--- title: "Entra ID P1 covers 5 of 7 IAM controls; the other 2 cost US$3 more a user" summary: "The 2022 identity checklist mapped onto Microsoft Entra ID Free, P1 and P2 and their US$ list prices, with the log-retention gap CERT-In exposes. September 2026." url: https://www.thetechbag.com/blog/organizations-can-use-identity-access-management-iam format: Note desk: "Identity & access" published: 2024-12-31 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["IAM","Microsoft Entra ID","MFA","SSO","Conditional Access","PIM","access reviews","log retention","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/organizations-can-use-identity-access-management-iam.png --- # Entra ID P1 covers 5 of 7 IAM controls; the other 2 cost US$3 more a user *The 2022 identity checklist mapped onto Microsoft Entra ID Free, P1 and P2 and their US$ list prices, with the log-retention gap CERT-In exposes. September 2026.* Note · Identity & access · By TechBag · Published 2024-12-31 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/organizations-can-use-identity-access-management-iam Five of the seven identity controls this piece recommended in 2022 come with Microsoft Entra ID P1, which lists at US$7 a user a month and is already inside Microsoft 365 E3 and Business Premium. The two it leaves out, managing privileged accounts and reviewing who has access, are in P2 at US$10.[1] For most Indian companies on Microsoft 365, the question is no longer which practices to adopt. It is whether the people with the most access are worth US$3 a month more, and how to keep the logs CERT-In asks for. ## The 2022 checklist, priced by tier The original list had eight items. One, “treat identity as the perimeter”, is a principle and costs nothing. The other seven are switches in a product. On Microsoft’s own pricing page, the free tier that comes with any Microsoft 365 subscription includes multi-factor authentication, single sign-on to SaaS applications and password self-service. P1 adds Conditional Access, which is how “verify every request” is actually enforced, and passwordless, phishing-resistant sign-in. P2 adds Privileged Identity Management and basic access reviews.[1] **Figure: The tier most Indian Microsoft 365 tenants already own covers five of the seven controls** *Controls from the 2022 checklist included in each Microsoft Entra ID tier, with published US$ list price per user per month, September 2026* Entra ID Free, with Microsoft 365 MFA, SSO, password self-service 3 of 7 Entra ID P1, US$7 adds Conditional Access and passwordless 5 of 7 Entra ID P2, US$10 adds privileged identity and access reviews 7 of 7 | | Value (of 7) | | --- | --- | | Entra ID Free, with Microsoft 365 | 3 | | Entra ID P1, US$7 | 5 | | Entra ID P2, US$10 | 7 | Source: Microsoft Entra pricing page; TechBag mapping of the checklist to the listed features · as of 30 September 2026 Our view Our view: the two missing controls are the ones that matter most per head, because they govern the accounts an attacker wants. The uplift from P1 to P2 is US$3 a user a month at list; for a 400-person company that licensed everyone, that is US$14,400 a year before GST.[1] Ask your licensing partner which users actually need P2 before paying for the whole tenant. ## What the tier does not fix: the log clock Entra ID keeps sign-in and audit logs for seven days on the free tier and 30 days on P1 or P2. Upgrading does not recover anything older than seven days.[2] CERT-In’s 2022 Directions require logs of ICT systems to be kept for 180 days, within India.[3] No Entra tier meets that by itself: the logs have to be routed to a storage account or a SIEM from day one, which is a separate line on the invoice and the step most often missed. ## If you are buying this in India Microsoft prices Entra in US dollars; Indian customers buy through a cloud solution provider, invoiced in rupees with 18% GST on top. The DPDP Rules were notified on 13 November 2025, and the duty to keep reasonable security safeguards over personal data applies from 13 May 2027.[4] If you are not on Microsoft 365, the same seven controls map onto Okta, Cisco Duo, miniOrange and others in our [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa). TechBag countTechBag count Of the 18 products in that guide, 10 are built in India, 5 more document Indian data residency, and 3 document neither. We counted the guide’s India field, set from vendor documentation.[5] How we did this Figures as of 30 September 2026 The tier mapping uses the features Microsoft lists on its Entra pricing page; a control was counted only where the page names it, so password protection lists and lifecycle workflows, which the page does not place in a tier, were left out. Prices are US$ list, paid yearly, before any agreement discount. Log retention is from Microsoft Learn. The India counts are TechBag’s, from the IAM guide as verified against vendor documentation in August 2026. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Microsoft, Microsoft Entra plans and pricing (Free, P1 US$7, P2 US$10; features by plan; plans included in Microsoft 365)](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing) — undated page 2. [Microsoft Learn, Microsoft Entra data retention](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention) — updated 25 March 2026 3. [CERT-In, Directions under section 70B(6) of the IT Act (180-day log retention in India; six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 4. [Legismith, DPDP Rules 2025 commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 5. [TechBag, IAM, SSO and MFA guide (18 products by SKU)](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — vendor documentation, verified 22 August 2026 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — the 18 products this note counts, with India-built and residency flags - [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — the control Entra ID P1 leaves out, across dedicated PAM products - [Microsoft 365 plans compared](https://www.thetechbag.com/microsoft/microsoft-365) — which plans already include Entra ID P1 or P2