If you’re on Microsoft 365, you already have Entra ID — the question is what tier, what it costs, and whether it’s configured well enough to survive an audit or an attacker. That’s what the rest of this post walks through, tier by tier, dollar by dollar, starting with what the name even means.
What Is Microsoft Entra ID? (And Why Was It Called Azure AD?)
Microsoft Entra ID is Microsoft’s cloud identity and access management (IAM) service — the system that verifies who your employees are and controls what they can log into. If you’ve ever signed into Outlook, Teams, or a connected SaaS app with your work email, Entra ID handled that sign-in.
The naming confusion is understandable. Microsoft announced on July 11, 2023 that Azure Active Directory would be renamed Microsoft Entra ID, with the rollout across product experiences beginning that August and most naming changes wrapped up by the end of 2023. It’s a rebrand, not a new product. Your tenant ID, sign-in URLs, APIs, PowerShell cmdlets, and MSAL libraries all kept working through the change with zero forced migration. If your team still calls it “Azure AD” out of habit, nothing broke — they’re just behind on the name.
An Intro to The Microsoft Entra Product Family (So You Know What You’re Actually Being Sold)
“Entra” is now an umbrella brand, and that’s where a lot of confusion creeps into vendor conversations. Under that umbrella sit several distinct products: Entra ID (the core identity service this post is about), Entra ID Governance (access reviews and entitlement management), Entra Permissions Management, Entra Verified ID, and Entra Internet Access / Entra Private Access (network access products, adjacent to SASE).
Most startups need exactly one of these: Entra ID. If someone quotes you a proposal that bundles in the full Entra suite before you’ve even nailed down basic Conditional Access, ask why.
What Entra ID Actually Does for a Growing Company
Single Sign-On (SSO)
One login, many apps. If your team already signs into Slack, Google Workspace add-ons, or other SaaS tools through their Microsoft 365 account, you’re likely using Entra ID’s SSO right now without having named it.
Multi-Factor Authentication (MFA)
Basic MFA is available even on the free tier through a feature called Security Defaults. It’s real protection — but it’s all-or-nothing. You can’t say “require MFA for logins outside the office” or “skip it for trusted devices.” Every user gets the same rule, no exceptions.
Conditional Access
This is the feature most growing companies actually want: require MFA only for risky sign-ins, block logins from countries you don’t operate in, force a compliant device for anyone touching sensitive data. It’s also the single biggest “wait, I have to pay more for that?” moment for companies that assumed MFA was MFA. Conditional Access requires a P1 license — more on what that costs below.
Identity Governance & B2B/External Identities
Access reviews, entitlement management, and Entra External ID for inviting contractors or partners securely — these live in P2 or the Governance add-on. Treat this as a grow-into feature. Most companies under roughly 50 employees don’t need it yet, and buying it early is money spent on a problem you don’t have.
Entra ID Licensing: What You’re Already Paying For (and What Costs Extra)
Pricing reflects Microsoft’s July 1, 2026 rate increase — most competing pages still show pre-increase figures.
| Tier | Price (per user/month) | What You Get | Who Actually Needs It |
| Free | $0 (included with any M365/Azure subscription) | Core directory, basic SSO, Security Defaults (all-or-nothing MFA) | Very small teams with no compliance pressure yet |
| P1 | $7 standalone; bundled in Microsoft 365 Business Premium and E3 | Conditional Access, hybrid AD join, self-service password reset | Most growing companies — this is the tier that actually changes what you can enforce |
| P2 | $10 standalone; bundled in M365 E5 | Everything in P1, plus risk-based Conditional Access and advanced identity governance | Companies pursuing SOC 2 or ISO 27001, or past ~100 employees |
| Entra Suite | $12 (requires P1 base) | Adds Internet/Private Access, full Identity Governance, and Verified ID on top of P1 | Enterprises consolidating network + identity security — rarely a startup-stage need |
Free Tier — What’s Included by Default
Every Microsoft 365 or Azure subscription includes Entra ID Free automatically. The free tier’s object limit is 50,000 Microsoft Entra resources by default, extendable to 300,000 once you verify a domain — so “we outgrew the free tier” is not a realistic near-term problem for a 10–200 person company. If you’re being sold an upgrade on the basis of hitting a user cap, that’s not the actual constraint.
P1 — The Tier Most Growing Companies Actually Need
P1 is where Conditional Access lives, and it’s already bundled into Microsoft 365 Business Premium and Microsoft 365 E3. If you’re on Business Premium, check your admin center — you’re likely paying for P1 today without using it. If you’re on Business Standard, you’re not, and adding it means either a standalone P1 add-on or an upgrade to the whole tenant.
P2 — When You Actually Need It
P2 adds risk-based Conditional Access (policies that respond to signals like an impossible-travel login) and advanced governance. Don’t buy this ahead of the need. It’s usually not necessary until you’re actively pursuing SOC 2 or ISO 27001 certification, or your headcount has crossed roughly 100 people. Before that, it’s a line item with no corresponding risk it’s solving.
Business Premium vs. Business Standard + Add-On P1
This is a real decision point, not a hypothetical — it comes up constantly in practitioner forums, including a live Microsoft Q&A thread on exactly this question. Some IT consultants recommend upgrading the whole tenant to Business Premium rather than bolting a standalone P1 add-on onto Business Standard, because Business Premium also includes Intune (device management) and Defender (endpoint security) — and the bundled price often lands close to or below the sum of buying the pieces separately. Before you approve a P1 add-on line item, get a quote for the full Business Premium upgrade and compare the total.
Setting Up Entra ID for a Small Team: A Practical Checklist
- Verify your domain in the Entra admin center (entra.microsoft.com) so users sign in with your company email, not a default onmicrosoft.com address.
- Turn on Security Defaults if you’re on the free tier — or move straight to Conditional Access if you have P1, since it gives you far more control for roughly the same setup effort.
- Enforce MFA for every user, no exceptions for “just the intern’s account” or “the shared marketing login.”
- Set up at least one break-glass admin account — an emergency access account excluded from Conditional Access policies, so a misconfiguration can’t lock every admin out simultaneously.
- Review guest and external access settings before you start inviting contractors, so external accounts don’t inherit more access than intended.
- Plan for hybrid join only if you still run on-premises Active Directory — most startups on cloud-only infrastructure can skip this step entirely.
Do You Need an MSP to Manage Entra ID?
If you’re a very small team on the free tier with basic MFA turned on, DIY is genuinely fine. There’s no compliance pressure, no complex policy set, and low stakes if something’s slightly off.
That changes once Conditional Access enters the picture. A single misconfigured policy — say, one that requires a compliant device for a group that includes your break-glass account — can lock your entire team out during a Monday morning push, or worse, leave a gap an auditor flags mid-SOC 2 review. Conditional Access is a rules engine, and rules engines are exactly where small teams without dedicated IT staff make expensive mistakes.
The tipping point toward outside help is usually one of three things: you’re building multi-policy Conditional Access that needs to survive an audit, you’re prepping for SOC 2 or ISO 27001 and identity controls are now part of the evidence, or you’re integrating on-premises Active Directory via hybrid join and don’t want to be the one debugging sync errors at 11pm.
If any of that sounds like where you are, this is exactly the gap Interlaced’s Cyber Security and Compliance services are built to close — configuring Conditional Access correctly the first time, and making sure your identity setup holds up when an auditor or an enterprise security questionnaire comes asking. If you’re not sure which side of that line you’re on, our Managed IT team can tell you in one conversation, no hard sell required.
Identity and access management also shows up the moment someone joins or leaves your company — see our employee onboarding and offboarding guide for how provisioning and deprovisioning tie back to the Entra ID setup above. And if you’re already thinking about SOC 2, our post on IT compliance automation and audit readiness walks through where identity controls fit into that evidence trail. If device management is your next question, MacBook management and MDM covers the device side of the same access-control decision.
How Interlaced Solves It
Start with the Azure Health Check. Every engagement starts with a fixed-fee, vCISO-style gap assessment of your environment — including your identity setup. You get a ranked list of your top security and cost fixes, what each would take to implement, and a clear picture of your current exposure. No guessing, no open-ended retainer to start.
Then we build from the roadmap. For identity specifically, that means Entra ID, Conditional Access, Microsoft Defender, and Sentinel configured and monitored on an ongoing basis — working together with your Microsoft 365 tools (Intune, Entra sync) instead of as disconnected point solutions. The same roadmap can also cover cloud infrastructure, backup and disaster recovery, compliance (HIPAA, SOC 2, NIST 800-171), and AI readiness, depending on what your Health Check turns up.
Why us and not a reseller: a cloud reseller sells you Entra ID. We run identity, devices, and security inside live IT environments every day — which is the difference between a Conditional Access policy that looks fine in a diagram and one that survives an audit, a lockout attempt, or a compliance review. When something breaks, you call a partner with a 15-minute average response time, not a reseller who closed the deal and moved on.
One partner, full accountability, from your first licensing question to production.
Book Your Free Azure Health Check →
FAQ
Is Microsoft Entra ID the same thing as Azure AD? Yes. It’s a rename, not a new product — same service, same tenant, same underlying technology, just a new name and a new admin portal (entra.microsoft.com) as of mid-2023.
Do I already have Entra ID if I use Microsoft 365? Yes. Every Microsoft 365 and Azure subscription includes Entra ID Free automatically. The real question isn’t whether you have it — it’s which paid tier, if any, is already bundled into your specific Microsoft 365 plan.
What’s the difference between Entra ID P1 and P2, and which one do I need? P1 unlocks Conditional Access, which is what most growing companies actually need. P2 adds risk-based access controls and advanced governance, and is typically only necessary once you’re pursuing SOC 2 or ISO 27001-level compliance, or you’ve crossed roughly 100 employees.
Is MFA free in Entra ID, or do I have to pay for Conditional Access to get it? Basic MFA is free through Security Defaults, but it’s all-or-nothing — every user, same rule. Granular, rule-based MFA (like “only require it off the corporate network”) requires Conditional Access, which requires P1.
Does Microsoft 365 Business Premium already include what I need, or do I have to buy Entra ID separately? Business Premium already bundles P1, including Conditional Access. Business Standard does not. If you’re on Standard, compare the cost of adding P1 as a standalone add-on against simply upgrading the whole tenant to Premium — the math often favors the upgrade.
Can I set up Conditional Access myself, or do I need IT help? Basic MFA enforcement is DIY-friendly. Multi-policy Conditional Access setups — especially ones that need to survive a compliance audit — are where misconfiguration risk (accidental lockouts, gaps auditors flag) makes outside help worth the cost.
What happens to my existing Active Directory (on-prem) if I set up Entra ID — do I have to replace it? No. Entra ID and on-premises AD aren’t mutually exclusive. Microsoft Entra hybrid join and Entra Connect let you sync your existing on-prem AD to Entra ID rather than ripping out infrastructure — common for companies still running legacy file servers or line-of-business apps.
How is Entra ID different from Okta for a small company? If you’re already committed to Microsoft 365, Entra ID is usually the lower-friction, often already-paid-for choice. Okta tends to make more sense for companies wanting a vendor-neutral identity layer across a more mixed, non-Microsoft stack. Which one you need depends on how Microsoft-centric your stack already is — not a flat recommendation either way.