Microsoft Entra ID Pricing (2026): P1, P2 and Bundles

Short answer: Microsoft Entra ID P1 costs $7 per user per month and P2 costs $10 per user per month, both paid yearly on an annual commitment (Microsoft Entra pricing page, checked September 22, 2026). A Free edition comes with Microsoft cloud subscriptions. Most teams need P1, because Conditional Access requires it, and many already own P1 through Microsoft 365 Business Premium or E3.

Microsoft Entra ID plans and prices

Microsoft sells Microsoft Entra ID in three workforce tiers (Free, P1, P2) plus the Microsoft Entra Suite, and every paid tier is priced per user per month, paid yearly, with an annual commitment. For the full field of single sign-on tools, see the single sign-on category hub.

Microsoft Entra ID plans and prices, checked September 22, 2026:

Sources: Microsoft Entra pricing page for prices; Microsoft Learn licensing page for feature gates. Microsoft notes that the Entra Suite has special pricing for P2 and Microsoft 365 E5 customers but does not publish that price.

What Microsoft Entra ID costs for your team

The formula for standalone Microsoft Entra ID is seats x monthly list price x 12. The table assumes every user is licensed, which is how Microsoft Entra ID P1 and P2 features are licensed for member users.

Microsoft Entra ID standalone annual totals, estimate before tax and discounts, checked September 22, 2026:

A 50-person company choosing between standalone P1 and Microsoft 365 Business Premium should compare $4,200 a year for P1 alone against $13,200 a year for Business Premium at $22 per user per month, which includes P1 alongside the rest of the Microsoft 365 business suite. If the team also needs the Microsoft 365 apps, the bundle can make sense; if it only needs SSO and Conditional Access in front of other SaaS apps, standalone P1 costs far less.

What each Microsoft Entra ID plan includes

Microsoft Entra ID Free

The Free edition is included with a subscription to a Microsoft commercial online service such as Azure, Dynamics 365, Intune or Power Platform (Microsoft Entra pricing page footnote). It covers the core directory and security defaults, which enforce MFA for all users. The Microsoft Learn licensing page notes the limit that matters: with security defaults, the Microsoft Authenticator app is the only prompt option, and there is no Conditional Access, so you cannot scope MFA by app, location or device.

Microsoft Entra ID P1

Microsoft Entra ID P1 adds the controls most admins mean when they say "Entra": Conditional Access, phone call and SMS as MFA methods, trusted IPs, MFA for on-premises applications, and Microsoft Entra application proxy for publishing on-premises web apps (Microsoft Learn). P1 is the tier that turns Entra ID from a directory into a policy engine.

Microsoft Entra ID P2

Microsoft Entra ID P2 adds Microsoft Entra ID Protection, which feeds user and sign-in risk into Conditional Access, and Privileged Identity Management for just-in-time admin role activation (Microsoft Learn). Choose P2 when you need risk-based policies or time-bound admin roles; otherwise P1 covers SSO and Conditional Access.

Microsoft Entra Suite

The Microsoft Entra Suite bundles five products: Private Access, Internet Access, ID Governance, ID Protection and premium Verified ID capabilities. It requires a P1 subscription or a package that includes P1, and it is also included in Microsoft 365 E7 (Microsoft Learn). At $12 on top of P1, the suite is aimed at teams replacing a VPN or secure web gateway as well as buying governance.

Microsoft Entra ID P1 vs P2: which plan do you need?

The Microsoft Entra ID P1 vs P2 decision comes down to two capabilities that only P2 carries: Microsoft Entra ID Protection, which feeds user and sign-in risk into Conditional Access, and Privileged Identity Management for time-bound admin role activation. Conditional Access itself is already in P1, which is why most teams need P1 rather than P2.

Microsoft Entra ID P1 vs P2, checked September 22, 2026:

Sources: Microsoft Entra pricing page for prices and Microsoft Learn licensing page for feature gates and plan inclusions.

Do you already own Microsoft Entra ID P1 or P2?

Many Microsoft 365 tenants already hold Microsoft Entra ID P1 or P2 licenses, so the first budget step is an inventory, not a purchase. Microsoft Learn lists these inclusions (licensing page, updated June 18, 2026):

Admin tip: License assignment for Microsoft Entra ID is managed in the Microsoft 365 admin center, so check Billing > Licenses there to see which P1 or P2 seats the tenant already holds (Microsoft Learn).

Costs beyond the Microsoft Entra ID license

Microsoft Entra ID pricing grows through add-ons that are sold separately from P1 and P2. Prices below are from the Microsoft Entra pricing page, checked September 22, 2026, all per month, paid yearly:

• Microsoft Entra ID Governance: $7 per user per month, available to P1 and P2 customers. Access reviews, entitlement management and Lifecycle Workflows need it for member users, with only some capabilities working under P2.
• Microsoft Entra Internet Access: $5 per user per month, a secure web gateway that extends Conditional Access to internet traffic.
• Microsoft Entra Private Access: $5 per user per month, Microsoft's zero trust network access (ZTNA) product for private apps.
• Microsoft Entra Workload ID: $3 per workload identity per month, for Conditional Access and risk detection on apps and service principals.
• Guests and external users: billed through Microsoft Entra External ID on monthly active users, free for the first 50,000 MAU of core features. SMS authentication, machine-to-machine authentication, ID Governance for guests and Global Secure Access for guests are premium add-ons charged on top of MAU billing (External ID pricing, Microsoft Learn). The per-MAU rate beyond 50,000 is published on Azure's pricing pages, not on the Entra pricing page.
• Microsoft Entra Domain Services: sold separately; the Entra pricing page links to Azure pricing rather than listing a figure.

Watch out: External ID MAU billing only works when the tenant is linked to an Azure subscription, so B2B guest features that need premium licensing require someone to own an Azure billing relationship, not just a Microsoft 365 subscription (Microsoft Learn).

Free plan and trial

Microsoft Entra ID Free comes with any Microsoft commercial online subscription and has no end date. For P1, P2, the Entra Suite, ID Governance, Internet Access and Private Access, the Microsoft Entra pricing page offers a "Try for free" option; the trial length and whether a payment method is required are not stated on that page, so confirm both in the Microsoft 365 admin center before starting. Free-tier tenants still get security defaults MFA, which is enough for a small tenant that only uses Microsoft 365 apps.

Discounts and contract terms

Microsoft lists every paid Microsoft Entra ID plan as paid yearly with an annual commitment, and it does not publish a month-to-month price on the Entra pricing page. Microsoft does not publish Entra-specific nonprofit or education percentages on that page; for Microsoft 365 suites, Microsoft states that nonprofit pricing is tied to commercial pricing through a fixed percentage discount (Microsoft 365 blog, December 4, 2025).

Microsoft Learn documents one contract detail worth knowing before a downgrade: when licenses required for Conditional Access expire, policies are not disabled or deleted. They can be viewed and deleted, but no longer updated (Microsoft Learn).

Renewal pricing

Microsoft does not publish a separate renewal rate for Microsoft Entra ID P1 or P2; the list price on the pricing page is the published rate. The standalone Entra prices did not change in the July 1, 2026 Microsoft 365 update, but the suites that include Entra did. According to SAMexpert, existing customers stay on current pricing until their next renewal after July 1, 2026 (SAMexpert).

SAMexpert also reports that Microsoft removed Enterprise Agreement volume discounts at Levels B, C and D in November 2025, so large customers on EA pricing may see a bigger effective increase than the list-price change (SAMexpert).

Microsoft Entra ID price history

No dated Microsoft announcement of a change to the standalone Microsoft Entra ID P1 or P2 price was found during research, so no standalone change is listed.

How Microsoft Entra ID pricing compares

At 50 users on each vendor's entry plan that includes SSO and MFA, billed annually, standalone Microsoft Entra ID P1 sits between Okta and JumpCloud. Plan contents differ, so treat this as a list-price comparison, not a feature match.

Sources, checked September 22, 2026: Okta pricing (all suites billed annually, $1,500 annual contract minimum for Okta Workforce Identity) and JumpCloud pricing ($13 billed monthly). Okta's $1,500 minimum means a 10-user team pays $1,500 a year, against $840 for 10 Microsoft Entra ID P1 seats.

Is Microsoft Entra ID worth the price?

Microsoft Entra ID P1 is worth buying for a Microsoft 365 tenant that needs Conditional Access and does not already hold Business Premium or E3, because at $7 per user per month it is the cheapest route to policy-based MFA for Microsoft apps and for SAML and OIDC SaaS apps in the same directory.

Microsoft Entra ID P2 is worth the extra $3 per user when you need risk-based Conditional Access or Privileged Identity Management for admin roles.

Entra ID is a weaker value for organizations that run Google Workspace as their primary directory, or that want one identity layer across many non-Microsoft tools without an Azure billing relationship; there, Okta or JumpCloud may fit better on price and scope. Use the SSO shortlist builder to score options against your own requirements.

Bottom line

Budget Microsoft Entra ID by inventory first: a tenant on Business Premium, E3 or E5 already has P1 or P2 and pays nothing more for SSO and Conditional Access. If you need to buy seats, start with P1 at $7 per user per month and add P2 only for risk-based policies or PIM. If most of your apps sit outside Microsoft, compare the Okta and JumpCloud totals above and then work through the single sign-on category hub before committing to an annual term.