About This Article
This article clarifies the relationship between Microsoft Entra ID P1/P2 and Microsoft 365 E3/E5 based on official Microsoft licensing information as of September 17, 2026.Verification Status: 📘 Confirmed with official Microsoft information, unverified on actual hardware
Microsoft Entra ID is the identity foundation that supports sign-ins, users, groups, and app access in Microsoft 365. The difference between P1 and P2 is not whether users can log in, but how extensively advanced access control, risk detection, and privileged management are handled.
Differences Between E3 and E5
According to official Microsoft sources,Entra ID P1 is included in Microsoft 365 E3/E5, and P2 is included in Microsoft 365 E5. In addition to P1 features, P2 emphasizes advanced identity protection and privileged management, such as Identity Protection and Privileged Identity Management.
Try First: Read Your Tenant
Open Overview in the Microsoft Entra admin center to check tenant information and licenses. Next, browse Users and Groups to understand the configuration. Do not modify Conditional Access from the start.
Read Safely with Microsoft Graph
If you have an environment where Graph PowerShell can be used, you can check your own information with read permissions.
Connect-MgGraph -Scopes "User.Read" Get-MgContext Get-MgUser -UserId (Get-MgContext).Account -Property Id,DisplayName,UserPrincipalName
What to Check Here
Verify the target tenant, the scope in use, and the user ID.
Criteria for Success
Connecting to the expected tenant with read permissions and retrieving only your own information.
Change One Thing
Get-MgContextCheck the display and understand the read scope by changing only the retrieved properties rather than adding another write scope.
Scenarios Where P1 is Effective
It serves as the foundation for organizational access control, such as Conditional Access, group-based management, and hybrid identities.
Scenarios Where P2 is Effective
It provides value in advanced breach-assumption identity defenses, such as control using sign-in/user risk and Just-In-Time administrator privileges via PIM.
Points for Administrators to Check
Assignment of E3/E5 or additional SKUs
Break-glass accounts
Lockout prevention measures when modifying Conditional Access
PIM target roles
MFA and authentication methods
Retention conditions for audit and sign-in logs
Official Microsoft Information
https://learn.microsoft.com/en-us/entra/fundamentals/licensing
https://learn.microsoft.com/en-us/entra/fundamentals/whatis
Entra ID P1/P2 is not merely an "advanced version of the management console"; it is the foundation that determines how far risk-based, least-privilege access control can be operated across all of Microsoft 365.
