Microsoft Entra ID pricing in 2026. Check what your suite already includes.

Entra ID P1 lists at $7 and P2 at $10 per user per month, yet E3 and Business Premium include P1 and E5 includes P2. Most overspend comes from buying standalone what the suite grants while owned controls stay switched off.

How much does Microsoft Entra ID cost in 2026?

Microsoft Entra ID has four tiers. Free costs nothing, P1 lists at $7 per user per month and P2 at $10, both on an annual commitment, and ID Governance is a $7 add on that requires P1 or P2. Above them, the Entra Suite bundles Governance with network access and verification for $12.

The P1 and P2 prices rose on July 1, 2026, from $6 and $9. The same Microsoft price change moved Microsoft 365 E3 from $36 to $39 and E5 from $57 to $60, while Business Premium stayed at $22. A standalone seat you did not need was waste before July, and it now costs $12 a year more.

Is Entra ID the same product as Azure AD?

Yes. Microsoft renamed Azure Active Directory to Entra ID in 2023 and carried the capabilities and licensing tiers over. Older contracts, tooling reports and internal documents that mention Azure AD P1 and P2 describe exactly the entitlements this comparison runs on, and license exports still show the service plans as AAD_PREMIUM and AAD_PREMIUM_P2.

What does the Free tier leave out?

Free covers the directory, single sign on to any number of SaaS apps, basic reports and multifactor authentication through security defaults. It does not let you write your own conditional access policies, which is usually the first reason a tenant needs P1. If your users sit on Office 365 rather than Microsoft 365, they have Free and nothing above it.

Which Microsoft 365 plans already include Entra ID P1 or P2?

P1 ships inside Microsoft 365 E3 and Business Premium, and P2 ships inside E5. Microsoft's licensing documentation also lists P1 in F1, F3 and Enterprise Mobility + Security (EMS) E3, and P2 in EMS E5 and the Microsoft Defender Suite, the $12 add on for E3 previously sold as Microsoft 365 E5 Security.

• Microsoft 365 E3, F1, F3, Business Premium, EMS E3. P1 is included. A standalone P1 on any of these users duplicates what you already pay for.
• Microsoft 365 E5 and EMS E5. P2 is included, and P2 contains every P1 feature. A standalone P1 or P2 on these users is a duplicate.
• E3 plus the Defender Suite. P2 arrives through the add on, so a standalone P2 on top of it is a duplicate.
• Office 365 E1 or E3, and Exchange Online only users. No P1. This is the narrow place where standalone P1 legitimately belongs.

What changed with Microsoft 365 E7?

Microsoft made Microsoft 365 E7 available on May 1, 2026 at $99 per user per month. It combines E5, Microsoft 365 Copilot, Agent 365 and the full Entra Suite, so it is the first suite that includes ID Governance. For every suite below E7, Governance is still bought separately.

E7 also creates a new way to double pay. When users move from E5 to E7, any standalone Governance or Entra Suite seats they held become duplicates on the day those users change plans, and they should come off the order in the same transaction.

How do you find and cancel double paid Entra licenses?

List every standalone Entra seat against the suite held by the same user. Flag any E3 user on standalone P1 and any E5 user on standalone P1 or P2 as a duplicate, and cancel it at the earliest date your agreement allows. Once you have the license exports, the cross reference takes an afternoon.

1. Export what the tenant owns. Run Get-MgSubscribedSku in Microsoft Graph PowerShell, or read Billing, then Licenses, in the Microsoft 365 admin center. Standalone P1 shows as AAD_PREMIUM, P2 as AAD_PREMIUM_P2, Microsoft 365 E3 as SPE_E3 and E5 as SPE_E5.
2. Export what each user holds. Pull every user's assigned licenses with Get-MgUserLicenseDetail, or with Get-MgUser and the AssignedLicenses property.
3. Join the two lists by user. Mark everyone who holds both a suite and a standalone Entra SKU.
4. Check group based licensing. A user can get the suite directly and a standalone seat through a group, so review the groups that assign Entra SKUs.
5. Compare purchased against assigned. Standalone seats that are not assigned to anyone are waste even before any overlap check.

Why do some tenants double pay more than others?

Seat placement decides most of it, so run this check beside the E3 versus E5 versus F3 decision and the security stack review in our security licensing guide. Our Defender P1 versus P2 analysis applies the same included versus standalone test to the endpoint side of the same suites.

A tenant that standardized its tiers deliberately rarely pays twice. One that grew through acquisitions and ad hoc purchases almost always does, because each acquired business arrives with its own identity SKUs.

When is a standalone P2 on an E3 user worth keeping?

An E3 user with standalone P2 is a partial overlap. P1 already comes with E3, so the full $10 pays for the P2 features alone. That can be the right purchase for a small group, such as administrators whose privileged roles you manage through PIM, or users you cover with risk based policies.

For those users, compare three prices: standalone P2 at $10, the Defender Suite at $12 if you also want the Defender products, or the $21 monthly gap between E3 and E5 at list. Standalone P2 is the cheapest route to P2 alone. For users who need none of those features, cancel the seat.

What does Entra double payment cost at 2026 list prices?

Every duplicate P1 seat wastes $84 a year at list, and every duplicate P2 seat wastes $120. The hypothetical tenant below shows how quickly that adds up once a few years of ad hoc purchases pile on top of the suites.

A worked example on 6,000 users

Say you run 4,000 users on Microsoft 365 E3 and 2,000 on E5. Over several years, different teams also bought 900 standalone P1 seats and 500 standalone P2 seats. The cross reference sorts them as follows.

The $107,400 is at list, so your discounted rate will bring it down. The seats also renew every year they survive, so a duplicate left in place for a three year agreement costs three times the figure in the table.

When is Entra ID Governance worth buying?

Buy Governance after the P2 controls you already own have run for a quarter, and only for the gap they leave. Governance adds advanced entitlement management, lifecycle workflows for joiners, movers and leavers, and certification at a scale that P2's access reviews do not reach.

P2 already includes basic entitlement management. Governance adds features such as auto assignment policies, custom extensions and Entra roles in access packages.

Why we would not buy Governance to prepare for an audit

The common advice is to buy Governance early, so identity governance is in place before an auditor asks. We disagree. Governance is a practice, and the tenants shopping for the license already owned its core tools, access reviews and PIM, switched off inside E5 licenses they had paid for.

A new SKU does not appoint reviewers, set a review cadence or name role owners. We recommend this order instead.

1. Turn on every owned P2 control and run it for a quarter.
2. Write down the specific gaps: entitlement management at scale, automated joiner mover leaver workflows, certification beyond P2's reviews.
3. License Governance against that written gap, and negotiate it inside the Enterprise Agreement, where its price and the Entra Suite's can move.

Paying again for identity maturity you already own is the most common overspend we find, and it compounds at every renewal it survives.

How does Microsoft count Governance licenses?

Microsoft counts every member user in scope of a Governance feature, plus the people who configure it. You do not assign a license to each person, but you must own enough to cover everyone in scope. Microsoft's own example: if 2,000 employees can request an access package, you need 2,000 licenses even if only 150 ever do.

Guests are billed separately, on monthly active users through an Azure subscription. Scope is therefore your main cost control. In the 6,000 user example, Governance for everyone lists at $504,000 a year. Scoped to 1,200 users in finance and contractor access, it lists at $100,800.

Should you buy Governance, the Entra Suite or E7?

Price each component against what your suite already grants. The Entra Suite at $12 contains Governance, which costs $7 alone, plus Private Access and Internet Access at $5 each, along with ID Protection and Verified ID premium features.

Microsoft's price page also offers special Suite pricing to P2 and E5 customers, so E5 tenants should ask for that rate before comparing.

• Governance only. $7 beats the $12 Suite. E5 users already own ID Protection through P2.
• Governance plus one network product. $7 plus $5 equals the Suite price, so the Suite breaks even.
• Governance plus both network products. $17 bought separately against $12 for the Suite. The Suite wins if both will be deployed.
• E7. The $39 gap over E5 at list pays for Copilot, Agent 365, the Entra Suite and extra Defender, Intune and Purview capabilities together. Compare it only if you already plan to buy Copilot.

What have we seen in Microsoft identity reviews in 2024 and 2025?

Across roughly 25 to 35 Microsoft identity licensing engagements we reviewed between 2024 and 2025, paying again for entitlements already in the suite was the most frequent finding. Three patterns repeated often enough to shape how we run the review.

• Double payment. Standalone P1 or P2 seats overlapped suite entitlements on 15 to 25 percent of reviewed users.
• Unused P2. Risk based identity protection, PIM and access reviews sat entirely unused in 40 to 60 percent of the E5 tenants that owned them.
• Governance first. In roughly 20 of 30 tenants, Governance had been bought while the access reviews and PIM inside E5 stayed switched off.

The unused P2 pattern changes the maturity discussion with your security team. Most of the identity maturity gains we saw came from turning on controls already paid for, which adds no license cost at all.

What will the Microsoft account team say, and how should you answer?

Expect the discussion to steer toward more identity SKUs, usually framed around security or audit readiness. These are the lines we hear most often, with replies that keep the conversation on what you already own.

• "Governance gets you audit ready." Reply: our E5 access reviews and PIM can produce review evidence today; show us which control P2 cannot deliver and we will price that gap.
• "The Entra Suite is better value than Governance alone." Reply: at list it only breaks even once we add a network product, so quote the E5 customer rate, and only for users who will use Private Access or Internet Access.
• "The July price change applies to every customer." Reply: our enrollment prices hold until renewal, the renewal price is still open, and we want the Entra rates fixed for the full new term.
• "Move to E7 and the add ons disappear." Reply: send the E7 quote with every standalone Entra seat for those users removed, next to E5 plus the parts we would deploy.

Which contract terms should you ask for?

• Price hold on every Entra SKU. Put P1, P2, Governance and Suite rates on the price sheet at signature, including SKUs you may only add later, so a mid term addition does not come in at the new list. Our price hold clause guide has wording.
• Reduction right at each anniversary. Ask for the right to cut standalone Entra seats when users move onto a suite that includes them.
• Governance ramp. Start at the scoped user count and add seats only as workflows go live.
• Clean E7 transition. Standalone Governance and Suite seats end on the date their users move to E7.
• Guest billing visibility. Monthly reporting on Governance guest activity before it reaches the Azure invoice.

What to do next

1. This month. List every Entra capability your suites already include, per user. Every later step depends on that map.
2. Within 60 days. Cancel standalone seats that duplicate E3, E5 or E7 entitlements, at the earliest date the agreement allows.
3. Next quarter. Switch on the owned P2 controls, access reviews and PIM, and run them for a quarter before any Governance conversation.
4. After that quarter. Scope Governance and the Entra Suite only against the proven gap, and benchmark both independently before committing volume.
5. Before renewal. Settle the identity baseline so you negotiate the Enterprise Agreement on real requirements. The license optimizer runs the suite side of the reconciliation in minutes.
6. If you want help. Our Microsoft practice runs the entitlement review with you and prices the gap before you sign.

Frequently asked questions