Tools
Entra ID P1 or P2: what the extra tier actually buys
P1 gives you Conditional Access. P2 gives you the ability to prove who has privilege and take it back. Which one you need depends on one question.
Microsoft
The dividing line
P1 is about controlling access. Conditional Access, group-based licensing, self-service password reset with writeback, hybrid identity at scale. If you are enforcing multi-factor authentication with conditions, P1 is the tier that makes it possible.
P2 is about governing privilege. Privileged Identity Management, access reviews, entitlement management and Identity Protection risk policies. It answers a different question: not who can get in, but who currently holds power they should have given back.
| P1 | P2 | |
|---|---|---|
| Conditional Access | ||
| Self-service password reset with writeback | ||
| Privileged Identity Management | ||
| Access reviews | ||
| Entitlement management | ||
| Risk-based Conditional Access | ||
| Identity Protection reporting |
Plan contents change. Confirm against Microsoft's current comparison before purchase.
The question that decides it
How many people hold standing administrative privilege right now, and could you produce that list in five minutes?
If the answer is more than a handful, or you cannot produce the list, P2 is doing work that nothing else will do. Privileged Identity Management turns permanent Global Administrator into a request with an expiry, and that single change removes the condition that turns one compromised account into a tenant-wide event.
If you genuinely have two admins, both use separate accounts, and both are on hardware keys, then P1 plus discipline is defensible.
The verdict
P2, once you are past about 50 people
Standing privilege is the most common serious finding in Microsoft estates, and PIM is the only thing that fixes it structurally rather than by policy and hope.
P1
Enough for small teams with genuinely few admins, where the governance features would be bought and never configured.
Check your licence first. Microsoft 365 E5 and several education and business SKUs already include P2, and organisations buy it twice more often than you would expect.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.