This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 92%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMB%3C/text%3E%3C/svg%3E)
I am reading various articles about Microsoft cloud security features. Many of them list having a Entra ID P1 / P2 license as a prerequisite. But I am unclear on exactly what that means.
On the Azure portal, the "All Services > Licenses" page, my organization shows as having a single Entra ID P2 license. It's assigned to a single admin user, leaving "available" licenses at zero. The pricing page for Entra ID also lists everything as per-user.
However, on the "All Services > Licenses > Licensed Features" page there is a big blue box that appears to be saying it's the tenant that has the license.
Additionally, there are services we have been using for a long time (e.g., Risk-Based Conditional Access) that are listed as only being available with an Entra ID P2 license -- yet these services are administered by more than my one P2 license assignee and are deployed at the tenant level.
So, I guess my question is: For a service that both applies to all users and requires an Entra ID P2 license, would my tenant qualify or not?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 26%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
Following up to see if the below answer was helpful. Please remember to "Accept Answer" if answer helped you. This will help us as well as others in the community who might be researching similar questions. if you have any further query do let us know.
Each account that consumes a P2 service requires a license. You can have one P2 to light up the feature and enable it but each user that takes advantage of that service needs to be licensed to be compliant. The docs arent very clear about that sometimes.
How would you define "take advantage of a service"? Every user in the tenant, for example, benefits from using Risk-Based Conditional Access. Would that not be taking advantage of that service?
How would that work with Risk Policies? Every user is taking advantage of that feature. We have Risk-Based Conditional Access policies that apply to everyone org-wide, with no service limitations that I've run into. Yet all with only a single P2 license.
If you are using a Ca policy that leverages risk-based actions, then every member account you have in scope of that policy needs a P2:
https://www.reddit.com/r/AZURE/comments/16d6ez2/does_every_user_need_a_azure_ad_p2_license_to_use/
Not sure why I had to dig for so long to find this particular information, but as least I appear to have an answer now. -- as least with regard to risk-based CA policies.
According to this article, Microsoft splits risk-based policy result visibility into "Premium" and "Nonpremium". From what I read, it seems the risk-based policies would work regardless of the license level. The tenant would still be protected, but the customer may not know what they were protected from.
The license level appears to only matter if a tenant admin wants the details on why a particular user/sign-in was flagged as "risky". There are a handful of detections that a nonpremium tenant can see (3 for sign-in risk & 2 for user risk), but any detection that's restricted to Premium will just be displayed as "Additional Risk Detected".
Example: Impossible Travel risk policy
The good news is, the risk-based policy action would still have the desired effect (e.g., blocked).
The bad news is, if an admin what's to know what activity triggered the risk flag, they gotta pay up.
and depending on how you want to handle the risk, a CA policy is required and that needs a license :) Its way t0o confusing
Beyond the single P1/2 needed to enable CA in general, I can't find anything in the documentation that says just implementing a risk-based CA policy requires any additional licensing. Not even sure how that would be possible since, under the hood, all the different CA policies are rolled up into a single policy at runtime.
All the risk-based policies still do their intended work regardless of the end-user license assignment status. The additional Premium licenses are needed for more robust reporting after the CA policies have applied, but the tenant is still protected against risky sign-ins or risky users without them.