Blog

Microsoft Entra ID P1 and P2: How Premium Licensing Lifts Your Security Score

Image: Kampus Production via Pexels

If you’ve ever looked at your Microsoft Secure Score and wondered why it seems stuck below a certain point no matter what you do, there’s a good chance the answer comes down to licensing. Specifically, whether your organisation has Microsoft Entra ID P1 or P2 — the identity tiers formerly known as Azure AD Premium. Understanding what each tier unlocks is genuinely useful, because these licences sit at the heart of modern identity security.

What Are Entra ID P1 and P2?

Microsoft Entra ID (the rebranded Azure Active Directory) comes in a free tier built into most Microsoft 365 plans, but the premium tiers unlock the controls that matter most for protecting your users and data. Think of them as the engine room for identity security — the place where sign-in policies, risk detection, and privileged access management all live.

Entra ID P1 is the foundation. It unlocks:

• Conditional Access — the ability to define policies like “require MFA for all admin sign-ins,” block legacy authentication protocols, restrict access by country or location, and enforce compliant device requirements
• Self-service password reset with writeback — so users can reset their own passwords without calling the helpdesk, with changes syncing back to on-premises Active Directory
• Dynamic groups — automatically assign licences and policies based on user attributes
• Hybrid identity features — for organisations still running on-premises infrastructure alongside Microsoft 365

Entra ID P2 builds on all of that and adds the advanced layer:

• Identity Protection — risk-based Conditional Access driven by Microsoft’s global threat intelligence, detecting anomalous sign-ins, leaked credentials, and suspicious behaviour in real time
• Privileged Identity Management (PIM) — just-in-time admin elevation, meaning no one holds permanent admin rights; access is requested, approved, time-limited, and fully audited
• Access reviews — periodic, structured reviews to confirm who still needs access to what

Where Secure Score Hits a Ceiling

Microsoft Secure Score rewards you for turning on controls it considers high impact. The problem is, many of those controls simply aren’t available without P1 or P2. An organisation running Microsoft 365 Business Standard with no premium identity licensing will hit a score ceiling — not because they’ve been neglectful, but because the underlying controls are locked. Enabling a Conditional Access policy to require MFA for administrators, for example, moves the Secure Score needle noticeably. Enabling sign-in risk policies — which automatically challenge or block users whose credentials show signs of compromise — requires P2.

This isn’t theoretical. Microsoft’s Security Blog documented the Storm-2949 campaign, a recent incident where a single compromised identity escalated into a cloud-wide breach — precisely the scenario that Conditional Access, Identity Protection, and risk-based policies are designed to prevent. The controls that could have stopped it are Entra ID P1 and P2 features.

What This Means for Your Licensing

The good news for most small and medium-sized organisations is that Entra ID P1 is already included in Microsoft 365 Business Premium. If you’re on Business Premium, Conditional Access, self-service password reset, and the full suite of P1 controls are available right now — they just need to be configured. This is one of the core reasons we recommend Business Premium over Business Standard for most clients; the security gap between those two tiers is significant.

For organisations that need the full P2 capability — particularly those with elevated compliance requirements, sensitive data, or privileged user populations — standalone Entra ID P2 licences or Microsoft 365 E5 are the path to Identity Protection and PIM.

If you’re unsure which tier you’re on, or you’d like to understand where your Secure Score ceiling actually sits, our team is always happy to help you work through it.

Simon Falconer
Director, Resolve Technology
When he’s not finding a reason to buy the latest gadget, Simon is probably setting it up, breaking it, and fixing it again — all before breakfast.