Entra licence tier that adds Privileged Identity Management, access reviews and Identity Protection.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Entra ID P2 in context, with comparison tables and the common traps.
Terms in this definition
- Licence
What entitles one particular user to the services a subscription offers. Each product licence is made up of several service plans (one per app or service), and before giving it to someone an admin has to record that user's usage location.
- Archive
Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.
- Privileged Identity Management
Capability in Microsoft Entra ID P2 that activates privileged roles just in time and for limited periods, with approval, justification and an audit trail.
- Access reviews
Microsoft Entra ID Governance capability that periodically asks reviewers or users themselves to confirm membership for guests, app users or groups, removing anyone who does not respond. PIM, by contrast, handles privileged roles.
- Entra ID Protection
Calculates sign-in risk and user risk and enforces the MFA registration policy; it comes with Entra ID P2.
Related terms
- AADSignInEventsBeta
An advanced hunting table holding both interactive and non-interactive Microsoft Entra sign-ins, available with Entra ID P2. From 19 October 2026 EntraIdSignInEvents takes over from it, and existing queries move across automatically.
- E5
Top-tier Microsoft 365 licensing bundle that includes Entra ID P2 together with ID Governance capabilities.
- EntraIdSignInEvents
Lets you query, in advanced hunting, sign-ins to Microsoft Entra, both interactive and non-interactive. From 19 October 2026 it supersedes AADSignInEventsBeta; using it requires an Entra ID P2 licence.
- Sign-in risk policy
A risk-based policy in ID Protection (Entra ID P2) that responds, for example by demanding MFA, to the likelihood that someone other than the owner is signing in. It does not turn on any authentication methods.