RemoteMicrosoft Entra ID
Microsoft Entra ID: what each licence actually switches on.
Entra ID is the identity behind every Microsoft 365 sign-in. The free tier gives you accounts and basic MFA. P1 adds Conditional Access. P2 adds risk-based policies and Privileged Identity Management. Governance adds access reviews and access packages. Here is what each does, what it costs in Australia, and what the licensing warnings in the admin centre mean.
Licensing rules from Microsoft Learn. Prices from Microsoft's Australian page, checked 30 October 2026.
- Free, P1, P2 and Governance
- Prices in AUD
- Licence check tool
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What each tier adds
Five tiers, from free to the Entra Suite.
Each tier includes the one before it.
Entra ID Free
Comes with every Microsoft cloud subscription. Users, groups, single sign-on, self-service password reset and Security defaults, which turns MFA on for everyone.
- Included with Microsoft 365
- Security defaults for MFA
- No Conditional Access
Entra ID P1: A$10.50
Conditional Access: rules that decide who can sign in, from where, on what device. Included in Business Premium and Microsoft 365 E3.
- Location and device rules
- Authentication strengths
- Group-based access
Entra ID P2: A$15.00
ID Protection with sign-in and user risk policies, plus Privileged Identity Management and basic access reviews. Included in Microsoft 365 E5 and E7.
- Risk-based Conditional Access
- Just-in-time admin rights
- Full risky user reports
Entra ID Governance: A$10.50
Lifecycle workflows, entitlement management with access packages, and the governance features Microsoft is adding beyond P2. Needs P1 or P2 underneath.
- Access packages
- Joiner and leaver workflows
- New governance features land here
Entra Suite: A$18.00
Governance, ID Protection, Private Access, Internet Access and Verified ID together. Included in Microsoft 365 E7.
- Private Access replaces VPN
- Internet Access filtering
- For P1 or P2 customers
Entra licence check
What Entra licensing do you need on top of your plan?
Pick your plan and tell us how many accounts sign in, who will use PIM and whether you want risk-based policies. The result shows any extra licences at Australian list prices.
What you need on top of the plan you already have, at Microsoft's Australian list prices.
Extra Entra licensing
A$45.00a month ex GST
On top of your current plan.
| Licence | Seats | Each |
|---|---|---|
| Entra ID P2 for PIM (admins and approvers) | 3 | A$15.00 |
- Licences are assigned to user accounts, so a separate admin account that benefits from Conditional Access needs its own.
The licensing warning
"Conditional Access policies are protecting more users than your licensing allows."
This comes from Entra's License usage page. For P1, it counts the unique users who had at least one Conditional Access policy evaluated in the last month, and compares that with the P1 licences you own. For P2, it counts users with a risk-based policy evaluated. Usage above your entitlement shows as a spike.
Common causes are separate admin accounts and shared or service accounts covered by an 'all users' policy. Licences are assigned per user account, so an admin with two accounts needs two. Check Billing, then Licenses, in the Entra admin centre, and either license the extra accounts or tighten the scope.
Our view
P1 is where Entra starts earning its keep.
Every Real Bytes managed tenant runs a standard set of Conditional Access policies, including our rule that limits sign-ins to Australia. That needs P1, which is one of the reasons Business Premium is our default plan.
P2 we add where it changes the risk: for admins, through PIM, so nobody holds admin rights all day. Full P2 for everyone, for risk-based policies, makes sense for larger or higher-risk tenants, and at that point Microsoft 365 E5 is often the better buy.
Feature by licence
Which licence each feature needs.
From Microsoft's Entra licensing documentation.
| Feature | Free | P1 | P2 |
|---|---|---|---|
| Security defaults (MFA for everyone) | Yes | Yes | Yes |
| Self-service password reset | Yes | Yes | Yes |
| Password reset with on-premises writeback | No | Yes | Yes |
| Conditional Access | No | Yes | Yes |
| Risk-based Conditional Access | No | No | Yes |
| Full risky users and sign-ins reports | No | No | Yes |
| Privileged Identity Management | No | No | Yes |
Entra ID Governance adds entitlement management, lifecycle workflows and the newer governance features on top of P1 or P2. Microsoft says no new governance features will be added to P2 itself.
Mistakes we see
Five Entra mistakes we fix.
- Staying on Security defaults after buying P1Security defaults cannot do exceptions or device checks. Move to Conditional Access.
- Admins with standing Global AdministratorUse PIM so rights are switched on when needed.
- No emergency access accountKeep a break-glass account excluded from Conditional Access, watched and stored safely.
- Policies scoped to 'all users' without a plan for guestsPartners and contractors get locked out, or quietly excluded with no rules at all.
- Buying P2 for everyone for PIMPIM needs P2 for admins, approvers and reviewers only.
How we set it up
Entra, in five steps.
- Step 1Review
Accounts, admin roles, MFA methods, guests and licence usage.
- Step 2Protect admins
Separate admin accounts, phishing-resistant MFA and PIM.
- Step 3Conditional Access
Our standard policy set, run in report-only first.
- Step 4Tidy
Stale accounts, old app consents and guests removed.
- Step 5Watch
Sign-in risk, licence usage and policy changes reviewed.
Related guides
Entra is the identity layer. These build on it.
Conditional Access, privileged access and passwordless sign-in all live in Entra.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about Microsoft Entra ID.
What is Microsoft Entra ID?
It is Microsoft's cloud identity service, formerly Azure Active Directory. Every Microsoft 365 tenant has it. It holds your user accounts and groups, handles sign-in and MFA, and decides who can reach which apps.
What do Entra ID P1 and P2 cost in Australia?
Per user per month, ex GST, annual, from Microsoft's Australian page on 30 October 2026: Entra ID P1 A$10.50, Entra ID P2 A$15.00, Entra ID Governance A$10.50 and the Entra Suite A$18.00. Business Premium and Microsoft 365 E3 include P1; E5 and E7 include P2.
What does 'Conditional Access policies are protecting more users than your licensing allows' mean?
Entra compares how many unique users had a Conditional Access policy evaluated last month against the number of P1 licences you own. If more users were covered, it shows a usage spike. Check the License usage page under Billing, then license the extra accounts or narrow the policy scope.
Do I need P2 for Privileged Identity Management?
Yes, or Entra ID Governance. Microsoft says PIM licences are needed for users with eligible or time-bound roles, members or owners of PIM for Groups, people who approve activations, and people in or running access reviews. Not every user.
Is Security defaults enough?
It is a free starting point that turns on MFA for everyone. It cannot do exceptions, location rules or device checks. Once you have Business Premium or P1, Conditional Access replaces it.
What happens to Conditional Access if our P1 licences lapse?
Microsoft says policies are not disabled or deleted. You can view and delete them, but you cannot update them until the licences are back.
Next step
Not sure what your Entra licences are doing?
We will review your tenant's sign-in setup, licence usage and admin access, and tell you what to change first.
Keep reading
- Conditional Access library Policies we deploy.
- Privileged access guide PIM explained.
- Microsoft 365 licensing Plans and prices.
- Identity and access Our identity service.
Reviewed by Blake Bath, General Manager, on 30 October 2026. Licensing rules from Microsoft Learn. Prices from Microsoft's Australian Entra pricing page, ex GST, checked 30 October 2026. Microsoft Entra is a trademark of Microsoft Corporation. Microsoft Learn, Microsoft Entra licensing; Microsoft Learn, What is Conditional Access? (license requirements); Microsoft Learn, Microsoft Entra ID Protection (license requirements); Microsoft Learn, Microsoft Entra license usage insights; Microsoft Learn, Entra ID Governance licensing fundamentals; Microsoft, Entra pricing (Australia)