Entra ID Free vs P1 vs P2

Every Microsoft 365 subscription includes Entra ID Free automatically. P1 and P2 are paid add on tiers that unlock additional identity management and security features. This article summarizes the key differences.

Entra ID Free (included with every tenant)

• User and group management
• Basic authentication and authorization
• Single sign on for cloud applications
• Entra ID join for devices (join works, but device management does not)
• Self service password change for cloud users (change only, not reset)
• Basic security reports
• Security Defaults, a tenant wide toggle that enforces MFA for all users and blocks legacy authentication (all or nothing, cannot be targeted to specific users or conditions)

Entra ID P1 adds

• Conditional Access (the biggest reason most organizations upgrade from Free). This lets you build targeted policies based on user, group, location, device, or app, rather than the all or nothing Security Defaults toggle
• Dynamic groups (automatic group membership based on user or device attributes)
• Hybrid identity features, including password writeback for on premises AD environments
• Self service password reset for cloud users (Free only allows password change, not full reset)
• Automatic MDM enrollment tied to Entra ID join (device management, not just device join)
• Advanced usage and sign in reports

Entra ID P2 adds (on top of everything in P1)

• Identity Protection: risk based sign in detection and automated policies that can block, challenge, or allow access based on real time risk signals
• Privileged Identity Management (PIM): just in time elevation for admin roles instead of standing admin permissions
• Access Reviews: scheduled reviews to confirm users still need the access they have

Everything else (Conditional Access, MFA, SSPR, hybrid sync, dynamic groups) is available in P1. P2 is really about the governance and risk layer on top of P1's enforcement layer.

Practical notes

• Microsoft 365 Business Premium includes Entra ID P1 (not P2)
• Microsoft 365 E3 includes P1; Microsoft 365 E5 includes P2
• Signing into an Entra joined device does not require a P1 or P2 license. Basic authentication and sign in are covered under the Free tier for any user account in the tenant. What P1 and P2 gate is Conditional Access enforcement, automatic MDM enrollment on join, and the governance features listed above
• Assigning a P1 or P2 license to a user who was previously excluded from a Conditional Access policy (because the policy is scoped to a group that requires P1) can pull them into that policy's scope on their next sign in. If the policy requires MFA and the user has not registered a method yet, they will see an unexpected MFA registration prompt

Checking whether a computer is Entra ID joined or on premises AD joined (Command Prompt)

Run the following from Command Prompt, no admin rights needed:

dsregcmd /status

Look under the Device State section of the output:

• AzureAdJoined: YES and DomainJoined: NO means the device is Entra ID joined only (cloud native)
• DomainJoined: YES and AzureAdJoined: NO means the device is on premises AD joined only, not in Entra ID at all
• AzureAdJoined: YES and DomainJoined: YES means the device is hybrid joined (both)
• EnterpriseJoined: YES indicates an older MDM only join, less common now

To isolate just those lines instead of scrolling through the full output, run:

dsregcmd /status | findstr /i "AzureAdJoined DomainJoined EnterpriseJoined"

This returns the three key YES/NO values in one step.