Microsoft Entra Suite vs. Entra ID P2: What Are You Actually Paying For?

I get asked whether clients already paying for Entra ID P2 through Microsoft 365 E5 need Entra Suite as well. My first question is what they expect it to do that their existing licenses and systems cannot.

If the requirement is Privileged Identity Management (PIM) and risk-based Conditional Access, P2 already covers it. The Suite becomes worth evaluating when there is additional work to do around access governance, private application access, or internet security. Buying it because the organization uses Microsoft is not much of a business case.

What are you adding to P2?

Entra Suite combines ID Protection, ID Governance, Private Access, Internet Access, and premium Verified ID capabilities. There is overlap with P2, so the useful comparison is the additional capability you will actually deploy.

P2 includes basic access reviews and entitlement management. Lifecycle Workflows require ID Governance or the Suite; HR-driven provisioning is already available with P1. If offboarding automation is the only gap, compare standalone Governance with the Suite rather than assuming the bundle is the next step.

For example, a department change should prompt a review of the access someone no longer needs. A workflow can help carry out that process, but it still needs reliable employment data and someone responsible for exceptions. I would resolve missing managers and inconsistent department values before automating access changes.

Supporting reference: Microsoft Entra ID Governance licensing fundamentals ↗

Global Secure Access is the part I would pilot

Private Access and Internet Access make up Global Secure Access. A client on a supported device acquires traffic that matches the forwarding configuration and sends it through Microsoft's service. For private applications, Windows Server connectors provide outbound connections from the network hosting the resources.

The Microsoft traffic profile is available with P1 or P2. Private Access and Internet Access need their own licenses or the Suite. Enabling the Microsoft profile does not mean you have deployed the full internet security service.

Private Access is a candidate for replacing VPN access to specific applications. Internet Access provides controls for supported internet and SaaS traffic. I would assess those separately: reaching an internal application and inspecting an internet connection are different tests.

Start with a pilot group, representative devices, and a small set of applications. Confirm allowed access works, denied access fails, and the expected traffic appears in the logs. Then test application dependencies, existing VPN clients, connector failure, and the rollback process. Keep the existing service available until those tests are complete.

Supporting reference: Global Secure Access traffic forwarding profiles ↗

Limitations that belong in the buying decision

I would check these constraints before committing to a replacement.

• Government cloud: Microsoft lists Global Secure Access as available in GCC, but unsupported in GCC High and DoD. Establish the tenant environment before proposing it as a replacement.
• DNS on Windows: Microsoft's client limitations include secure DNS and Group Policy NRPT rules. Existing name-resolution controls need review before a rollout.
• QUIC: Internet Access cannot tunnel QUIC on UDP 80/443 in the documented Windows and macOS scenarios. Microsoft's guidance describes disabling QUIC so applications fall back to HTTPS over TCP. Validate that fallback rather than assuming coverage.
• Platform coverage: Clients do not have identical capabilities. Check the supported traffic and restrictions for each operating system and forwarding method you intend to use.

For the pilot, I would keep a simple record of what was inspected, what bypassed the service, and why. If an application works only because its traffic bypasses inspection, record that as an exception. A successful connection alone tells us very little about whether the intended control was applied.

Supporting reference: Global Secure Access known limitations ↗

Verified ID needs a defined use case

Core Verified ID credential issuance and verification are available outside the Suite. Face Check is premium, available through the Suite or a separate paid option; the Suite is not the only way to buy it.

Face Check compares a live selfie with the photo in a verified credential. That can support an identity verification process, but it does not replace MFA. I would want a specific recovery or onboarding requirement, trusted issuers, and a fallback for users who cannot complete verification before treating it as a reason to buy the bundle.

The integration and support process matter as much as the feature. Who deals with a failed verification, and what evidence allows them to proceed? That decision should be agreed before the help desk is expected to use it.

Supporting reference: Use Face Check with Microsoft Entra Verified ID ↗

Price the work you will actually replace

Microsoft's published US price is $12 per user per month, paid yearly, with a qualifying P1 foundation required. It advertises special pricing for existing P2 and Microsoft 365 E5 customers. E5 includes P2, not the complete Suite; Microsoft's current Microsoft 365 E7 offering includes the Suite.

That makes a comparison of standalone P2 and Suite list prices misleading. Ask for a quote based on the licenses you already own and the users who need the additional services. Compare it with standalone Governance, Private Access, or Internet Access where one component would meet the requirement.

I would include implementation, connector infrastructure, support, overlapping contracts, and the effort needed to retire the existing service. A lower license quote does not create a saving if both platforms have to remain in production.

My recommendation: stay with P2 where it meets the requirement. Pilot the Suite where several additional capabilities solve identified problems. Make the purchase decision after you know what will work, who will operate it, and which existing costs can actually be removed.

Supporting reference: Microsoft Entra pricing and purchase prerequisites ↗