If you searched for Azure AD and every result talks about something called Microsoft Entra ID, you are not lost. In 2023, Microsoft renamed Azure Active Directory — Azure AD — to Microsoft Entra ID. Same product, same job, new name. Nothing migrated and nothing broke; the sign-in system your business already uses simply changed labels. Anything that still says Azure AD is describing what this article covers.
This guide is for owners and managers of businesses with 10 or more employees, not for IT administrators. It explains what Entra ID actually is, why it quietly became the most important security system you own, what each tier costs at Microsoft’s list price, and the settings that separate a protected business from an exposed one.
What is Microsoft Entra ID?
Microsoft Entra ID is the identity layer of Microsoft 365. Every time someone on your team opens Outlook, joins a Teams call, or pulls a file from SharePoint, Entra ID is the system that checks who they are and decides three things: who can sign in, to what, and from where.
Think of it as the front desk and keycard system for your digital office. It holds every person’s account and password, every phone-based sign-in approval, and every rule about which doors those keycards open. If your business subscribes to Microsoft 365 in any form, you already have an Entra ID tenant — whether or not anyone has ever looked at it.
That last part matters. Entra ID is running right now, with whatever settings it was given on day one. The question is not whether you have it; it is whether it is configured to protect you.
Why identity became the security perimeter
A decade ago, small-business security meant a firewall around the office. Work happened inside four walls, so a strong wall was most of the job. That model is gone. Your email, files, accounting data, and client records now live in cloud services and get opened from laptops at kitchen tables, phones in airports, and home offices across town.
There is no wall around all of that. The one thing every one of those sessions has in common is a sign-in — which is why attackers have shifted from breaking in to logging in. A phished password, or one reused from a breached shopping site, is all it takes — and no firewall notices, because it looks like a normal person signing in normally.
That is why identity is now the perimeter, and why the highest-return security work in a small business is unglamorous: making sign-ins hard to fake. Microsoft’s own research puts it bluntly — multifactor authentication blocks over 99.9% of account-compromise attacks. Few security controls come with a number like that.
What does Microsoft Entra ID cost?
Entra ID comes in tiers, and the honest news for a small business is that the useful ones are inexpensive. At Microsoft’s list price:
- Entra ID Free is included with every Microsoft 365 subscription. It covers the basics: accounts, passwords, and baseline multifactor authentication through Microsoft’s “security defaults.”
- Entra ID P1 is $6 per person, per month as a standalone add-on. Its headline feature is conditional access — the rules engine covered below — plus finer control over groups and access.
- P1 is included in Microsoft 365 Business Premium, which lists at about $22 per person, per month and bundles the Office apps, device management, and Microsoft’s small-business security tooling into one license.
- Entra ID P2 adds risk-based protections — automatic detection of suspicious sign-ins, access reviews, identity governance. It is designed for larger or heavily regulated organizations; most businesses under 100 people do not need it.
| Tier | Cost at Microsoft’s list price | What it adds | Right for |
|---|---|---|---|
| Entra ID Free | Included with every Microsoft 365 subscription | Accounts, passwords, baseline MFA via security defaults | The floor every tenant starts from |
| Entra ID P1 | $6 per person/month standalone; included in Microsoft 365 Business Premium (about $22 per person/month) | Conditional access, group-based access control, self-service password reset | Most businesses with 10–100 people |
| Entra ID P2 | Standalone add-on or enterprise bundles | Everything in P1, plus risk-based sign-in protection and access reviews | Larger or heavily regulated organizations |
Prices are Microsoft’s published list prices and can change; what you pay through a partner may differ slightly. The takeaway is the shape of it: the tier that matters for a small business costs about as much per person as a sandwich.
The five settings that matter most
Licensing only buys the capability. Protection comes from a short list of settings, and every one of them is worth asking whoever handles your Microsoft 365 management to confirm in writing.
1. Multifactor authentication for everyone
Every person, no exceptions — especially not the owner and the bookkeeper, whose mailboxes are exactly the ones attackers want most. “Most people have it” is not a finished state; one unprotected account is the way in. MFA works on the free tier, so cost is never the reason to wait.
2. Conditional access
This is the P1 feature, and it is the reason P1 exists. Conditional access lets your tenant enforce sensible rules automatically: block sign-ins from countries you do not operate in, require extra verification from unfamiliar devices, refuse connections from computers you do not manage. It turns your security intentions into policy the system enforces at 2 a.m. without anyone watching.
3. Block legacy authentication
Older sign-in protocols from the pre-smartphone era do not understand MFA at all, and attackers deliberately use them to walk around it. Leaving legacy authentication enabled is installing a bank-vault door and leaving the side window open. Blocking it is a one-time decision that closes an entire category of attack.
4. Review stale accounts and guest access
Tenants accumulate clutter: accounts for people who left long ago, guest access for vendors from finished projects, shared mailboxes with forgotten passwords. Every one is a door nobody is watching. A quarterly review — who has an account, who is a guest, who holds admin rights — keeps the list honest.
5. Same-day offboarding
When someone leaves the company, their account should be disabled and their active sessions revoked that day, before the exit interview is a memory. Entra ID can cut access from every device at once. The businesses that get burned are usually the ones that simply forgot an account for months.
Common gaps in unmanaged tenants
When a tenant has grown up without anyone owning it — set up by a departed employee or a long-gone contractor — the same gaps show up again and again:
- MFA is “available” but never enforced, so part of the company quietly skipped it.
- The business pays for Business Premium, and therefore already owns P1 — but no conditional access policy has ever been created. The protection is purchased and switched off.
- Legacy authentication is still enabled because nobody knew to turn it off.
- Several people hold global admin rights, and those accounts are used for everyday email.
- Former employees and vendor guests still have active accounts.
- Nobody has ever looked at the sign-in logs, so nobody knows what normal looks like.
None of these are exotic, and most cost nothing to fix — what they require is ownership. To see where identity fits among the other layers, our SMB cybersecurity checklist covers the full picture.
Business Premium or standalone P1?
If you are on Microsoft 365 Business Basic or Business Standard today, there are two roads to conditional access: add P1 for $6 per person, per month, or step up to Business Premium at about $22 — both at Microsoft’s list price.
For most businesses, Business Premium is the cleaner answer. The step up does not just buy P1; it brings device management and Microsoft’s small-business security stack into the same license — where a growing company is usually headed anyway. Standalone P1 fits narrower cases: you are committed to a different bundle, or need conditional access on a plan you cannot change yet.
There is also a forward-looking reason to get this layer right: everything Microsoft is building now, including Copilot, sits on top of your identity and permission structure. Copilot can surface anything a person’s account can reach, so loose access today becomes visible in ways it never was before. Tidying Entra ID is step one of getting ready for AI in Microsoft 365, not a separate project.
Where to start
You do not need to become an identity expert; you need clear answers to owner-level questions. Is MFA enforced for every person? Do we have conditional access policies, and what do they say? Is legacy authentication blocked? When did we last review accounts and guest access? What happens, specifically, on the day someone leaves? Whoever runs your tenant should be able to answer all five without scheduling a research project — and those answers are the identity slice of your broader security posture.
NSN Management, Tulsa-owned since 2012, manages Microsoft 365 tenants for Tulsa-area businesses as a Microsoft partner across the stack it supports. This is the work behind the phrase “we manage Microsoft 365”: licensing that matches what you actually need, sign-in security configured and enforced, and offboarding that happens the day it should. If you would like to know what your tenant is set to today — what you have, what you are paying for, and what is still open — book a Discovery Call. It is a plain-English conversation, not a sales pitch.
Questions Tulsa businesses ask about this
Is Azure AD the same as Microsoft Entra ID?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. It is the same service with the same capabilities — nothing was migrated, removed, or repriced as part of the rename. Older documentation and invoices may still say Azure AD, but they refer to the same thing.
How much does Microsoft Entra ID cost?
A free tier is included with every Microsoft 365 subscription. Entra ID P1 costs $6 per person per month standalone at Microsoft’s list price, and it is included in Microsoft 365 Business Premium, which lists at about $22 per person per month. Entra ID P2 adds risk-based protections and is aimed beyond what most small businesses need.
Do I need Entra ID P1 or P2?
Most 10–100 person businesses need P1, because that is the tier that unlocks conditional access — the rules engine behind serious sign-in security. P2’s risk-based protections and access reviews are built for larger or heavily regulated organizations. If a compliance framework or cyber-insurance application names those features, look at P2.
Is Entra ID included in Microsoft 365?
Yes. Every Microsoft 365 subscription includes Entra ID’s free tier, which handles sign-in and baseline multifactor authentication. The P1 features, including conditional access, come with Business Premium or as a $6 per person per month add-on at Microsoft’s list price.
What happens to a person’s Entra ID account when they leave?
Nothing, until somebody acts. The account keeps working — email, files, remote access — which is why same-day offboarding matters. Disabling the account and revoking its sessions in Entra ID cuts access from every device at once; make it a standard step in your exit process.
Does NSN Management manage Entra ID?
Yes. NSN Management, Tulsa-owned since 2012, manages Microsoft 365 tenants for Tulsa-area businesses, and Entra ID is the identity core of that work — licensing, MFA enforcement, conditional access, and offboarding. A Discovery Call is the easiest way to find out what your tenant is actually set to.