends SSPR to on-premises users, allowing password reset policies for specific groups or users across both cloud and on-premises environments.
- Single Sign-On (SSO): Adds support for publishing on-premises applications, providing seamless access through a unified SSO experience.
- Health Monitoring: Tracks performance metrics for Active Directory Federation Services (AD FS) and Active Directory Domain Services (AD DS). Provides real-time alerts for system health and synchronization issues.
- Cross-Tenant Sync: Synchronizes cloud tenants, ensuring consistent security rules and policies across multiple environments.
- Session Lifetime Management: Controls how long users stay logged in by setting token expiration limits, improving security for high-risk applications.
- Conditional Access Engine: Unlocks all conditional access options, allowing for more granular security policies based on user identity, device health, and location.
Microsoft Entra ID P2
Entra ID P2 adds advanced security and identity management capabilities, ideal for organizations requiring real-time risk monitoring and in-depth protection. The P2 license is included in other subscriptions like Microsoft 365 E5 and E7, Office 365 E5, Enterprise Mobility + Security (EMS) E5, Microsoft 365 E5 Security, and Microsoft 365 A5. Standalone, P2 costs roughly $9 per user, per month.
Key P2 features:
- Sign-In Risk: Monitor real-time sign-in activity to detect anomalies and take action based on risk levels.
- User Risk: Continuously scan login signals and automatically alert administrators of any compromised credentials.
- Device and Application Filters: Use extended conditional access options. Apply detailed filters for devices, applications, and users.
- Token Protection: Ensure tokens are only used on the specific devices they were issued for.
- Privileged Identity Management (PIM): Discover, restrict, and monitor administrator access, with just-in-time role activation.
- Entitlement management and My Access: Baseline access-request workflows and self-service access through the My Access Portal.
One change worth flagging: since our original post, Microsoft has split the more advanced governance capabilities (things like auto-assignment policies, custom approval workflows, and Verified ID or ID Protection integration for access packages) out of P2 and into a dedicated Microsoft Entra ID Governance license (roughly $7 per user, per month, on top of P1 or P2). P2 still covers the core PIM and entitlement management scenarios described above, but if your organization needs the full governance feature set, budget for Entra ID Governance, the Entra Suite, or Microsoft 365 E7 rather than assuming P2 alone covers it.
Microsoft Entra Suite
The Microsoft Entra Suite offers a comprehensive solution for managing secure access, identity verification, and Zero Trust security across both cloud and on-premises environments. It integrates five key capabilities into one cohesive platform, letting organizations streamline identity management, safeguard network traffic, and verify user identities seamlessly.
To access the Entra Suite, a subscription to Microsoft Entra ID P1, or a package that includes P1, is required. As a standalone plan, the Entra Suite costs roughly $12 per user, per month on an annual commitment – noticeably less than licensing the same five products individually. Special pricing is available for Microsoft Entra ID P2 and Microsoft 365 E5 customers, and since May 2026 the complete Entra Suite is also included in Microsoft 365 E7.
Key Entra Suite features:
- Microsoft Entra Private Access: Provides Zero Trust Network Access (ZTNA) for on-premises apps without code changes, replacing legacy VPNs with Conditional-Access-driven, least-privilege access.
- Microsoft Entra Internet Access: Guards against unsafe content with cloud-delivered security controls and web content filtering, routed through Microsoft’s global network.
- Microsoft Entra ID Protection: Uses machine learning to detect sign-in and user risk and applies Conditional Access to block or allow access accordingly.
- Microsoft Entra ID Governance: Automates identity lifecycle management (joiner, mover, leaver workflows, access certifications, and delegation to business owners).
- Microsoft Entra Verified ID (premium capabilities): Decentralized credential verification, including Face Check, for high-assurance onboarding scenarios.
New in 2026: Microsoft 365 E7 Bundles the Entire Entra Suite
Generally available since May 1, 2026, Microsoft 365 E7 ($99 per user, per month) is the first Microsoft 365 plan to include the complete Entra Suite alongside Microsoft 365 E5 (which itself includes Entra ID P2), Microsoft 365 Copilot, and Microsoft Agent 365. For organizations that already plan to license Copilot and P2 together, E7 is worth comparing against buying the Entra Suite as a standalone add-on: it folds governance, network access, and now agent identity management into a single enterprise SKU.
New in 2026: Microsoft Entra Agent ID and Agent 365 – Identity for AI Agents
As organizations put AI agents to work, inside Copilot, custom automations, or third-party tools, those agents need identities, access policies, and oversight just like human users. Microsoft’s answer is Microsoft Entra Agent ID, which extends Conditional Access, Identity Governance, Identity Protection, and network controls to AI agent identities. It’s delivered through Microsoft Agent 365 (roughly $15 per user, per month standalone, or included in Microsoft 365 E7), and licensed separately from human-user identities: Conditional Access for agents requires Entra ID P1, ID Protection for agents requires P2, and ID Governance for agents requires P1, each paired with an Agent 365 license.
This is a meaningful shift for anyone managing non-human identities, service accounts, or agentic workflows. Learn more about our services in these areas: Non-Human Identities and AI Security.
What Do Microsoft Entra ID Licenses Cost in 2026?
Microsoft raised commercial Microsoft 365 and Entra pricing globally on July 1, 2026, with Entra ID P1 increasing by roughly 16%. Existing customers renewing before that date could lock in prior pricing until their next renewal. Approximate standalone list prices as of mid-2026:
| License | Approx. price | Notes |
|---|---|---|
| Entra ID Free | $0 | Included with any Microsoft cloud subscription |
| Entra ID P1 | $6 / user / month | +~16% from July 1, 2026 price increase |
| Entra ID P2 | $9 / user / month | Includes P1 features |
| Entra ID Governance | ~$7 / user / month | Add-on on top of P1 or P2 |
| Entra Suite | $12 / user / month | Annual commitment; requires P1; discounted for P2/E5 customers |
| Agent 365 | $15 / user / month | Standalone; licensed per user, not per agent |
| Microsoft 365 E7 | $99 / user / month | Bundles M365 E5, Copilot, Agent 365, and the full Entra Suite |
Always confirm current pricing with Microsoft or your licensing partner, as regional pricing and promotions vary.
How to Make the Most of Your Microsoft Entra ID Licenses
Now that you’re familiar with the different Microsoft Entra ID license models, here’s how you can maximize your existing setup and make informed decisions about upgrades:
- Evaluate your current license usage: You might already have access to P1 or P2 features through licenses such as Microsoft 365 F1, E3, E5, or E7, Office 365 E3, or EMS E3. Make sure you’re using all available features before considering an upgrade.
- Evaluate Microsoft Entra ID capabilities: Explore the range of functionalities Microsoft Entra ID offers, from basic identity access management to advanced governance and security features.
- Check whether you need the Governance license separately: If your P2 tenant needs the full governance feature set, including auto-assignment policies, advanced approval workflows, SAP or Verified ID integrations, budget for Microsoft Entra ID Governance, the Entra Suite, or Microsoft 365 E7 rather than assuming P2 already covers it.
- Plan for AI agent identities: If you’re rolling out Copilot agents or other automations, evaluate Microsoft Agent 365 and Entra Agent ID alongside your human-identity licensing, rather than as an afterthought.
- Leverage flexible licensing and cost savings: While it’s possible to license individual Entra products, it’s more efficient to use them together for comprehensive scenarios like Zero Trust, B2E, B2B, and B2C. Bundled packages such as the Entra Suite or Microsoft 365 E7 are typically more cost-effective than licensing products separately.
- Embrace Zero Trust with Conditional Access: Microsoft Entra’s cloud-first approach offers robust identity protection tools, with Conditional Access deeply rooted in Zero Trust principles.
- Consider transitioning to a hybrid identity environment: For organizations with both on-premises and cloud infrastructures, adopting a hybrid identity model ensures seamless management and better alignment with cloud migration strategies.
Frequently Asked Questions
Does Microsoft Entra ID P2 include full identity governance?
Not the full feature set. P2 includes core Privileged Identity Management and baseline entitlement management, but advanced governance capabilities, such as auto-assignment policies and custom approval workflows, now require the separate Microsoft Entra ID Governance license, the Entra Suite, or Microsoft 365 E7.
How much does Microsoft Entra Suite cost in 2026?
The Entra Suite lists at roughly $12 per user, per month on an annual commitment as a standalone add-on to Entra ID P1. It's also included, at no extra license, in Microsoft 365 E7.
What is Microsoft Entra Agent ID?
Microsoft Entra Agent ID is Microsoft's identity and governance framework for AI agents. Delivered through Microsoft Agent 365, it extends Conditional Access, Identity Protection, and Identity Governance (previously built for human users) to autonomous and Copilot agents.
What is included in Microsoft 365 E7?
Microsoft 365 E7 ($99 per user, per month) bundles Microsoft 365 E5 (including Entra ID P2), Microsoft 365 Copilot, Microsoft Agent 365, and the complete Microsoft Entra Suite in a single enterprise subscription.
Conclusion
Navigating Microsoft Entra ID’s various products and license packages can feel complex — and in 2026, with new bundles and an entirely new identity category for AI agents, more so than ever. At iC Consult, our experts can guide you through every step of your Microsoft Entra journey. We can help you determine which Microsoft Entra licenses and features best fit your business, from license evaluation to full integration and support.
Contact us to learn how we can make Microsoft Entra ID work seamlessly for you, or learn more about our Microsoft services here.
