I've always believed that when you buy Entra ID P1 or P2 licenses, the rule is that you need enough licenses for all active users in your tenant. I know that with Microsoft 365, if you buy just one license, the entire tenant gets upgraded to either P1 or P2, unlocking those features, but supposedly this could violate Microsoft's licensing policies.
Recently, I got an email from Microsoft about a new Conditional Access policy regarding multifactor authentication and risky sign-ins. They mentioned, 'We'll assign only eligible active users with MFA to the security group, and ensure the total users added don't exceed Entra ID P2 licenses for compliance.' This raises some questions for me—what exactly makes an active user 'eligible'? Could there be users who won't get this policy even if P2 is needed? Is this a sign that mixing P1 and P2 licenses, or even having users without these licenses, is acceptable now? Am I overthinking this, or is Microsoft hinting at a licensing change?
1 Answer
You actually can create a dynamic group for just P2 users. This way, you apply policies with P2 features only to that group, which keeps everything compliant with licensing rules.
Yeah, but I've heard you still need all active users to have the same Entra ID license type. Maybe Microsoft changed things, allowing for some mix-and-match?