This article was created using an automated generation workflow powered by generative AI.
What is Microsoft Entra ID P1 / P2? Comparing Authentication and Identity Management Differences Between M365 E3 and E5
About This Article
Based on official Microsoft licensing information as of September 18, 2026, this article outlines the relationship between Microsoft Entra ID P1/P2 and Microsoft 365 E3/E5/E7 from the perspectives of authentication, Conditional Access, Identity Protection, and PIM.Verification Status: 📘 Official Microsoft Information Confirmed / Not Verified on Actual Devices
Microsoft Entra ID is theidentity (digital representation of who a user is) foundationthat supports Microsoft 365 users, groups, sign-ins, and application access.
The difference between P1 and P2 is not whether users can log in to Microsoft 365. On top of basic identity management,the main difference is how far you can advance conditional access, risk detection, and privileged management.
- Key Terms to Learn First
- Relationship with E3/E5/E7
- Distinguishing P1 and P2 in Practice
- Sign-in Control Flow
- Try This First: Read Your Tenant Information
- Read Only Your Own Information with Microsoft Graph PowerShell
- Reduce "Permanent Administrators" with PIM
- Practical Example: Suspicious Sign-ins from Abroad
- Checklist for End Users, Administrative Staff, and IT Admins
- Administrator Checklist
- Common Misconceptions
- Official Microsoft Information
Key Terms to Learn First
| Term | Meaning for Beginners |
|---|---|
| MFA | Multi-Factor Authentication using factors other than a password |
| Conditional Access | A mechanism that evaluates access based on conditions such as user, device, location, and risk |
| sign-in risk | The risk that the current sign-in attempt might be by an attacker |
| user risk | The probability that a user account has been compromised |
| Identity Protection | An Entra feature that detects and mitigates risky users and sign-ins |
| PIM | Privileged Identity Management. A mechanism that activates administrative privileges only for the required duration |
| break-glass account | An emergency access account used during critical situations, such as Conditional Access outages |
Relationship with E3/E5/E7
According to the official Microsoft licensing documentation updated on June 18, 2026, the relationship is structured as follows:
| Microsoft 365 | Entra ID |
|---|---|
| E3 | Entra ID P1 |
| E5 | Includes rights equivalent to Entra ID P1 + P2 (includes P2) |
| E7 | Includes Microsoft Entra Suite in addition to Entra ID P2 features |
P1 is included in E3/E5/E7, and P2 is included in E5/E7. E7 further includes the Microsoft Entra Suite, expanding the scope to Private Access, Internet Access, ID Governance, ID Protection, and Verified ID premium capabilities.
Distinguishing P1 and P2 in Practice
| Feature Examples | P1 | P2 |
|---|---|---|
| Conditional Access | ○ | ○ |
| SSPR writeback | ○ | ○ |
| Risk-based Conditional Access | – | ○ |
| Full risk information in Identity Protection | Limited | ○ |
| Privileged Identity Management | – | ○ |
While Conditional Access is available in P1,risk-based policies that automatically control access based on sign-in risk or user risk require P2.
Sign-in Control Flow
flowchart LR
U[利用者] --> S[Microsoft Entra sign-in]
S --> CA[Conditional Access P1+]
CA --> D{端末・場所・アプリ等}
D --> MFA[MFA要求]
D --> B[Block / Allow]
S --> R[Identity Protection P2]
R --> RR{Sign-in/User Risk}
RR --> CA
In P1, you can create explicit conditions such as "require MFA if outside the corporate network" or "allow only managed devices." In P2, you can incorporate risks detected by Microsoft into your conditions, allowing you to design controls like "block high-risk sign-ins."
Try This First: Read Your Tenant Information
Open the Overview in the Microsoft Entra admin center to check the tenant name, Tenant ID, and licenses. Next, browse Users and Groups to understand the configuration.
It is safest not to modify Conditional Access policies from the start.
Read Only Your Own Information with Microsoft Graph PowerShell
In a test environment where Graph PowerShell is available, use the minimumUser.Readpermissions to retrieve your own information.
Connect-MgGraph -Scopes "User.Read" $ctx = Get-MgContext $ctx | Select-Object TenantId, Account, Scopes Get-MgUser -UserId $ctx.Account -Property Id,DisplayName,UserPrincipalName | Select-Object Id,DisplayName,UserPrincipalName
What to Check
TenantIdIs the tenant the expected one?ScopesIsUser.Readthe minimum privilege centered on User.Read?Can you retrieve only your own user information?
Criteria for Success
You can connect to the expected tenant with read-only permissions and retrieve your own identity information.
Change One Thing
Instead of adding a write scope,Select-Objectchange only the display properties. Get into the habit of starting with least privilege even when using APIs.
Reduce "Permanent Administrators" with PIM
sequenceDiagram
participant A as 管理者
participant P as PIM
participant C as 条件/承認/MFA
participant R as 管理者Role
A->>P: Role activationを要求
P->>C: 条件を評価
C-->>P: 承認
P-->>A: 一定時間だけRole有効
A->>R: 管理作業
P-->>A: 時間終了でRole無効
Instead of keeping administrators permanently assigned to roles like Global Administrator, PIM activates privileges only when needed, supportingJust-In-Time (JIT)operations.
According to Microsoft, using PIM requires a valid license such as Entra ID P2 or Entra ID Governance. Licensing requirements apply not only to users with eligible assignments but also to approvers and access reviewers.
Practical Example: Suspicious Sign-ins from Abroad
In an E3/P1 environment, you can configure Conditional Access based on conditions such as location, device, and MFA. With E5/P2, you can leverage Identity Protection's risk detection to link unusual sign-ins to risk-based Conditional Access.
However, applying automatic blocking to the entire organization all at once may lock out legitimate users. Implement it in phases using Report-only mode, test groups, and break-glass accounts.
Checklist for End Users, Administrative Staff, and IT Admins
| Role | What to Check |
|---|---|
| End Users | MFA registration, sign-in alerts, and password reset methods |
| Administrative/Account Staff | Onboarding/offboarding, transfers, groups, and license assignments |
| IT Admins / Security | Conditional Access, risk, PIM, auditing, and emergency accounts |
Administrator Checklist
Verify E3/E5/E7 or additional Entra SKUs.
Do users targeted by Conditional Access have the required P1 or higher rights?
Do users targeted by risk-based policies have P2 rights?
Is the break-glass account designed not to be locked out by the same policies as regular users?
Was Conditional Access tested starting with Report-only mode?
Have PIM-eligible roles and permanently assigned roles been audited?
Have licensing requirements been verified, including those for PIM approvers and reviewers?
Have MFA and authentication methods policies been organized?
Have retention and integration requirements for sign-in and audit logs been verified?
Have you confirmed that features for agent identities, such as Agent 365, have different requirements than user-targeted P1/P2?
Common Misconceptions
"Conditional Access cannot be used with E3"
E3 includes Entra ID P1, and Conditional Access is a P1 feature.
"P1 can also automatically block based on user risk"
Risk-based Conditional Access requires the P2 features of Identity Protection.
"PIM can be used by purchasing just a single P2 license for all administrators"
PIM has licensing requirements for each user, including those with eligible roles, approvers, and reviewers.
Official Microsoft Information
Entra ID P1/P2 is not simply an "advanced version of the admin portal."It is easier to understand the difference between E3 and E5 if you think of P1 as providing condition-based access control, and P2 as advancing risk detection and privileged management.
