Entra ID Licensing specifics for Conditional Access

Question

I understand that Conditional Access requires a minimum Entra ID P1 license.

What I need to know is whether the license that grants the rights to leverage Conditional Access is granted "per user" or "per account". And I need to know where specifically this is stipulated in Microsoft Documentation.

There's a lot of confusion in my circles regarding this. Some are saying a user that swaps between two accounts on the same Tenant (Like a standard and a privileged account) only requires one Entra ID license because it is "per user" and not "per account.

I of course cannot convince anyone to make their licensing compliant (entails cost) if this isn't clearly and officially stated somewhere.

Can anyone clarify?

Answer 1

Microsoft Entra ID licensing, including Entra ID P1 for Conditional Access, is assigned per user object (that is, per identity/account that signs in), not per human person. Microsoft’s official position is that “each user that benefits from a feature must be licensed,” which effectively means every account that is in scope of Conditional Access policies or that authenticates under those protections must have the appropriate license assigned. If a single human operates two separate Entra ID user accounts, Microsoft treats those as two licensed users when both accounts are enabled for or benefit from Conditional Access.

Likely the clearest official statement is in Microsoft’s product terms and licensing guidance rather than in the Conditional Access feature page itself. The Microsoft Entra ID Licensing documentation states that licenses are assigned to users and that licenses are required for all users that use or benefit from the service. You should be able to find this wording in Microsoft Learn under the Entra ID licensing fundamentals and in the general Microsoft Online Service Terms/Product Terms. The practical interpretation used by Microsoft auditors and licensing specialists is that privileged accounts, break-glass accounts (if excluded they may not require licensing), and secondary admin accounts must be individually licensed if they are covered by Conditional Access or otherwise benefit from Entra ID P1 features.

Relevant official documentation you can cite includes https://learn.microsoft.com/entra/fundamentals/licensing which explains that Entra ID licenses are assigned per user and required for users who benefit from features, and https://learn.microsoft.com/entra/identity/conditional-access/overview which states that using Conditional Access requires Entra ID P1 licenses for users targeted by policies. The broader licensing rule is also reiterated in Microsoft’s Product Terms at https://www.microsoft.com/licensing/terms where Microsoft defines that online service licenses are assigned to user accounts and that any user accessing or benefiting from licensed functionality must have an appropriate license.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin