Vendor pricing

Microsoft Entra pricing 2026: P1, P2, Suite and the M365 bundle math

Name: Microsoft Entra
Brand: Microsoft
Availability: InStock

For Microsoft-centric organisations, Entra is usually the cheapest route into the identity pillar, because much of it is already bundled into M365 E3 and E5. This page lists Entra's per-user prices, explains what your productivity licence already covers, and shows when the Entra Suite makes a dedicated SSE platform unnecessary. Figures dated June 2026 with sources at the foot of the page.

List pricing

Entra per-user prices

Microsoft publishes Entra list pricing openly, per user per month, billed yearly. The headline figures below are list; M365 bundling usually lowers the marginal cost.

Product	Per user / month	What it adds
Entra ID Free	$0	Included with Microsoft cloud subscriptions. Basic SSO, MFA, user management.
Entra ID P1	$6.00	Conditional access, self-service password reset, basic identity protection. Included in M365 E3.
Entra ID P2	$9.00	Risk-based conditional access, Privileged Identity Management, identity protection. Included in M365 E5.
Entra ID Governance	$7.00	Entitlement management, access reviews, lifecycle workflows.
Entra Internet Access	$5.00	Secure web gateway / SSE component for the network pillar.
Entra Private Access	$5.00	Microsoft's ZTNA for private applications.
Entra Suite	$12.00	Bundle: P2 + Internet Access + Private Access + ID Governance + Verified ID.

Source: Microsoft official Entra pricing page, per user per month billed yearly, June 2026.

The strategic question

Entra Suite versus a dedicated SSE platform

The Entra Suite at $12 per user per month extends identity into the network pillar. For many Microsoft shops, that removes the need for a separate Zscaler or Netskope contract.

Approach	Indicative per user / month	Covers	Trade-off
Entra Suite (Microsoft-native)	$12	Identity + ZTNA + SWG + governance, one vendor	Deepens single-vendor concentration
Okta + dedicated SSE	$17 + $8-12 = $25-29	Best-of-breed identity + best-of-breed network	Higher cost, deliberate vendor neutrality

Okta and Zscaler/SSE figures from our Okta and Zscaler pages. Illustrative stack comparison, not a like-for-like feature match.

The catch

Where Microsoft-native still falls short

The bundle is strong, but it is not a complete substitute for a dedicated SSE platform in every estate.

Throughput and inspection depth. High-traffic environments needing full SSL inspection everywhere, advanced sandboxing and a large global POP footprint may still want a dedicated SSE platform alongside Entra.

Concentration risk. Putting identity, ZTNA, SWG, endpoint (Defender) and email security all with one vendor concentrates both cost leverage and outage exposure. Some organisations split deliberately for resilience and negotiating position.

Licensing complexity. Microsoft's overlapping SKUs (M365 suites, standalone Entra, Defender plans, add-ons) make it easy to double-pay for capability you already own. Audit existing entitlements before buying Entra add-ons.

Alternatives

Compare before you commit

Price the Microsoft-native path against best-of-breed identity and network.

Okta pricing

Best-of-breed identity alternative

Zscaler pricing

Dedicated SSE platform

Identity pillar cost

Full identity-layer TCO

SSE bundle cost

Network-pillar bundle economics

Small business cost

The Microsoft-first SMB path

Full vendor comparison

Side-by-side across the market

Frequently asked

Microsoft Entra pricing questions

How much does Microsoft Entra cost per user?

Microsoft Entra ID P1 lists at $6.00 per user per month and P2 at $9.00 per user per month, both billed yearly. The Microsoft Entra Suite, which bundles P2 with Internet Access, Private Access, ID Governance and Verified ID, lists at $12.00 per user per month. Individually, Entra ID Governance is $7.00, Entra Internet Access is $5.00 and Entra Private Access is $5.00 per user per month. Entra ID Free is included with Microsoft cloud subscriptions. The catch is that for Microsoft 365 customers much of P1 or P2 is already bundled into E3 and E5, so the marginal cost is often far below list.

Is Entra included in Microsoft 365?

Partly, and this is the key to Entra economics. Microsoft 365 E3 includes Entra ID P1 (conditional access, basic identity protection), and Microsoft 365 E5 includes Entra ID P2 (risk-based access, Privileged Identity Management, identity protection). If you already license E3 or E5 for productivity, you are already paying for that identity capability, so the marginal cost of the identity pillar is close to zero. The standalone P1 and P2 prices apply when you want Entra without the corresponding M365 suite, or want to top up from P1 to P2.

What is the Microsoft Entra Suite?

The Entra Suite, launched as Microsoft's packaged zero trust identity bundle, lists at $12.00 per user per month and combines Entra ID P2 with Entra Internet Access (a secure web gateway / SSE component), Entra Private Access (Microsoft's ZTNA for private apps), Entra ID Governance and Entra Verified ID. It is Microsoft's answer to standalone SSE vendors like Zscaler: rather than buying ZTNA and SWG separately, a Microsoft-centric estate can extend its existing identity into the network pillar through one bundle.

Is Entra cheaper than Okta or Zscaler for zero trust?

For a Microsoft-centric estate, usually yes. Because identity (P1 or P2) is bundled into M365 E3 and E5, and because the Entra Suite extends into the network pillar at $12 per user per month, an organisation already committed to Microsoft can cover identity plus ZTNA plus SWG for less than buying Okta for identity and Zscaler for network separately. The trade-off is concentration: you are deepening dependence on one vendor. Best-of-breed estates that deliberately avoid single-vendor lock-in pay the premium for Okta and a dedicated SSE platform on purpose.

Does Entra cover the whole zero trust network pillar?

Increasingly, but not entirely. Entra Private Access provides ZTNA for private applications and Entra Internet Access provides secure web gateway capabilities, which together cover much of the network pillar for a Microsoft estate. Mature or high-throughput environments may still want a dedicated SSE platform (Zscaler, Netskope, Palo Alto Prisma) for advanced inspection, global POP coverage and deep CASB. For most mid-market Microsoft shops, the Entra Suite plus Defender covers the practical requirement.

Microsoft, Microsoft Entra, Entra ID and Microsoft 365 are trademarks of the Microsoft group of companies. ZeroTrustCost.com is an independent pricing reference and is not affiliated with, authorised by, sponsored by, or endorsed by any vendor named on this page. Product and company names are used for identification, commentary and price comparison only (nominative fair use).

Sources

Microsoft, official Entra pricing page (Entra ID P1 $6, P2 $9, Suite $12, Governance $7, Internet Access $5, Private Access $5, per user/month billed yearly). https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing
Microsoft 365 enterprise plans (E3 includes Entra ID P1; E5 includes Entra ID P2). https://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft365-plans-and-pricing

All Entra figures from Microsoft's official pricing page, per user per month billed yearly. Accessed and verified June 2026. Prices change with region, agreement type and Microsoft's periodic revisions.