Entra ID P1 plus identity protection (risk-based access) and privileged identity management — the top identity tier.
Included products
Derived from the service plans Microsoft provisions with this SKU — Microsoft publishes no product-in-bundle mapping.
Included in
Derived from the service plans Microsoft provisions with each SKU — Microsoft publishes no product-in-bundle mapping.
Commercial
- Enterprise Mobility + Security E5
- Microsoft 365 E5 +10 variants
- Microsoft 365 E5 Developer (without Windows and Audio Conferencing)
- Microsoft 365 E5 Security
- Microsoft 365 E7
- Microsoft 365 F5 Security + Compliance Add-on
- Microsoft 365 F5 Security Add-on
GCC
Education
What's included
Curated capability groupings first, then every remaining service plan Microsoft provisions with this SKU — together they're the complete list, nothing is hidden.
| Identity |
|---|
| Conditional Access Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back. Enforce sign-in rules (require MFA, block legacy auth, require a compliant device, restrict by location) based on user, app, and risk signals. |
| Risk-Based Conditional Access / Identity Protection Adds Identity Protection risk-based Conditional Access and Privileged Identity Management on top of Entra ID P1. Automatically detect and respond to compromised credentials and risky sign-ins, and build Conditional Access policies that key off Microsoft’s calculated user/sign-in risk score. |
| Multi-Factor Authentication Requires a second sign-in verification step (phone call, SMS, or app notification) in addition to a password. |
| Self-Service Password Reset With on-premises writeback (Entra ID P1) Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back. Let users reset or unlock their own account without a help desk call. Basic cloud-only SSPR is available broadly; on-premises writeback (syncing the reset back to Active Directory) requires Entra ID P1. |
| Privileged Identity Management Adds Identity Protection risk-based Conditional Access and Privileged Identity Management on top of Entra ID P1. Grant admin roles just-in-time (time-bound, approval-gated activation) instead of standing access, with full activation audit history. A core Entra ID P2 entitlement, also obtainable via the standalone Entra ID Governance add-on. |
| Access Reviews Adds Identity Protection risk-based Conditional Access and Privileged Identity Management on top of Entra ID P1. Periodically require an owner or the user themselves to re-certify continued need for group membership, app access, or a role assignment — access that’s no longer needed gets removed automatically. |
| Entitlement Management Adds Identity Protection risk-based Conditional Access and Privileged Identity Management on top of Entra ID P1. Bundle groups, apps, and SharePoint sites into a requestable "access package" with approval workflow and automatic expiration — including for external/guest users. |
| Other service plans |
| Exchange Foundation The baseline Exchange Online mailbox service included in most Microsoft 365 plans — hosted email, calendar, and contacts. |
| Microsoft Defender for Cloud Apps Discovery Discovers which cloud apps are actually being used in the organization, without the full Defender for Cloud Apps control capabilities. |
Conditional Access
Risk-Based Conditional Access / Identity Protection
Multi-Factor Authentication
Privileged Identity Management
Access Reviews