Azure Architecture Series #31 — Entra ID Editions: Free, P1, P2, and What Each Unlocks

Business Challenge

Phase 1 of this series took the Azure resource model apart over thirty posts, and in all of them the question of price came up exactly once, in passing, on quotas. That is because the Azure control plane is essentially free to govern. Management groups cost nothing. Azure Policy assignments cost nothing. Azure RBAC role definitions and assignments cost nothing, at any scale. The constraints in Phase 1 were structural — a limit of six levels, a cap of 4,000 role assignments, an AssignableScopes array you cannot widen later — and none of them had an invoice attached.

Phase 2 begins in a different economy. Microsoft Entra ID is the foundational product of Microsoft Entra, providing authentication, policy enforcement, and protection for users, devices, apps, and resources, and you already have it: if you're a Microsoft 365, Azure, or Dynamics CRM Online subscriber, you're already using Microsoft Entra ID, because every tenant is automatically a Microsoft Entra tenant. What you have is the Free edition, and the distance between Free and the thing most architecture diagrams quietly assume is a per-user bill.

That would be a procurement problem and not an architecture problem, except for how the counting works. Entra does not bill you for the users who use a feature. It bills you for the users a feature could reach. A policy you write on a Tuesday afternoon, scoping an access package to All employees, is a licensing decision for the whole company — taken by an administrator, in a blade, with no number displayed anywhere on the screen.

Architecture

Start with what is still free, because it is more than you expect

Four things this phase depends on carry no licence at all, and knowing them stops you over-buying on the strength of a feature you already have.

Managed identities. There are no licensing requirements for using Managed identities for Azure resources, and they can be used at no extra cost. Posts #35 and #36 are entirely about them; it is worth saying now that the most-recommended answer to credential handling in Azure is also the free one.

Built-in Entra roles. Using built-in roles in Microsoft Entra ID is free. But using custom roles requires a Microsoft Entra ID P1 license for every user with a custom role assignment — and that is a precise inversion of the trade-off from post #20. In Azure RBAC, a custom role costs nothing but is permanently capped by the AssignableScopes you set at creation. In Entra, a custom role has no such cap, and instead bills you per assignee. Two directories, two custom-role systems, opposite constraints.

Verified ID. Included with any Microsoft Entra ID subscription, including Microsoft Entra ID free, at no extra cost — with Face Check as the premium add-on that is not.

Entra Connect. Using this feature is free and included in your Azure subscription. Connect Health, which is the part that tells you whether sync is working, requires Microsoft Entra ID P1 licenses. Free to run the hybrid plumbing, paid to monitor it.

The ladder, and the one line on each rung that matters

The full comparison runs to several screens of tables. Compressed to the decision each rung actually forces:

Two observations about the shape of that table. First, the two rungs everyone argues about — P1 and P2 — are not separated by quantity of features but by a single qualitative line: P1 lets you write rules about conditions you can state, and P2 lets you write rules about risk you cannot. Everything else on the P2 side follows from having a risk engine and a privileged-access engine in the tenant.

Second, ID Governance and the Suite are not the top of the ladder. They are additions that require a rung beneath them to already be paid for. If a prerequisite isn't present, or the subscription expires, then Microsoft Entra ID Governance scenarios might not function as expected — so the dependency is live, not a one-time purchase check.

The counting rule, which is where budgets actually go wrong

This is the part worth reading twice. The documentation gives worked examples, and they are unusually candid.

In the first row, 2,000 − 150 = 1,850 licences are bought for employees who never clicked anything. That is not a billing error; it is the stated rule, and it is the right rule, because the entitlement exists whether or not it is exercised. But it means the cost of an access package is set by the audience of its policy, and an administrator widening a scope from one department to the whole company has just multiplied a bill with no prompt to say so.

The second and third rows make the same point from the other direction: you pay for reviewers as well as the reviewed, for approvers as well as the eligible. Governance features bill the entire loop, not the subject of it.

Why This Architecture Holds Up

Because the licence boundary decides where your control plane is

Phase 1 established that Azure governance has one enforcement point worth the name: Azure Policy, evaluated at resource write. Entra adds a second: Conditional Access, evaluated at sign-in. The two do not overlap, and they answer different questions — Policy asks may this resource exist in this shape, Conditional Access asks may this person reach it right now.

Conditional Access requires P1. That single fact determines whether an organisation's identity design can be conditional at all. Below P1 you have security defaults, which are an on/off posture for the tenant, not a policy language. So the choice between Free and P1 is not "do we want more features"; it is do we want an enforcement point at sign-in. Everything downstream of that — every design in this phase that says "require MFA when", "block from", "require compliant device for" — presumes the answer was yes.

Because P2 is a frozen SKU, and that is a stated roadmap

Buried in the governance licensing FAQ is a sentence that should end a great many purchasing debates: All currently Generally Available features in Microsoft Entra ID P2 will remain, but no new Identity Governance & Administration (IGA) features or capabilities will be added to the Microsoft Entra ID P2 SKU.

P2 is not being withdrawn, and what you have keeps working. But for governance specifically, P2 is a snapshot. New capability lands in ID Governance and the Suite. An architecture that plans to grow its governance posture over three years and budgets for P2 has budgeted for a feature set that will not grow with it. This is rare: a vendor stating plainly, in documentation rather than a roadmap deck, that a SKU is closed for new function.

Because the failure mode on expiry is different for every feature

Almost every discussion of licensing stops at what you get. The more useful question for an architect is what happens when you stop paying — during a migration, a tenant consolidation, a contract gap, or an expired trial. Entra answers that question differently for its two flagship features, and the difference is stark.

Conditional Access degrades safely. When licenses required for Conditional Access expire, policies aren't automatically disabled or deleted. They can be viewed and deleted, but no longer updated, and the documentation states the intent outright: to grant customers the ability to migrate away from Conditional Access policies without a sudden change in their security posture. Your rules keep enforcing. You lose the ability to change them.

PIM does the opposite. On expiry, eligible role assignments are removed, as users will no longer be able to activate privileged roles, any ongoing access reviews of Microsoft Entra roles end, and Privileged Identity Management configuration settings are removed. And the line that deserves to be read slowly: active time-bound assignments become active permanent, which means they'll no longer expire at a designated time.

There is a defensible logic to it — removing active assignments outright would lock administrators out of their own tenant at the worst possible moment — but the result is that letting a P2 subscription lapse is a privilege-escalation event that produces no alert, because Privileged Identity Management no longer sends emails on role assignment changes either. The operational consequence: a PIM deployment needs a licence-expiry watch as much as it needs an access-review schedule, and offboarding a tenant needs a deliberate pass to strip the assignments PIM will otherwise make permanent on its way out.

Because guests are billed on a different model entirely

One more structural point that catches B2B-heavy estates. Microsoft Entra ID Governance utilizes Monthly Active User (MAU) licensing for guest users which is different than licensing for employees and requires an Azure subscription. External ID follows the same shape, with core features free for your first 50,000 monthly active users.

So a single access review spanning employees and partners is billed two ways at once: a held seat count for the members, and a monthly active charge against an Azure subscription for the guests. That is the first place in this series where an Entra decision reaches back into the Azure billing hierarchy of posts #9 and #10 — and it means someone has to nominate which subscription carries it.

Key Architecture Decisions

Closing Thought

Licensing pages are the documentation nobody reads for architecture, and that is a mistake here, because in Entra the licence boundary is an architecture boundary. It decides whether you have an enforcement point at sign-in. It decides whether privileged access can be temporary. It decides, through the counting rule, that the cost of a governance design is set by the breadth of its scope rather than the frequency of its use — which is the opposite of how almost everything else in Azure bills.

The detail I keep returning to is the expiry behaviour, because of what it reveals. Two features, both premium, both security controls, and the platform chose opposite failure modes for them: Conditional Access keeps enforcing and stops accepting changes, while PIM stops enforcing and quietly makes the temporary permanent. Neither choice is wrong on its own terms. But together they mean you cannot reason about "what happens if the licence lapses" as a single question with a single answer, and an estate that assumed it could will find the answer differs per feature, at the worst time.

Phase 1 taught that the expensive Azure decisions are the ones that are hard to reverse. Phase 2 opens with a different lesson: the expensive identity decisions are the ones taken in a blade, by someone choosing a scope, with no number on the screen.

Official Azure Reference

• Microsoft Entra licensing
• Microsoft Entra ID Governance licensing fundamentals
• What is Microsoft Entra?
• Microsoft Entra built-in roles reference
• Security defaults in Microsoft Entra ID