Entra ID pricing, the identity you already own comes first
Entra ID sells in four tiers, and the higher ones are frequently already inside your Microsoft 365 suite: P1 ships in E3 and Business Premium, P2 ships in E5. The recurring overspend is not a rate problem; it is paying again for identity the suite already grants, while the controls you own sit switched off.
Prepared by Redress Compliance · August 7, 2026 · Microsoft advisory. Based on 25 to 35 identity licensing engagements reviewed 2024 to 2025.
Executive summary
Double payment is the recurring finding. Standalone Entra P1 or P2 seats overlapped with E3 or E5 suite entitlements on 15 to 25 percent of reviewed users: any E5 user holding a standalone P2 license is paying twice for the same capability. The cross reference, standalone seats against suite entitlements, is the single highest yield check in the Microsoft identity estate, and it costs an afternoon.
The capability you own sits unused. P2's risk based identity protection, privileged identity management, and access reviews went unused on 40 to 60 percent of the E5 estates that owned them, which inverts the maturity conversation: most identity maturity gains come from activating owned P2 controls, not from new SKUs, and activation delivers capability already paid for at no added license cost.
Governance gets bought before P2 gets switched on. In roughly 20 of 30 estates, Entra ID Governance was purchased while the access reviews and PIM already inside E5 sat switched off. You cannot govern what you have not activated: the sequence is owned controls on first, the remaining gap proven, and Governance licensed only for the entitlement management and lifecycle workflows P2 genuinely cannot cover.
Standalone has a legitimate lane, and it is narrow. Standalone Entra licenses make sense for users on suites below E3, and for Governance, which no suite includes; for E3 and E5 populations, standalone P1 or P2 is usually redundant. The Entra Suite, bundling identity protection with network access and verification, evaluates the same way: against what the suite already grants, never against the tier list alone.
The four tiers, and where each already comes from
| Tier | Key capability | Often included in | The buyer test |
|---|---|---|---|
| Free | Directory, user management, single sign on | Any Microsoft 365 plan | Already owned |
| P1 | Conditional access, self service password reset, hybrid identity | E3 and Business Premium | Check before buying standalone |
| P2 | Risk based protection, PIM, access reviews | E5 | Confirm it is switched on before anything else is bought |
| Governance | Entitlement management, lifecycle workflows | Standalone only: no suite includes it | Buy when certification needs exceed activated P2 |
Finding the double payment, and cancelling it
The mechanics are a cross reference: every standalone Entra seat listed against the suite entitlements of the user holding it, with any E3 user on standalone P1 and any E5 user on standalone P2 flagged as a duplicate to cancel. The seat placement work upstream decides most of it, which is why this check belongs beside the E3 versus E5 versus F3 decision and the security stack rationalization in the security licensing guide: an estate that standardized tiers deliberately rarely double pays, and an estate that grew by acquisition and ad hoc purchase almost always does. The Defender P1 versus P2 analysis runs the same included versus standalone logic on the endpoint side of the same suites.
The Microsoft EA renewal playbook
The negotiation the identity baseline feeds: the seven levers, the suite entitlement map, and the add on rationalization worked on a representative estate.
Get the white paper →Activation before purchase, the sequence that holds
The common advice, buy Governance early so identity governance is in place before an audit, fails on its own premise: governance is a practice, not a SKU, and the estates shopping for it had the practice's core tools, access reviews and privileged identity management, sitting switched off inside licenses already paid for. The sequence that holds runs the other way. Turn on every owned P2 control and run it for a quarter; document the specific gaps, entitlement management at scale, automated joiner mover leaver workflows, certification beyond P2's reviews; and license Governance against that proven gap, negotiated inside the Enterprise Agreement where its pricing and the Entra Suite's are genuinely movable. Buying maturity you already own is the most common identity overspend, and it compounds at every renewal it survives.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across identity engagements, 2024 to 2025
Across roughly 25 to 35 Microsoft identity licensing engagements Fredrik Filipsson reviewed between 2024 and 2025, double payment for entitlements already in the suite was the recurring finding:
Standalone P1 or P2 seats held by users whose E3 or E5 suite already granted the tier.
Estates buying the standalone product while the owned P2 controls sat switched off.
The levers are inventory and activation, not discounting: map what the suites grant, cancel the duplicates, switch on the owned controls, and benchmark only the genuine increments, Governance and the Entra Suite, independently before committing volume. The identity baseline then feeds the renewal: an estate that arrives with the entitlement map settled negotiates the EA on real requirements, and the license optimizer runs the suite side of the reconciliation in minutes.
Your first five moves
- List every Entra capability your suites already include, per user, because the entitlement map is the whole audit.
- Cancel standalone seats that duplicate E3 and E5 entitlements, the 15 to 25 percent paying twice.
- Switch on the owned P2 controls, access reviews and PIM, and run them a quarter before any Governance conversation.
- Scope Governance only against the proven gap, the entitlement and lifecycle capability P2 cannot cover, benchmarked independently.
- Settle the identity baseline before the renewal, where the entitlement map becomes negotiating position. The Microsoft practice runs the review with you.
Frequently asked questions
What are the Microsoft Entra ID pricing tiers?
Four: Free with basic directory and single sign on, P1 adding conditional access and hybrid identity, P2 adding risk based protection, privileged identity management, and access reviews, and Entra ID Governance adding entitlement management and lifecycle workflows. P1 is included in E3 and Business Premium, and P2 in E5, which is where the buying decisions actually sit.
Is Entra ID P1 or P2 included in Microsoft 365?
Yes: P1 ships inside Microsoft 365 E3 and Business Premium, P2 inside E5, and the Free tier with any Microsoft 365 subscription. Buying standalone P1 or P2 for users on those suites is paying twice, and standalone seats overlapped suite entitlements on 15 to 25 percent of the users we reviewed.
Is Entra ID the same as Azure AD?
Yes. Microsoft renamed Azure Active Directory to Entra ID in 2023, with the capabilities and licensing tiers carried over unchanged. Contracts and tooling that reference Azure AD P1 and P2 describe the same entitlements, so the suite comparison and double payment check run identically under either name.
When should you buy Entra ID Governance?
After activating the P2 controls you own, and only against a proven gap: Governance adds entitlement management, lifecycle workflows, and certification at scale that no suite includes, but in 20 of 30 estates it was bought while the owned access reviews and PIM sat switched off. Activate first, document what P2 cannot cover, then license that.
What is the Entra Suite?
A bundle combining identity protection with secure network access and identity verification in one license. It evaluates the same way every Entra purchase should: against what your Microsoft 365 suite already grants, with the genuine increment benchmarked independently and negotiated inside the Enterprise Agreement rather than accepted at list.
How do you cut Entra ID overspend?
Inventory and activation rather than discounting: map the entitlements each suite grants, cancel standalone seats that duplicate them, switch on the owned P2 capabilities, and buy only the increments P2 cannot cover. The overspend is almost always double payment or unused capability, and both corrections are within your own control.
