Microsoft Entra ID P1 (Azure AD P1)

Microsoft Entra ID P1 (formerly Azure Active Directory Premium P1) is Microsoft’s advanced identity and access management platform. It provides the tools to enforce the right access policies across your organisation — ensuring the right people get access to the right resources, from the right devices, in the right locations — while making life easier for end users with self-service capabilities.

What’s Included

• Conditional Access — The most important feature in Entra ID P1. Create policies that grant or block access based on combinations of: user identity, device compliance status, network location, application sensitivity, and sign-in risk. Examples: “Require MFA when signing in outside the office,” “Block access from non-compliant devices,” “Require approved apps on mobile devices.”
• Multi-factor Authentication (MFA) — Enforce MFA across all cloud apps and on-premises applications through Conditional Access. Supports Microsoft Authenticator app, FIDO2 security keys, SMS, voice call, and hardware OATH tokens.
• Self-service password reset (SSPR) — Users can reset their own passwords or unlock their accounts without calling IT helpdesk — reducing support tickets and user frustration. Integrates with on-premises AD password writeback.
• Group-based licensing — Assign Microsoft 365 and other SaaS licences to groups rather than individual users. When someone joins a group (via dynamic membership rules based on HR attributes like department or location), they automatically receive the right licences.
• Dynamic groups — Create security groups and Microsoft 365 groups with membership rules based on user attributes (department, country, job title). Group membership updates automatically as attributes change.
• Hybrid identity (Azure AD Connect) — Synchronise your on-premises Active Directory users, groups, and password hashes to Entra ID. Single sign-on for both cloud and on-premises applications using the same credentials.
• Application proxy — Securely publish on-premises web applications to remote users without a VPN. Users access internal apps through the internet with SSO and MFA applied.
• SaaS application integration — Pre-configured SSO integration for 3,000+ SaaS applications including Salesforce, ServiceNow, SAP, Workday, and more. Provision and deprovision users automatically via SCIM.

Ideal For

Any organisation that wants to move beyond basic passwords and enforce Zero Trust access controls. Entra ID P1 is included in Microsoft 365 Business Premium, E3, and E5 — but can be purchased standalone to add Conditional Access and SSO to any Microsoft 365 plan or Azure subscription.