Microsoft Azure Active Directory Premium is now called Microsoft Entra ID P1 and P2. P1 is the paid plan for core identity management and Conditional Access; P2 adds identity-risk detection, risk-based access policies, and privileged-access controls. Before buying either plan, check whether your Microsoft 365 or other subscription already includes the features you need.
What is Azure AD Premium called now?
Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID. The former Azure AD Premium plans are now named Microsoft Entra ID P1 and Microsoft Entra ID P2. Entra ID is Microsoft’s identity and access management service for cloud and on-premises environments. The old name remains common in searches and older licensing references, but current Microsoft product and licensing pages use Entra ID terminology. Microsoft’s Entra ID overview describes the current product and plans.
As an Amazon Associate I earn from qualifying purchases.
What do P1 and P2 include?
P1 covers core identity and access capabilities for organizations that need more than the Free edition. P2 includes P1 capabilities and adds tools for detecting identity risk and controlling privileged access. Microsoft’s service description compares Free, P1, and P2, but exact entitlements can vary by feature and subscription; confirm the current terms for your tenant and users in the Microsoft Entra service description.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Plan | What it is for | Notable capabilities |
|---|---|---|
| Microsoft Entra ID P1 | Core paid identity management and access control | Authentication, single sign-on and application access, employee self-service, administration and hybrid identity, multifactor authentication, passwordless authentication, Conditional Access, and logging and reporting. |
| Microsoft Entra ID P2 | P1 plus identity-risk and privileged-access controls | Entra ID Protection, risk-based Conditional Access, Privileged Identity Management, and basic entitlement management and access reviews. Verify feature-level licensing before deployment. |
How should you choose between P1 and P2?
Choose P1 when access policies are the main need
P1 is the relevant plan when you need Conditional Access and the core paid identity and administration features, but do not require risk-based policies or P2’s privileged-access capabilities. Conditional Access lets administrators define access requirements for sign-ins; Microsoft identifies P1 as a licensing requirement for the feature.
#1 Best Overall
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
Choose P2 when identity risk or privileged access matters
P2 is designed for organizations that need to identify and respond to risky users or sign-ins, apply risk-based Conditional Access, or manage privileged roles with Privileged Identity Management. These are specific additions, not simply a general promise of stronger security. Microsoft’s Entra ID Protection licensing guidance explains the P2 requirement and feature-level entitlements.
Check your existing subscriptions first
Some Microsoft suites include Entra ID capabilities. Microsoft’s displayed service-availability table associates P1 with Microsoft 365 E3 and Enterprise Mobility + Security E3, and P2 with Microsoft 365 E5 and Enterprise Mobility + Security E5. That does not mean every Microsoft 365 customer has P1 or P2: the exact SKU, cloud, user licensing, and feature conditions matter. Review the current service description and your subscription details before purchasing a standalone license.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What license is required for Conditional Access?
Microsoft says Conditional Access requires Entra ID P1. Risk-based Conditional Access requires Entra ID Protection, which requires P2. Microsoft 365 Business Premium customers also have access to Conditional Access features. These requirements are feature-specific, so verify the applicable license for every user and feature in the current Conditional Access overview; Microsoft last updated that page on April 27, 2026, according to its page listing.
Recommended Free Tools
How do you get P1 or P2?
Microsoft documents purchase and activation through several subscription routes. You may be able to use an existing Azure or Microsoft 365 subscription, an Enterprise Mobility + Security licensing plan, or a Volume Licensing plan. An organization can associate a premium edition with an Azure subscription, but signup and activation are distinct steps. Follow Microsoft’s current premium edition signup and activation instructions for the route you use, then confirm that licenses are assigned to the users who need them.
Rank #3
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
How much do Entra ID P1 and P2 cost?
Microsoft’s US product page displayed P1 at $7 per user per month and P2 at $10 per user per month, paid yearly, in a September 28, 2026 capture. Those are US page prices at that time, not global prices or a guarantee of the current price. Geography, purchase channel, billing terms, and later price changes can affect the amount. Check the live Microsoft Entra pricing page and your existing suite entitlements before budgeting.
Quick Recap
Best Value
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Rank #4
- FIDO2 + FIDO U2F certified security key, supports PIV credential authentication
- Sits with a low-profile when plugged-in
- Works in every browser without installing any drivers
- Supports desktops, laptops, tablets, and Android mobile devices via USB-C
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
What to verify before purchasing
- Identify the exact features you need: core Conditional Access points to P1; risk-based Conditional Access and privileged identity management point to P2.
- Check whether your Microsoft 365, Azure, Enterprise Mobility + Security, or volume-licensing subscription already includes the relevant entitlement.
- Confirm feature-level, user-license, and cloud requirements in Microsoft’s current licensing documentation.
- Check the live regional price and billing term for your purchase route rather than relying on an old Azure AD Premium price listing.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
