Microsoft Entra ID
live verifiedMicrosoft · Per-user, annual commitment. Free tier covers basic SSO; paid tiers add MFA, conditional access, governance.
Most companies already pay for Entra ID without realising — P1 is included with M365 E3 and with M365 Business Premium, and E5 includes P2. Business Premium matters for smaller buyers: it is the cheap route to P1 and is easy to miss if you only compare against E3. Calculate the marginal cost of upgrading from Free to P1 / P2 only if you are not already on one of those M365 plans.
1.Year-1 TCO breakdown
Representative buyer: 200 employees, 30 SaaS apps, full SAML + MFA + lifecycle automation, 90-day audit retention.
2.The hidden cost category for this IdP
The M365 bundling math is the entire hidden cost story. Most companies are paying for Entra ID without realising — M365 E3 and M365 Business Premium both include Entra ID P1, and M365 E5 includes P2. The decision isn't 'should I pay for Entra' but 'do I need to move M365 plan'. For a 200-employee buyer already on E3 or Business Premium, the marginal cost of full Entra ID P1 is $0. For a buyer on M365 Business Standard the usual advice is to jump to E3, but Business Premium is the cheaper route to the same P1 entitlement and is the one most often missed — price both before assuming an E3 upgrade. The two genuine gotchas above P1: Entra Suite at $12 requires a P1 subscription underneath rather than replacing it, and the $7 ID Governance add-on is sold only to existing P1 or P2 customers, so neither is a standalone purchase.
3.Migration cost out of Microsoft Entra ID
Migrating off Entra is rare because most companies are locked into M365 for reasons that have nothing to do with identity. When it does happen — usually a merger forcing standardisation, or a security event — the distinctive cost is that Conditional Access policies have no one-to-one equivalent anywhere else. They encode device state, risk signals and location in a model other IdPs express differently, so they are re-authored from intent rather than translated. SCIM provisioning into Microsoft-catalogue apps also has to be rebuilt. Scope by counting Conditional Access policies and Microsoft-native app integrations, not total app count.
4.The negotiation lever
M365 contract negotiation, not Entra. Entra is barely negotiable as a standalone product — it is a line inside the Microsoft agreement, and the real lever is the plan mix. Two concrete moves: check whether Business Premium gets the seats that need P1 there instead of paying the E3 delta, and split the estate so only the users who need P2 carry P2 rather than uplifting everyone. Microsoft publishes no public discount schedule, and leverage tracks total commit — small buyers should expect to compete on plan selection rather than on price.
5.Vendor tier reference
| Tier | Per-user (USD/mo) | Features |
|---|---|---|
| Free | $0 | SSO to SaaS apps included with any Microsoft 365 subscription |
| P1 | $7 | Conditional access, MFA, SSO to on-prem apps |
| P2 | $10 | Identity Protection, Privileged Identity Management |
| Suite | $12 | Identity Governance + Verified ID + Internet Access. Requires a P1 subscription (or a package including P1) underneath — not standalone |
| ID Governance (add-on) | $7 | Governance add-on, available to P1 and P2 customers only — cannot be bought on its own |