We're a small company with fewer than 20 users and currently have around five AIP P1 licenses. Our main environment is Microsoft 365 Business Premium with Intune, without any unusual add-ons. We've been told that AIP P1 is retiring and that these licenses should be replaced with Entra ID P1, but the quoted price is much higher: £18.48 per user annually for AIP P1 versus £658.40 for Entra ID P1.
The affected accounts include a few administrator accounts with no other packages, two non-executive directors who only have Exchange Online Plan 1, and an external contractor with Exchange Online Plan 1, SharePoint Plan 1, and Teams Essentials. These accounts are fairly restricted. We do use Conditional Access policies for contractors and guests, and I'm trying to understand which users must be licensed for Entra ID P1. Are the administrator accounts required to have it, and do the other restricted users need it as well? Is there a safer or more cost-effective licensing approach, or should every affected account simply receive Entra ID P1?
3 Answers
Business Premium already includes Entra ID P1, so users who are properly licensed with Business Premium generally don’t need a separate P1 license. For accounts without Business Premium, the key question is whether they’re using P1 features such as Conditional Access. If a Conditional Access policy applies to those users, they should generally have the appropriate Entra ID P1 entitlement. Guest licensing has separate rules, so check the current Microsoft terms rather than assuming every guest needs a full user license.
The quoted £658.40 per user per year sounds wrong for standalone Entra ID P1. It’s normally priced far below that, although regional pricing, annual commitments, reseller markups, or a different product SKU could explain the discrepancy. Ask the supplier for the exact Microsoft SKU and a line-item quote before making any licensing decision. Don’t replace the licenses based only on that headline figure.
The supplier gave us that figure, so I’m going back to them to confirm which SKU and pricing model they’re quoting.
Admin accounts that actively use Entra ID P1 features should be licensed, even if licensing enforcement isn’t immediate. Business Premium users are covered automatically; for non-Business-Premium accounts, license the accounts that are actually targeted by Conditional Access or other P1 functionality. If an account only needs basic MFA, there may be simpler options depending on your setup, but that doesn’t automatically cover broader Conditional Access requirements.
We do have Conditional Access policies covering both contractors and guests, so those accounts are the main concern.