Conditional access, self-service password reset, and group-based access management — the entry paid identity tier, standalone or bundled into several Microsoft 365 plans.
Included in
Derived from the service plans Microsoft provisions with each SKU — Microsoft publishes no product-in-bundle mapping.
Commercial
- Enterprise Mobility + Security E3
- Enterprise Mobility + Security E5
- Microsoft 365 Business Premium +3 variants
- Microsoft 365 E3 +6 variants
- Microsoft 365 E5 +10 variants
- Microsoft 365 E5 Developer (without Windows and Audio Conferencing)
- Microsoft 365 E7
- Microsoft 365 F1 (M365_F1) +1 variant
- Microsoft 365 F3 +1 variant
- Microsoft Entra ID P2
- Microsoft 365 F1 (M365_F1_COMM)
GCC
- Enterprise Mobility + Security G3 GCC
- Enterprise Mobility + Security G5 GCC
- Microsoft 365 F3 GCC
- Microsoft 365 G3 - Unattended License for GCC
- Microsoft 365 G3 GCC
- Microsoft 365 GCC G5
- Microsoft 365 GCC G5 w/o WDATP/CAS Unified
Education
- Enterprise Mobility + Security A3 for Faculty
- Microsoft 365 A3 - Unattended License for students use benefit
- Microsoft 365 A3 for Faculty
- Microsoft 365 A3 for Students
- Microsoft 365 A3 for students use benefit
- Microsoft 365 A5 for faculty
- Microsoft 365 A5 for Students
- Microsoft 365 A5 for students use benefit
- Microsoft 365 A5 without Audio Conferencing for students use benefit
- Microsoft Entra ID P1 for Faculty
Partially included in
Commercial
- Microsoft Azure Multi-Factor Authentication 1 of 2 plans
- Microsoft Teams Rooms Pro 1 of 2 plans +1 variant
- Microsoft Teams Rooms Standard 1 of 2 plans
- Microsoft Teams Rooms Standard without Audio Conferencing without Audio Conferencing not included
- Microsoft Teams Shared Devices 1 of 2 plans
GCC
- Microsoft Teams Rooms Pro for GCC 1 of 2 plans
- Microsoft Teams Rooms Standard for GCC 1 of 2 plans
- Microsoft Teams Rooms Standard for GCC without Audio Conferencing 1 of 2 plans
- Microsoft Teams Shared Devices for GCC 1 of 2 plans
Education
- Microsoft Teams Rooms Pro for EDU 1 of 2 plans
- Microsoft Teams Shared Devices for Faculty 1 of 2 plans
What's included
Curated capability groupings first, then every remaining service plan Microsoft provisions with this SKU — together they're the complete list, nothing is hidden.
| Identity |
|---|
| Conditional Access Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back. Enforce sign-in rules (require MFA, block legacy auth, require a compliant device, restrict by location) based on user, app, and risk signals. |
| Multi-Factor Authentication Requires a second sign-in verification step (phone call, SMS, or app notification) in addition to a password. |
| Self-Service Password Reset With on-premises writeback (Entra ID P1) Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back. Let users reset or unlock their own account without a help desk call. Basic cloud-only SSPR is available broadly; on-premises writeback (syncing the reset back to Active Directory) requires Entra ID P1. |
| Other service plans |
| Exchange Foundation The baseline Exchange Online mailbox service included in most Microsoft 365 plans — hosted email, calendar, and contacts. |
| Microsoft Defender for Cloud Apps Discovery Discovers which cloud apps are actually being used in the organization, without the full Defender for Cloud Apps control capabilities. |
Conditional Access
Multi-Factor Authentication