Three questions are worth asking about your Microsoft Entra licenses. Do you know what they include? Are you using them? And are you paying for the right license for each person, or the same license for everyone? Most companies can answer the first one at best, and the third one is where money quietly disappears.
What does your license include?
Free comes with every Microsoft cloud subscription, Microsoft 365 E3 adds Entra ID P1, E5 adds P2, and E7 adds the Microsoft Entra Suite and Microsoft Agent 365 on top of E5. Entra ID Governance and the Entra Suite can also be bought as add-ons.
- Free is included with Microsoft cloud subscriptions such as Microsoft Azure, Microsoft 365, Dynamics 365, Intune and Power Platform.
- E3 is Microsoft 365 E3, which includes Entra ID P1. P1 is also sold standalone and is included in Microsoft 365 Business Premium and in the frontline plans F1 and F3.
- E5 is Microsoft 365 E5, which includes Entra ID P2. P2 is also sold standalone.
- E7 is Microsoft 365 E7: everything in E5, plus Microsoft 365 Copilot, the Microsoft Entra Suite and Microsoft Agent 365.
- Governance is the Microsoft Entra ID Governance add-on for P1 and P2. It contains entitlement management, PIM and access reviews, so P1 customers get them too. A separate Step-Up version exists for P2 customers.
- Suite is the Microsoft Entra Suite: Governance, ID Protection, Verified ID, Private Access and Internet Access. It can be bought separately, but requires P1 or a plan that includes P1.
The table lists the features by license type, from the lowest license that includes them. It is the same table I use in the Entra ID security review. A tick means the feature is included, a dash means it is not. It is a simplified overview, not a complete licensing matrix: some features also require licenses for specific users, such as the administrators or reviewers involved, and Microsoft changes its packaging and prices regularly. Always check Microsoft’s current licensing terms and prices before you buy.
| Feature | What it does | Free | E3 | E5 | E7 | Governance | Suite |
|---|---|---|---|---|---|---|---|
| Users and groups | Create and manage user accounts and security or Microsoft 365 groups with assigned membership. | ✔ | ✔ | ✔ | ✔ | – | – |
| Device registration and Entra join | Register personal devices and join Windows devices directly to Entra ID with single sign-on. Admins can recover BitLocker keys. | ✔ | ✔ | ✔ | ✔ | – | – |
| Basic administrative units | Split the directory into units and delegate admin rights inside one unit only. Creating units is free; each admin scoped to a unit needs P1. | ✔ | ✔ | ✔ | ✔ | – | – |
| Entra Connect Sync and Cloud Sync | Synchronize on-premises Active Directory users, groups and password hashes to Entra ID. | ✔ | ✔ | ✔ | ✔ | – | – |
| Workload identities (incl. managed identities) | Identities for software: app registrations, service principals, federation with external identity providers, and managed identities for Azure resources. | ✔ | ✔ | ✔ | ✔ | – | – |
| Agent ID | Identities and blueprints for AI agents, managed like other identities in the tenant. | ✔ | ✔ | ✔ | ✔ | – | – |
| Baseline MFA (security defaults, MFA for admins, Authenticator app) | Preconfigured baseline: requires MFA registration, blocks legacy authentication, second factor through the Authenticator app. No custom policies. | ✔ | ✔ | ✔ | ✔ | – | – |
| Passkeys (FIDO2) | Phishing-resistant passwordless sign-in with hardware security keys or passkeys. | ✔ | ✔ | ✔ | ✔ | – | – |
| Enterprise applications (SSO and user provisioning) | One sign-in for Microsoft 365, Azure and many SaaS apps, plus automatic user provisioning and removal in connected SaaS apps. | ✔ | ✔ | ✔ | ✔ | – | – |
| Audit and sign-in logs | Records of administrative changes and of user and app sign-ins (kept 7 days on Free). | ✔ | ✔ | ✔ | ✔ | – | – |
| Basic reports | Basic security and usage reports, limited Identity Protection risk reports, recommendations and the Identity Secure Score. | ✔ | ✔ | ✔ | ✔ | – | – |
| B2B guest collaboration | Invite external users as guests and control which external organizations your users and guests can collaborate with (cross-tenant access settings). | ✔ | ✔ | ✔ | ✔ | – | – |
| Verified ID (core) | Issue and verify digital credentials without storing personal data centrally. | ✔ | ✔ | ✔ | ✔ | – | – |
| Entra ID custom roles | Create your own admin roles with a chosen set of permissions. | – | ✔ | ✔ | ✔ | – | – |
| Dynamic administrative units and protected actions | Administrative units with attribute-based membership, and Conditional Access step-up before sensitive admin actions. | – | ✔ | ✔ | ✔ | – | – |
| Entra Connect Health (hybrid identity monitoring) | Monitor the health, performance and sync errors of Entra Connect, AD FS and domain controllers, with alerts. | – | ✔ | ✔ | ✔ | – | – |
| Device / group write-back | Write cloud device objects and cloud-created groups back to on-premises Active Directory, for device-based Conditional Access and on-premises group use. | – | ✔ | ✔ | ✔ | – | – |
| MDM auto-enrollment | Enroll devices in Intune or another MDM automatically when they join Entra ID, with local admin policy. | – | ✔ | ✔ | ✔ | – | – |
| Password protection (custom banned list, on-premises) | Block organization-specific weak passwords on top of the global list, also in on-premises Active Directory. | – | ✔ | ✔ | ✔ | – | – |
| Self-service password reset | Let users reset or unlock their own password, including write-back to on-premises AD. | – | ✔ | ✔ | ✔ | – | – |
| Conditional Access policies (incl. MFA methods) | E.g. compliant device, trusted location, authentication strengths, fraud alert, MFA for on-premises apps, TAP, certificate-based authentication, WHfB and token protection. | – | ✔ | ✔ | ✔ | – | – |
| Application Proxy | Publish on-premises web apps to remote users without a VPN. | – | ✔ | ✔ | ✔ | – | – |
| Advanced app access | SAML token encryption, group and on-premises provisioning to apps, and user requests for app access in My Apps. | – | ✔ | ✔ | ✔ | – | – |
| Advanced group management | Group access management, dynamic groups with rule-based membership, and self-service groups with owner approval. | – | ✔ | ✔ | ✔ | – | – |
| Advanced logs and monitoring | Longer log retention (30 days), export to SIEM or Log Analytics, Graph activity logs, Entra health with SLA reporting, advanced reports and the governance dashboard. | – | ✔ | ✔ | ✔ | – | – |
| Entra Backup and Recovery and configuration monitoring | Daily backups of tenant configuration, difference reports, recovery of changed or deleted objects and drift detection. | – | ✔ | ✔ | ✔ | – | – |
| Cross-tenant sync and multitenant organization | Automatically provision users between tenants and group several tenants into one organization. | – | ✔ | ✔ | ✔ | – | – |
| Tenant restrictions v2 and guest session controls | Control which external tenants your users can sign in to, and apply sign-in frequency and other session controls to guests. | – | ✔ | ✔ | ✔ | – | – |
| Global Secure Access: Microsoft traffic profile | Route Microsoft 365 traffic through Global Secure Access, with universal Conditional Access (compliant network check) and universal tenant restrictions. | – | ✔ | ✔ | ✔ | – | – |
| Identity Protection (risk policies, risk-based Conditional Access) | Automatic responses to risky users and sign-ins (block, MFA, password change), and risk as a Conditional Access condition. | – | – | ✔ | ✔ | – | ✔ |
| Privileged Identity Management (PIM) | Just-in-time, approval-based and time-limited activation of privileged roles, with auditing. | – | – | ✔ | ✔ | ✔ | ✔ |
| Access reviews | Recurring reviews where owners or users confirm who still needs access to groups, apps and roles. | – | – | ✔ | ✔ | ✔ | ✔ |
| Entitlement management (incl. My Access portal) | Bundle access into access packages with request, approval and expiration, requested through the My Access portal. | – | – | ✔ | ✔ | ✔ | ✔ |
| Account Discovery | Discover and review accounts in connected apps. | – | – | – | ✔ | ✔ | ✔ |
| Advanced cross-tenant sync | Cross-tenant sync for groups, cross-cloud sync between Microsoft clouds, and discovery of related tenants. | – | – | – | ✔ | ✔ | ✔ |
| PIM custom extensions for role activation | Run Logic App workflows when a privileged role is activated. | – | – | – | ✔ | ✔ | ✔ |
| Advanced access reviews | Reviews of inactive users, machine-learning assisted recommendations, and reviews across all access packages in a catalog. | – | – | – | ✔ | ✔ | ✔ |
| Advanced entitlement management | Auto assignment policies, custom extensions (Logic Apps), sponsors as approvers, and Verified ID and ID Protection integration in access requests. | – | – | – | ✔ | ✔ | ✔ |
| Lifecycle Workflows | Automate joiner, mover and leaver tasks. | – | – | – | ✔ | ✔ | ✔ |
| Protection for agents | Conditional Access and risk detection for AI agent sign-ins (Agent 365). | – | – | – | ✔ | – | – |
| Governance for agents | Access packages and lifecycle workflows for AI agents and their sponsors. | – | – | – | ✔ | – | – |
| Verified ID Face Check | Match a person’s live face against the photo in a verified credential. | – | – | – | ✔ | – | ✔ |
| Internet Access (secure web gateway) | Identity-aware secure web gateway: web filtering, TLS inspection and threat intelligence for internet traffic. | – | – | – | ✔ | – | ✔ |
| Private Access (ZTNA, VPN replacement) | Zero Trust access to private apps without a VPN, per app and with Conditional Access. | – | – | – | ✔ | – | ✔ |
Are you using what you pay for?
Often not. The most common gap is not a missing license but one that was bought and never switched on. A company on Business Premium has P1 but still runs on security defaults with no Conditional Access policies. A company on E5 has P2, but its administrators still hold permanent rights because PIM was never set up.
That is security you have already paid for, and usually the cheapest improvement you can make.
Does everyone need the same license?
No. Licenses are assigned per user, and one tenant can mix plans. Giving everyone the license that only some people need is one of the easiest ways to overpay.
Take a company of 100 employees. Frontline staff who work from a shared device and mostly use Teams may be well served by F1 or F3. Office staff may need E3. The 20 people who hold administrator rights or work with the most sensitive data may be the ones who justify P2, through E5 or a standalone P2 license on top of E3. Those numbers are an illustration, not a recipe. The point is that the right mix follows roles and risk, not a single company-wide plan.
Microsoft’s licensing pages spell out who needs the license for each feature. For PIM, it is the users with eligible administrator roles and the people who approve or review access, not every employee. Check that for the features you rely on before you trim.
What should decide the mix?
Not headcount. A few questions do more work:
- Do other tools already cover it? If you run an IGA tool such as Saviynt, SailPoint or Omada, the Governance add-on largely duplicates it. If you already have a ZTNA or secure web gateway service, the network half of the Entra Suite does too.
- How complex is the environment? One tenant and a handful of apps rarely need sophisticated governance. Several tenants, many administrators, external consultants and a long list of SaaS apps shift the balance.
- How sensitive is the data? A small company handling health data, payment data or critical operations can justify P2 for the people who touch it.
- Are you putting AI agents to work? Conditional Access, risk detection and governance for AI agents come with Agent 365. E7 includes it, but Agent 365 can also be bought separately on top of the right base license. If you would not buy Copilot and the Entra Suite on top of E5 anyway, E7 pays for a roadmap you do not have.
How do you see what you have?
Open the Microsoft 365 admin center and go to Billing, then Licenses. The list shows every subscription you own, how many licenses you pay for and how many are assigned. If you have a paid Entra license, the license usage page in the Microsoft Entra admin center shows how many P1, P2 and Suite licenses you have.
That tells you what you own. Whether those features are switched on and configured well is a different question, and it is the one the Entra ID security review answers, finding by finding. If you want the controls put in place, that is Advanced. Book a 30-minute call.