Skip to main content
Microsoft Security

Microsoft Entra Plans & Pricing

Select the best option for your identity needs

Explore identity and access management products and pricing

Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).

  • Partially included Partially included
  • Included Included

Azure Active Directory Free

Originally starting from Free now starting from Free

Free Free

Included with Microsoft cloud subscriptions such as Microsoft Azure, Microsoft 365, and others.1

Microsoft Entra ID P1 for students

Originally starting from €5.60 now starting from €5.60

€5.60 €5.60


Azure Active Directory P1 (becoming Microsoft Entra ID P1) is available as a standalone or included with Microsoft 365 E3 for enterprise customers and Microsoft 365 Business Premium for small to medium businesses.

Most comprehensive

Microsoft Entra ID P2

Originally starting from €8.40 now starting from €8.40

€8.40 €8.40


Azure Active Directory P2 (becoming Microsoft Entra ID P2) is available as a standalone or included with Microsoft 365 E5 for enterprise customers.

Customer offer available2

Microsoft Entra ID Governance

Originally starting from €6.60 now starting from €6.60

€6.60 €6.60


Entra ID Governance is an advanced set of identity governance capabilities available for Microsoft Entra ID P1 and P2 customers.

  • Partially included Partially included
  • Included Included
Authentication, single sign-on and application access
Cloud authentication
(Pass-through authentication, password hash synchronization)
Federated authentication
(Active Directory Federation Services or federation with other identity providers)
Single sign-on (SSO) unlimited3
Software as a service (SaaS) apps with modern authentication (Microsoft Entra ID application gallery apps, SAML, and OAUTH 2.0)
Group assignment to applications
Cloud app discovery (Microsoft Defender for Cloud Apps)
Application proxy for on-premises, header-based, and integrated Windows authentication
Secure hybrid access partnerships (Kerberos, NTLM, LDAP, RDP, and SSH authentication)
Service level agreement
Customizable user sign-in page
Administration and hybrid identity
Role-based access control (RBAC)
User and group management
Advanced group management (dynamic groups, naming policies, expiration, default classification)
Synchronize Active Directory identities with Microsoft Entra ID using cloud sync or connect sync
Cloud monitoring and analytics for your key on-premises servers (connect health)
Delegated administration-built-in roles
Microsoft identity manager user client access license (CAL)
Cross-tenant user synchronization
End user self service
Application launch portal (My Apps)
User application collections in My Apps
Self-service account management portal (My Account)
Self-service password change for cloud users
Self-service password reset/change/unlock with on-premises write-back
Self-service sign-in activity search and reporting
Self-service group management (My Groups)
Self-service entitlement management (My Access)
Multifactor authentication and conditional access
Multifactor authentication (MFA)
Passwordless (Windows Hello for Business, Microsoft Authenticator, FIDO2, security key integrations)
Conditional access
SharePoint limited access
Session lifetime management Learn more
Continuous access evaluation
Global password protection and management (cloud-only users)
Global password protection and management (custom banned passwords, users synchronized from on-premises Active Directory)
Custom security attributes
Identity protection
Risk-based Conditional Access (sign-in risk, user risk)
Authentication context (step-up authentication)
Device and application filters for Conditional Access
Token protection
Vulnerabilities and risky accounts
Risk events investigation, security information and event management (SIEM) connectivity
Event logging and reporting
Basic security and usage reports
Advanced security and usage reports
Identity governance
 Automated user provisioning to SaaS apps
Automated user provisioning to on-premises apps
Automated group provisioning to apps
HR-driven provisioning
Terms of use attestation
Basic access certifications and reviews
Machine learning assisted access certifications and reviews
Basic entitlement management
Entitlement management – separation of duties
Entitlement management with Verified ID
Lifecycle workflows
Identity governance dashboard
Privileged identity management (PIM)

Azure Active Directory Domain Services

  • Azure Active Directory Domain Services is becoming Microsoft Entra Domain Services. Manage your domain services in the cloud to:

  • Gain access to managed domain services.

  • Join Azure virtual machines to a managed domain without domain controllers.

  • Sign-in to apps connected to your managed domain with Microsoft Entra credentials.

Get more with Microsoft 365

Provide seamless and protected sign-in experiences for frontline and informational workers with a Microsoft 365 subscription that includes Microsoft Entra ID.

Back to tabs

Explore new network access products in preview

Secure access to all private apps and resources, for users anywhere, with identity-centric Zero Trust network access. Pricing information will be provided when these products become available.

A woman sitting at a desk while working on a Microsoft Surface.

Microsoft Entra Private Access

Enable users to securely connect to private apps from anywhere.

A man sitting at a desk having a phonecall on a cellphone, while working on a laptop.

Microsoft Entra Internet Access

Secure access to internet, SaaS, and Microsoft 365 apps.

Reimagine secure access

  • [1] The free edition of Microsoft Entra ID is included with a subscription of a commercial online service such as Microsoft Azure, Microsoft Dynamics 365, Microsoft Intune, Microsoft Power Platform, and others in countries where they are available for sale.
  • [2] Microsoft Entra ID Governance is available at a promotional price for Microsoft Entra ID P2 customers until Dec 31, 2023.

Follow Microsoft