A bundle that costs less than its parts is only a saving if you would have bought the parts
The Entra Suite layers identity protection, governance, secure network access, and verified credentials on top of an Entra ID base, and at roughly 12 dollars per user per month it genuinely undercuts buying those components individually. The buyer question is not whether the bundle is good value. It is who in your estate actually uses the access and governance layers that create the value.
Prepared by Redress Compliance · August 10, 2026 · Microsoft advisory. Based on 25 to 35 Microsoft identity and suite engagements, 2025 to 2026.
Executive summary
The suite costs about 12 dollars per user per month on a P1 base, against roughly 17 to 23 for the same components bought separately.
It bundles identity protection, identity governance, Internet Access and Private Access as the secure network layer, and Verified ID Premium, and it requires at least an Entra ID P1 licence underneath rather than replacing one.
The discount against assembling the parts is real, which is precisely why it gets licensed more broadly than the usage supports.
Only 30 to 60 percent of seats actually used the network access features that drive suite value. Internet Access and Private Access are the components that justify the bundle over an identity base, and in most estates they were needed by a minority of the population.
Identity governance showed the same pattern: bought broadly, configured for a fraction of users. A bundle that undercuts its parts still wastes money when it is bought for people who never touch half of it.
The top tier suite pulls the full Entra Suite to every seat, which is why the bundle maths depends on it.
Where the Entra Suite is included in a larger enterprise bundle, part of that bundle's value rests on Entra usage, and seats that need only identity are paying for access features they will never open.
Price the larger bundle against a base licence plus a targeted suite allocation per cohort before committing, rather than treating the inclusion as free capability.
Right size by cohort: identity base widely, full suite narrowly. Most estates need P1 or P2 broadly and the full suite only for the population that uses secure access or governance, so the allocation decision is where the money is rather than the negotiation.
Audit who actually uses Internet Access, Private Access, and governance, license those cohorts, and remove any third party secure access tooling the suite genuinely replaces to offset the cost.
The options, and where each one fits
| Option | Approximate cost | Best fit | Buyer side note |
|---|---|---|---|
| Entra ID P1 | Base identity | Most users | Often enough on its own |
| Entra ID P2 | Identity plus risk | Higher risk roles | Allocate to a subset |
| Entra Suite | About 12 USD on a P1 base | Needs access plus governance | Right size to real need |
| Inside the top tier bundle | Part of the bundle rate | Needs all bundled products | Do not pay for unused access |
Five capabilities sit inside the suite, and only two of them typically justify it over a plain identity base.
Identity protection provides risk based signals, identity governance covers access reviews, entitlement management, and lifecycle, Internet Access and Private Access form the secure network access layer, and Verified ID Premium handles verifiable credentials.
In the estates we reviewed the network access pair was the real driver of value, while governance was bought broadly and configured for a fraction of users, which means the honest allocation question is narrower than the feature list suggests: who needs secure network access.
And who is genuinely running access reviews and entitlement management rather than intending to.
The base licence detail sits in the Entra ID pricing guide.
Allocating by cohort rather than by default
- Inventory the current base licensing across P1 and P2 before anything else, because the suite prices on top of that base rather than replacing it and the base mix is often wrong too.
- Identify which cohorts genuinely use Internet Access, Private Access, and governance, since those are the components that make the bundle worth more than an identity licence.
- Price the suite for those cohorts only, on top of the base, which is where the overspend hides in estates that licensed it uniformly.
- Model the top tier bundle against a base plus targeted suite allocation, rather than accepting the inclusion as free capability for seats that need identity alone.
- Remove third party secure access tooling the suite genuinely replaces, confirming feature parity first, because that offset is what makes a correctly scoped suite purchase pay for itself.
The Entra Suite allocation brief
Cohort right sizing, the take the bundle or assemble arithmetic, and the buyer side moves across the identity and secure access estate.
Get the white paper →The bundle question, priced honestly
The common advice is that the Entra Suite is a clear saving because it undercuts its own components, so it should be licensed broadly. The first half is true and the conclusion does not follow.
In most identity estates we reviewed.
Only 30 to 60 percent of seats actually used the network access features that drive suite value, while governance was configured for a fraction of users, which means broad licensing bought a genuine discount on capability a majority of the population never opened.
The correct reading of the pricing is narrower and more useful: the suite is excellent value for the cohort that needs secure access and governance, and it is pure overspend for the cohort that needs identity alone.
So the buyer side move is to license the identity base widely and the full suite narrowly.
That same logic decides the larger bundle question.
Where the suite is included inside a top tier enterprise bundle, part of that bundle's value depends on Entra usage, so seats needing only identity are paying inside the bundle for access features they will not use.
And the honest comparison is the bundle rate against a base licence plus a targeted suite allocation per cohort.
Run that comparison before committing rather than after, because the allocation is far harder to unwind once the bundle is the licensing baseline.
One offset genuinely counts: where the suite covers secure access or governance you currently buy from another vendor, removing that tool reduces the net cost, provided feature parity is confirmed before anything is cancelled. The wider price cycle context sits in the 2026 price increase guide.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across Microsoft identity engagements, 2025 to 2026
Across roughly 25 to 35 Microsoft identity and suite engagements we advised on between 2025 and 2026, the Entra Suite was frequently licensed to everyone when only a subset needed it:
Share of seats needing Internet Access and Private Access, the components that actually drive the suite's value over an identity base.
Suite cost per user per month on a P1 base against buying the same components individually, which is a real discount on the right cohort.
Three patterns recurred: Internet Access and Private Access were the real drivers of suite value yet were needed by only 30 to 60 percent of seats, identity governance was bought broadly but configured for a fraction of users.
And top tier bundle adoption pulled the full suite to every seat whether the access features were used or not.
The Entra Suite is a strong package on its merits. The buyer question is allocation: who genuinely needs the secure access and governance layers, and who only needs the identity base underneath them.
Value concentrates in the secure access layer, and the estates that price it right separate those two populations. The wider library sits in the Microsoft practice.
Your first five moves
- Inventory current Entra ID base licensing across P1 and P2, because the suite prices on top of the base and a wrong base mix compounds any suite decision.
- Audit which cohorts actually use Internet Access, Private Access, and identity governance, since only 30 to 60 percent of seats used the access layer in our file.
- Price the suite for those cohorts only, licensing the identity base widely and the full suite narrowly, which is where the entire saving sits.
- Model the top tier bundle against a base plus targeted suite allocation per cohort before committing, rather than treating the included suite as free capability.
- Remove third party secure access tools the suite genuinely replaces, after confirming feature parity, and avoid licensing the full suite to identity only seats. The Microsoft practice runs the allocation with you.
Frequently asked questions
What is in the Microsoft Entra Suite?
Five capabilities layered on an Entra ID P1 or P2 base: identity protection with risk based signals, identity governance covering access reviews, entitlement management and lifecycle, Internet Access and Private Access as the secure network layer, and Verified ID Premium for verifiable credentials.
The suite sits on top of the base licence rather than replacing it.
What base licence does the suite require?
At least Entra ID P1. The suite price is additional to that base, so the total per user cost is the identity licence plus the suite, not the suite alone.
Estates comparing the suite against a standalone alternative frequently omit the base from the comparison, which flatters the bundle by the price of a licence they still have to buy.
How much does the Entra Suite cost?
About 12 dollars per user per month on a P1 base. Bought individually the same components run roughly 17 dollars on a P1 base or about 23 from a standalone P2 position, so the suite genuinely undercuts its own parts.
The discount is real; whether it is a saving depends entirely on who you assign it to.
Should the suite be licensed to everyone?
Usually not. In most estates only 30 to 60 percent of seats used the network access features that drive suite value, and governance was configured for a fraction of users.
License the identity base widely and the full suite narrowly to the cohorts that actually use access and governance, because blanket licensing is exactly where the overspend hides.
Which components actually justify the suite?
Internet Access and Private Access, the secure network access layer. They are typically the strongest reason to take the full suite rather than an identity base alone.
Identity governance is the second consideration, but in our reviews it was bought broadly and configured for a fraction of users, which makes it a weaker justification than it appears on the feature list.
How does the suite affect a top tier bundle decision?
It carries part of that bundle's value, so if your seats need only identity you are paying inside the bundle for access features they will not use.
Price the bundle against a base licence plus a targeted suite allocation per cohort before committing, because the allocation is much harder to unwind once the bundle becomes the licensing baseline.
Can the suite replace third party tools?
It can, and that offset is what makes a correctly scoped purchase pay for itself. Where the suite covers secure access or governance you currently buy from another vendor, removing that tool reduces the net cost.
Confirm feature parity against your actual configuration before cancelling anything, rather than against the marketing comparison.
Microsoft EA: Where the Leverage Really Is, and the Mistakes That Give It Away
Leverage lives in Microsoft's calendar and targets, and in credible movement at the edges of the estate. The three mistakes that hand it back: the copy-paste renewal, everyone-gets-everything licensing, and price-only negotiation under their clock.
