Entra ID P1 covers 5 of 7 IAM controls; the other 2 cost US$3 more a user
The 2022 identity checklist mapped onto Microsoft Entra ID Free, P1 and P2 and their US$ list prices, with the log-retention gap CERT-In exposes. September 2026.
Five of the seven identity controls this piece recommended in 2022 come with Microsoft Entra ID P1, which lists at US$7 a user a month and is already inside Microsoft 365 E3 and Business Premium. The two it leaves out, managing privileged accounts and reviewing who has access, are in P2 at US$10.1 For most Indian companies on Microsoft 365, the question is no longer which practices to adopt. It is whether the people with the most access are worth US$3 a month more, and how to keep the logs CERT-In asks for.
01The 2022 checklist, priced by tier
The original list had eight items. One, “treat identity as the perimeter”, is a principle and costs nothing. The other seven are switches in a product. On Microsoft’s own pricing page, the free tier that comes with any Microsoft 365 subscription includes multi-factor authentication, single sign-on to SaaS applications and password self-service. P1 adds Conditional Access, which is how “verify every request” is actually enforced, and passwordless, phishing-resistant sign-in. P2 adds Privileged Identity Management and basic access reviews.1
The tier most Indian Microsoft 365 tenants already own covers five of the seven controls
Controls from the 2022 checklist included in each Microsoft Entra ID tier, with published US$ list price per user per month, September 2026
Source: Microsoft Entra pricing page; TechBag mapping of the checklist to the listed features · as of 30 September 2026
02What the tier does not fix: the log clock
Entra ID keeps sign-in and audit logs for seven days on the free tier and 30 days on P1 or P2. Upgrading does not recover anything older than seven days.2 CERT-In’s 2022 Directions require logs of ICT systems to be kept for 180 days, within India.3 No Entra tier meets that by itself: the logs have to be routed to a storage account or a SIEM from day one, which is a separate line on the invoice and the step most often missed.
03If you are buying this in India
Microsoft prices Entra in US dollars; Indian customers buy through a cloud solution provider, invoiced in rupees with 18% GST on top. The DPDP Rules were notified on 13 November 2025, and the duty to keep reasonable security safeguards over personal data applies from 13 May 2027.4 If you are not on Microsoft 365, the same seven controls map onto Okta, Cisco Duo, miniOrange and others in our IAM, SSO and MFA guide.
Sources
- Microsoft, Microsoft Entra plans and pricing (Free, P1 US$7, P2 US$10; features by plan; plans included in Microsoft 365) — undated page
- Microsoft Learn, Microsoft Entra data retention — updated 25 March 2026
- CERT-In, Directions under section 70B(6) of the IT Act (180-day log retention in India; six-hour reporting) — 28 April 2022
- Legismith, DPDP Rules 2025 commencement timeline — notified 13 November 2025
- TechBag, IAM, SSO and MFA guide (18 products by SKU) — vendor documentation, verified 22 August 2026
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
