TOOL PROFILE · IDENTITY PROVIDER AND SUITE
Microsoft Entra: IAM jobs covered, pricing and limits
Short answer
Microsoft's identity family: Entra ID for sign-in and access policy, ID Governance for lifecycle and reviews, and Defender for Identity for detection. Its own pages document directory and SSO, lifecycle and IGA and threat detection and cover part of app coverage and privileged access. Every tier has a published per-user price, from Entra ID Free to Entra Suite at $12.00.
Which IAM jobs does Microsoft Entra cover?
Read the stack as a list
- J5 Identity threat detection and response: 5 documented, 1 partial
- J4 Privileged access: 2 documented, 7 partial
- J3 Application coverage and identity orchestration: 2 documented, 6 partial
- J2 Lifecycle and governance: 7 documented, 4 partial
- J1 Directory and single sign-on: 5 documented, 1 partial
| Job | Status | What its pages say |
|---|---|---|
| J1Directory and SSO | Documented | Entra ID Free includes MFA and SSO; the app gallery lists thousands of applications; Conditional Access comes with P1; phishing-resistant methods include passkeys and FIDO2 security keys. Source: Microsoft Entra pricing · Read 27 Sep 2026 · Source: Microsoft Learn: Entra application gallery · Read 27 Sep 2026 · Source: Microsoft Learn: Conditional Access overview · Read 27 Sep 2026 · Source: Microsoft Learn: Entra authentication methods · Read 27 Sep 2026 |
| J2Lifecycle and IGA | Documented | Entra ID Governance: lifecycle workflows before start, on status change and at leave, access reviews, entitlement management, and HR-driven provisioning from Workday and SAP SuccessFactors. Source: Microsoft Learn: Entra ID Governance overview · Read 27 Sep 2026 · Source: Microsoft Learn: HR-driven provisioning · Read 27 Sep 2026 Prerequisite: Requires Entra ID P1 or P2. |
| J3App coverage | Partial | Account discovery shows app users who do not match an Entra ID user. For apps without provisioning, the documented path is a CSV export, matching, an access review and an optional ServiceNow ticket. Source: Microsoft Learn: governing existing users in an application · Read 27 Sep 2026 · Source: Microsoft Learn: applications that do not support provisioning · Read 27 Sep 2026 |
| J4Privileged access | Partial | Privileged Identity Management (PIM) needs Microsoft Entra ID Governance or Entra ID P2 licences, per Microsoft's licensing page; feature detail is not in our sources. Source: Microsoft Learn: Entra ID Governance licensing fundamentals · Read 11 Oct 2026 |
| J5Threat detection | Documented | Defender for Identity detects identity-based attacks across on-premises Active Directory, Entra ID and other IAM such as Okta; ID Protection and risk-based Conditional Access come with P2. Source: Microsoft Learn: What is Microsoft Defender for Identity · Read 29 Sep 2026 · Source: Microsoft Entra pricing · Read 27 Sep 2026 |
How does Microsoft Entra fit in an IAM stack?
Microsoft Entra can fill three of the five jobs from one vendor: directory and sign-in with Entra ID, lifecycle and reviews with ID Governance, and detection with Defender for Identity and ID Protection. P1 is included in Microsoft 365 E3 and Business Premium and P2 in Microsoft 365 E5, so many organizations already own part of it.
Suits: Organizations on Microsoft 365 that want governance and detection from the same vendor.
What does it cost and how is it deployed?
- Pricing
- Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
Source: Microsoft Entra pricing · Read 27 Sep 2026 · Source: Microsoft Learn: What is Microsoft Defender for Identity · Read 29 Sep 2026 · Source: Microsoft Learn: Defender for Identity sensor prerequisites · Read 11 Oct 2026
- Deployment
- Microsoft cloud service; on-premises apps provisioned through the ECMA connector host; Defender for Identity uses sensors on identity infrastructure.
Source: Microsoft Learn: application provisioning · Read 27 Sep 2026 · Source: Microsoft Learn: What is Microsoft Defender for Identity · Read 29 Sep 2026
- Integrations
- Thousands of gallery applications; provisioning by SCIM 2.0, LDAP, SQL, REST, SOAP, PowerShell and ECMA connectors.
Source: Microsoft Learn: Entra application gallery · Read 27 Sep 2026 · Source: Microsoft Learn: application provisioning · Read 27 Sep 2026
- Certifications
- Not covered in our sources
Where is Microsoft Entra strong?
- Published per-user prices for every tier.
Source: Microsoft Entra pricing · Read 27 Sep 2026
- Directory, governance and detection from one vendor.
Source: Microsoft Learn: Entra ID Governance overview · Read 27 Sep 2026 · Source: Microsoft Learn: What is Microsoft Defender for Identity · Read 29 Sep 2026
- Account discovery for app users who match no Entra ID user.
Source: Microsoft Learn: governing existing users in an application · Read 27 Sep 2026
What are its limits?
- ID Governance requires Entra ID P1 or P2.
Source: Microsoft Entra pricing · Read 27 Sep 2026
- Apps without provisioning rely on a documented manual path (CSV export and matching).
Source: Microsoft Learn: applications that do not support provisioning · Read 27 Sep 2026
- Privileged Identity Management needs Entra ID P2 or ID Governance licences, and its feature detail is not in our sources.
Source: Microsoft Learn: Entra ID Governance licensing fundamentals · Read 11 Oct 2026
What has Microsoft Entra announced recently?
2026-06-24
Microsoft's documentation, in a page dated 24 June 2026, describes Entra Agent ID as generally available for all Microsoft Entra customers, with extended security features requiring Microsoft Agent 365.
Source: Microsoft Learn: Entra Agent ID for AI agents · Read 27 Sep 2026
April 2026
Microsoft's what's new page lists Account Discovery as generally available in April 2026, giving visibility into accounts in connected apps, including orphan accounts.
Source: Microsoft Learn: What's new in Microsoft Entra · Read 27 Sep 2026
Which head-to-heads include Microsoft Entra?
Frequently asked questions
What does Microsoft Entra do in an IAM stack?
Microsoft's identity family: Entra ID for sign-in and access policy, ID Governance for lifecycle and reviews, and Defender for Identity for detection. Its pages document directory and SSO, lifecycle and IGA and threat detection.
Does Microsoft Entra publish pricing?
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
What does Microsoft Entra not cover?
Microsoft Entra's pages describe all five jobs in some form. ID Governance requires Entra ID P1 or P2.
Read next