Vendor pricing

Microsoft Entra pricing 2026: P1, P2, Suite and the M365 bundle math

Name: Microsoft Entra
Brand: Microsoft
Availability: InStock

For Microsoft-centric organisations, Entra is usually the cheapest route into the identity pillar, because much of it is already bundled into M365 E3 and E5. This page lists Entra's per-user prices, explains what your productivity licence already covers, and shows when the Entra Suite makes a dedicated SSE platform unnecessary. Figures checked against Microsoft's pricing page in October 2026, with sources at the foot of the page.

List pricing

Entra per-user prices

Microsoft publishes Entra list pricing openly, per user per month, billed yearly. The headline figures below are list; M365 bundling usually lowers the marginal cost.

Product	Per user / month	What it adds
Entra ID Free	$0	Included with Microsoft cloud subscriptions. Basic SSO, MFA, user management.
Entra ID P1	$7.00	Conditional Access, password reset with on-premises writeback, application proxy, MFA for on-premises apps. Included in M365 E3 and Business Premium.
Entra ID P2	$10.00	Adds ID Protection (risk-based Conditional Access) and Privileged Identity Management. Included in M365 E5.
Entra ID Governance	$7.00	Entitlement management, access reviews, lifecycle workflows. Sold to P1 and P2 customers.
Entra Internet Access	$5.00	Secure web gateway / SSE component for the network pillar.
Entra Private Access	$5.00	Microsoft's ZTNA for private applications.
Entra Suite	$12.00	Private Access + Internet Access + ID Governance + ID Protection + Verified ID premium (Face Check). Requires P1 alongside it.

Source: Microsoft official Entra pricing page, per user per month, paid yearly on an annual commitment, checked October 2026. Product contents and the P1 prerequisite from Microsoft Learn, Microsoft Entra licensing.

The strategic question

Entra Suite versus a dedicated SSE platform

The Entra Suite at $12 per user per month, on top of P1, extends identity into the network pillar. For many Microsoft shops, that removes the need for a separate Zscaler or Netskope contract.

Approach	Indicative per user / month	Covers	Trade-off
Entra Suite, P1 already owned via M365 E3 or Business Premium	$12	Identity + ZTNA + SWG + governance, one vendor	Deepens single-vendor concentration
Entra ID P1 + Entra Suite, no M365 suite	$7 + $12 = $19	Same coverage, bought standalone	Same concentration, no productivity bundle
Okta Essentials + Cloudflare Zero Trust	$17 + $7 = $24	Best-of-breed identity + ZTNA and SWG	Higher cost, deliberate vendor neutrality

Our arithmetic over published list prices: Okta Essentials $17 per user per month billed annually (okta.com/pricing, $1,500 annual minimum) and Cloudflare Zero Trust pay-as-you-go $7 per user per month (see our Cloudflare page). Zscaler and Palo Alto publish no per-user price on their own sites; see our Okta and Zscaler pages for marketplace and filed figures. Illustrative stack comparison at list, not a like-for-like feature match.

The catch

Where Microsoft-native still falls short

The bundle is strong, but it is not a complete substitute for a dedicated SSE platform in every estate.

Throughput and inspection depth. High-traffic environments needing full SSL inspection everywhere, advanced sandboxing and a large global POP footprint may still want a dedicated SSE platform alongside Entra.

Concentration risk. Putting identity, ZTNA, SWG, endpoint (Defender) and email security all with one vendor concentrates both cost leverage and outage exposure. Some organisations split deliberately for resilience and negotiating position.

Licensing complexity. Microsoft's overlapping SKUs (M365 suites, standalone Entra, Defender plans, add-ons) make it easy to double-pay for capability you already own. Audit existing entitlements before buying Entra add-ons.

Alternatives

Compare before you commit

Price the Microsoft-native path against best-of-breed identity and network.

Okta pricing

Best-of-breed identity alternative

Zscaler pricing

Dedicated SSE platform

Identity pillar cost

Full identity-layer TCO

SSE bundle cost

Network-pillar bundle economics

Small business cost

The Microsoft-first SMB path

Full vendor comparison

Side-by-side across the market

Frequently asked

Microsoft Entra pricing questions

How much does Microsoft Entra cost per user?

Microsoft Entra ID P1 lists at $7.00 per user per month and P2 at $10.00 per user per month, both paid yearly on an annual commitment. The Microsoft Entra Suite lists at $12.00 per user per month and is an add-on, not a replacement: Microsoft requires a Microsoft Entra ID P1 subscription, or a package that includes P1, alongside it. Individually, Entra ID Governance is $7.00, Entra Internet Access is $5.00 and Entra Private Access is $5.00 per user per month. Entra ID Free is included with Microsoft cloud subscriptions. The catch is that for Microsoft 365 customers much of P1 or P2 is already bundled into E3 and E5, so the marginal cost is often far below list.

Is Entra included in Microsoft 365?

Partly, and this is the key to Entra economics. Microsoft 365 E3 includes Entra ID P1 (conditional access, basic identity protection), and Microsoft 365 E5 includes Entra ID P2 (risk-based access, Privileged Identity Management, identity protection). If you already license E3 or E5 for productivity, you are already paying for that identity capability, so the marginal cost of the identity pillar is close to zero. The standalone P1 and P2 prices apply when you want Entra without the corresponding M365 suite, or want to top up from P1 to P2.

What is the Microsoft Entra Suite?

The Entra Suite lists at $12.00 per user per month, billed yearly, and combines five products: Entra Private Access (Microsoft's ZTNA for private apps), Entra Internet Access (a secure web gateway / SSE component), Entra ID Governance, Entra ID Protection and the premium capabilities of Entra Verified ID, including Face Check. It does not include Entra ID P1: Microsoft requires a P1 subscription, or a package that includes P1 such as Microsoft 365 E3 or Business Premium, as a prerequisite. Microsoft also notes special Suite pricing for Entra ID P2 and Microsoft 365 E5 customers, and Microsoft 365 E7 includes the Suite. It is Microsoft's answer to standalone SSE vendors like Zscaler: rather than buying ZTNA and SWG separately, a Microsoft-centric estate can extend its existing identity into the network pillar through one bundle.

Is Entra cheaper than Okta or Zscaler for zero trust?

For a Microsoft-centric estate, usually yes. Because P1 is bundled into M365 E3 and Business Premium, and P2 into E5, an organisation already licensing those suites pays only the $12 Entra Suite to add ZTNA and SWG at Microsoft's list prices. Okta's published Essentials suite alone is $17 per user per month before any network product. Without an M365 suite, the Entra path is the $7 P1 prerequisite plus the $12 Suite, $19 per user per month at list. The trade-off is concentration: you are deepening dependence on one vendor. Best-of-breed estates that deliberately avoid single-vendor lock-in pay the premium for Okta and a dedicated SSE platform on purpose.

Does Entra cover the whole zero trust network pillar?

Increasingly, but not entirely. Entra Private Access provides ZTNA for private applications and Entra Internet Access provides secure web gateway capabilities, which together cover much of the network pillar for a Microsoft estate. Mature or high-throughput environments may still want a dedicated SSE platform (Zscaler, Netskope, Palo Alto Prisma) for advanced inspection, global POP coverage and deep CASB. For most mid-market Microsoft shops, the Entra Suite plus Defender covers the practical requirement.

Microsoft, Microsoft Entra, Entra ID and Microsoft 365 are trademarks of the Microsoft group of companies. ZeroTrustCost.com is an independent pricing reference and is not affiliated with, authorised by, sponsored by, or endorsed by any vendor named on this page. Product and company names are used for identification, commentary and price comparison only (nominative fair use).

Sources

Microsoft, official Entra pricing page (Entra ID P1 $7, P2 $10, Suite $12 with P1 required, Governance $7, Internet Access $5, Private Access $5, per user/month paid yearly). https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing
Microsoft Learn, Microsoft Entra licensing (Suite contents and P1 prerequisite; P1 in M365 E3 and Business Premium, P2 in M365 E5). https://learn.microsoft.com/en-us/entra/fundamentals/licensing
Okta, Workforce Identity pricing (Essentials $17 per user/month, billed annually). https://www.okta.com/pricing/
Microsoft 365 enterprise plans (E3 includes Entra ID P1; E5 includes Entra ID P2). https://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft365-plans-and-pricing

All Entra figures from Microsoft's official pricing page, per user per month paid yearly. Checked October 2026. Prices change with region, agreement type and Microsoft's periodic revisions.