Microsoft Entra ID P1 vs P2 vs Entra Suite
By ClearSourcePublished Last checked
The Microsoft Entra identity tiers, split by Conditional Access, risk-based policies, governance and Global Secure Access.
In short:
- P1: every tenant needing Conditional Access (usually via Microsoft 365 E3 / Business Premium)
- P2: organisations needing risk-based access and privileged identity management
- Microsoft Entra Suite: organisations replacing their VPN with per-app access (Private Access) and needing advanced identity governance
ClearSource’s reading of Microsoft’s documentation — not a recommendation for your situation.
Microsoft Entra ID P1 CHF 5.70, Microsoft Entra ID P2 CHF 8.10, Microsoft Entra Suite CHF 9.70, Microsoft Entra ID Governance (add-on) CHF 5.70 per user and month. Microsoft list prices for Switzerland, annual commitment, excl. VAT, as of 4 October 2026; IT partners often quote lower.
The upgrade path
CHF list price per user and month, annual commitment, excl. VAT
- Entra ID P1CHF 5.70Includes
- SSO, MFA, Conditional Access, passwordless, hybrid identity, self-service, cross-tenant sync, Verified ID credentials
- Microsoft traffic profile of Global Secure Access (Internet Access for Microsoft services)
- Microsoft Entra application proxy
- Included in Microsoft 365 E3 / Business Premium / EMS E3
- Entra ID GovernanceCHF 5.70
Needs: Microsoft Entra ID P1 or P2 (P2 step-up variant for P2 customers)
Includes- Lifecycle workflows, account discovery, ML-assisted access reviews, automatic assignment policies and other advanced IGA
- Entra ID P2CHF 8.10Includes
- P1 + ID Protection, risk-based Conditional Access, PIM, basic entitlement management, basic access reviews
- Included in Microsoft 365 E5
- Entra SuiteCHF 9.70
Needs: Entra ID P1
Includes- Private Access, Internet Access, ID Governance, ID Protection, Verified ID
- Included in Microsoft 365 E7
No difference is shown between an option that needs a base licence and one that does not: their prices are not comparable.
The options
- Lowest list priceSecurity
Microsoft Entra ID P1
AAD_PREMIUMIncludes
- SSO, MFA, Conditional Access, passwordless, hybrid identity, self-service, cross-tenant sync, Verified ID credentials [2]
- Microsoft traffic profile of Global Secure Access (Internet Access for Microsoft services) [3]
- Microsoft Entra application proxy [4]
- Included in Microsoft 365 E3 / Business Premium / EMS E3 [2]
- Security
Microsoft Entra ID P2
- Lowest list priceSecurity
Microsoft Entra ID Governance
Includes
- Lifecycle workflows, account discovery, ML-assisted access reviews, automatic assignment policies and other advanced IGA [5]
Limits
- No new IGA features are added to P2; guests billed MAU via Azure subscription [5]
Microsoft_Entra_ID_GovernanceRequires
- Microsoft Entra ID P1 or P2 (P2 step-up variant for P2 customers) [5]
- Security
Microsoft Entra Suite
Key differences
What changed recently
Sources
- 1Microsoft Entra – Preise (microsoft.com/de-ch) (25 September 2026)
- 2Microsoft Entra pricing (de-ch) (24 September 2026)
- 3What is Global Secure Access? (Microsoft Learn) (19 May 2026)
- 4Microsoft Entra application proxy FAQ (Microsoft Learn) (1 May 2026)
- 5Microsoft Entra ID Governance licensing fundamentals (Microsoft Learn) (14 September 2026)
- 6Try Microsoft Entra Suite (Microsoft Learn) (9 April 2026)
- 72026 Microsoft 365 packaging and pricing updates (Microsoft Licensing news) (16 February 2026)
- 8Modern Work Plan Comparison - Enterprise (Microsoft PDF, publish date September 1, 2026) (1 September 2026)
Microsoft’s own pages, read on or before 25 September 2026.
Microsoft changes for these products
All Microsoft changes →- Microsoft Purview Suite for Business Premium: 50% off with Copilot runs until 31 December 2026
- Microsoft Entra ID P2 (Education Student): renewals must use a new SKU from 1 July 2026
- Microsoft Security Store: in Microsoft Entra and Microsoft Purview; Advisor now generally available
- Microsoft 365 E7: in CSP from 1 May 2026 with launch discounts of 10–15% until 31 December 2026
Want offers for these licences?
Free and without obligation: checked Swiss IT partners send you an offer. Nothing goes out until you confirm by email.
