Conditional Access Policies for Users with Business Basic and Standard Licenses

Question

Dear Microsoft Community,

We have a tenant with the following licenses:

• 100 Business Premium
• 200 Business Basic
• 200 Business Standard

Recently, some user accounts were compromised. To enhance security for privileged users, we have assigned Business Premium licenses to them, while others have Business Basic or Business Standard licenses.

We are considering implementing Conditional Access policies to strengthen security across our tenant. However, we would like to confirm whether these policies will function for users who only have Business Basic and Business Standard licenses, given that they do not include Azure AD Premium P1 or P2.

Could you please clarify if Conditional Access policies can be applied in this scenario, or if P1/P2 licenses are mandatory for enforcement?

Looking forward to your guidance.

Answer 1

Dear Vinay Shivakoti**,**

Good day! Thank you for reaching out to Microsoft community.

As per your description, it seems like that you are managing a Microsoft 365 tenant with Business Premium, Business Basic, and Business Standard licenses. Due to recent security breaches, you want to enhance security using Conditional Access policies but are unsure if these policies will work for users who have Business Basic and Business Standard licenses since these do not include Azure AD Premium P1/P2 features. You are looking for confirmation on whether Conditional Access will function for these users or if an additional license is required.

According to the Microsoft article, to implement Conditional Access policies, it's essential to understand the licensing requirements. Conditional Access policies require Azure AD Premium P1 or P2 licenses. This means that users with only Business Basic or Business Standard licenses, which do not include Azure AD Premium P1 or P2, will not be able to utilize Conditional Access policies.

• For your reference: Microsoft Entra Plans and Pricing | Microsoft Security.

On the other hand, for Microsoft 365 Business Premium which includes Microsoft Entra ID P1 can use the same Conditional Access features noted in the following sections to provide multifactor authentication to users.

• For your reference: Microsoft Entra multifactor authentication versions and consumption plans - Microsoft Entra ID | Microsoft Learn.
• 

Business Basic and Standard users can use Security Defaults, but Conditional Access policies require P1/P2 licenses.

If you want to enforce Conditional Access policies for all users, you will need to ensure that every user affected by these policies has an Azure AD Premium P1 or P2 license.

I hope this helps. Let me know if you have any further questions or concerns.

If you think that I have provided the necessary information related to this post and it's Helpful, you can also vote for this thread. In order to make this thread a top content and help any other community users who might be facing a similar scenario to easily find this thread/post.

Thanks for choosing the MS community and have a great day ahead!!

Sincerely

S M Nazmun Nur | Microsoft Community Moderator

Answer 2

DearVinay Shivakoti,

Good day to you and hope you are doing well. 

We haven't heard back from you, so wanted to quick check, have you checked my response?

If you think that I have provided the necessary information related to this post and it's Helpful, you can also vote for this thread.

In order to make this thread a top content and help any other community users who might be facing a similar scenario to easily find this thread/post.

Feel free if you need further assistance, we will be happy to assist you further. 

Thank you for your time and cooperation.

Sincerely

S M Nazmun Nur | Community Moderator

Answer 3

I believe a single licence is required to enable the feature at the tenant level and it's an honesty model. This type of model allows you to protect multiple accounts where one user might have two logins: ie, a standard and an admin user account, where you are correctly licenced for the amount of users, even if they have multiple accounts.

You should correctly licence the number of users who are protected against those features. Ideally, you should have a group which identifies all licenced users (or where the licence is applied to the group for example) and the conditional access policy should be set to only include this group. Microsoft may audit the usage against licence users.

Additionally, some research may be disabled. For P2 for instance, you may notice a sign-in was blocked because of a risky sign-in, but you may not be able to investigate further as to why, against a licenced user.

Answer 4

Dear Nazmun,

I have a similar question but in a slightly different scenario.

In my organization, we use Microsoft Business Suite, including Business Basic, Standard, and Premium.

As Microsoft states, to use Conditional Access, an Entra ID Plan 1 or Plan 2 is required.

However, when I set up a Conditional Access Policy to block access from untrusted network locations to all M365 resources for all users,

I noticed that Business Basic and Standard users are effected that conditional access policies .

They do not have Entra ID Plan 1 or Plan 2. These users only have Entra ID Free.

My questions are:

1. Why are these Basic and Standard users also being blocked from accessing M365 (All Resources) by the Conditional Access policy?
2. Do Business Basic and Standard users need Entra ID Plan 1 for future Conditional Access policies to be applied?

Thank you for your insights.