Microsoft Entra ID P2 (Azure AD P2)

Microsoft Entra ID P2 (formerly Azure Active Directory Premium P2) is Microsoft’s most complete identity security plan, adding three critical capabilities to everything in Entra ID P1: Identity Protection (real-time risk-based access decisions), Privileged Identity Management (just-in-time admin access), and Access Reviews (automated entitlement governance).

What’s Included — Everything in Entra ID P1, Plus:

• Microsoft Entra ID Protection
  • Real-time sign-in risk detection — analyses every sign-in for risk signals: impossible travel (signing in from London and then Sydney within 2 hours), anonymous IP address, atypical location, malware-linked IP, leaked credentials (from breach databases), and AI-detected anomalies
  • User risk detection — identifies whether a user account has been compromised based on aggregated signals over time
  • Risk-based Conditional Access — automatically step up authentication (require MFA) for medium-risk sign-ins, and block high-risk sign-ins until the user proves their identity
  • Risky user report — a prioritised list of accounts that show signs of compromise, with recommended remediation actions
• Privileged Identity Management (PIM)
  • Just-in-time (JIT) admin access — admin roles are not permanently assigned. Users activate them for a specific time window (e.g., 1 hour) when needed, with optional approval workflow and MFA requirement
  • Eliminates standing privilege — dramatically reduces the blast radius if an admin account is compromised, since the account has no admin rights outside of approved activation windows
  • Audit trail — full record of who activated which role, when, why, and what they did while activated
  • Privileged access reviews — periodically review who has admin role assignments and remove those that are no longer needed
• Access reviews
  • Periodically review and certify group memberships, application access, and role assignments
  • Send automated review requests to managers or resource owners: “Does [user] still need access to [application]?”
  • Automatically remove access when reviewers do not respond (access by default is denied, not approved)
  • Essential for meeting ISO 27001, SOC 2, and other compliance frameworks that require periodic access certification

Ideal For

Organisations with compliance requirements (ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS), enterprises with privileged admin accounts that need JIT access controls, and any organisation that wants to close the identity security gap between basic MFA (P1) and full Zero Trust identity governance. Entra ID P2 is included in Microsoft 365 E5.