Microsoft Entra ID (Azure AD) features and licenses

Reading Time: 2 minutes

Azure AD is becoming Microsoft Entra ID. Azure AD P1 and Azure AD P2 licenses are becoming Microsoft Entra ID P1 and P2. This is only a name change.

Below is a list of Microsoft Entra ID (previously known as Azure AD) services and the required licenses. I created this list as a way to memorise the features and licenses required for exam purposes. I trust that the list will be of use to you.

IMPORTANT NOTE: The below list does not include 365 licenses. You may already be licensed for certain features listed below via your 365 license agreement. Please check the relevant Microsoft articles or contact your licensing department or account manager to ensure your organisation is licensed accordingly.

A useful site for understanding licenses is M365 Maps. This is not an official Microsoft website, a personal recommendation only.

The below list was correct at the time of writing this post. Please comment below if you have any feedback. I’ll continue to update the list when required.

ServiceLicense required
Dynamic GroupsMicrosoft Entra ID P1 or P2
Company Branding Microsoft Entra ID P1 or P2
Administrative UnitsMicrosoft Entra ID P1 or P2
Password WritebackMicrosoft Entra ID P1 or P2
Self Service Password Reset (SSPR)Cloud-only user password change: FREE
When a user in Entra ID knows their password and wants to change it to something new.

Cloud-only user password reset: P1 or P2
When a user in Entra ID has forgotten their password and needs to reset it.

Hybrid user password change & writeback: P1 or P2
Privileged Identity Management (PIM)Microsoft Entra ID P2
Conditional AccessMicrosoft Entra ID P1 or P2
Identity ProtectionMicrosoft Entra ID P2
Microsoft Entra ID custom rolesMicrosoft Entra ID P1 or P2
Microsoft Entra ID Connect HealthMicrosoft Entra ID P1 or P2
Device Write BackMicrosoft Entra ID P1 or P2
Password ProtectionCloud only users with global banned password list : Free

Cloud only users with custom banned password list: P1/P2

On-prem synced users with global and custom banned list) P1/P2
Smart LockoutDefault version: Free

If you wish to customise smart lock out configuration: P1/P2
Custom Security AttributesMicrosoft Entra ID P1 or P2
Group-based licensingMicrosoft Entra ID P1 or P2