Is Microsoft Entra ID Free? Pricing Guide for Small Businesses

Yes, Microsoft Entra ID is free — up to a point. The free tier covers basic identity and access management for up to 50,000 directory objects — or 300,000 once you have at least one verified custom domain — and comes automatically with any Microsoft cloud subscription. Brand-new tenants are capped at 600 objects for their first two days. For most small businesses, it is more than enough to get started. But Microsoft's licensing structure is notoriously complex, and the line between "free" and "you need to pay" is not always obvious.

This guide cuts through the noise. You will know exactly what the free tier includes, how it relates to your existing Microsoft 365 subscription, how to set it up from scratch, and when — if ever — you should pay for Premium P1 or P2.

What Is Microsoft Entra ID and Do I Need It?

Microsoft Entra ID is Microsoft's cloud-based Identity and Access Management (IAM) platform. You may know it by its former name, Azure Active Directory (Azure AD) — Microsoft rebranded it to Entra ID in 2023, but the underlying service is the same.

At its core, Entra ID does three things:

• Authentication: Verifies who your users are before they access apps and resources
• Authorization: Controls what authenticated users are allowed to do
• Single Sign-On (SSO): Lets users log in once and access multiple apps without re-entering credentials

Unlike traditional on-premises Active Directory (which manages devices and users inside your company network), Entra ID is cloud-native. It is designed for the modern reality where your users work from anywhere and your apps live in the cloud. If you are unsure how your Entra ID tenant relates to Azure billing, see Microsoft Entra tenant vs Azure subscriptions.

Do you need it? If your business uses Microsoft 365, Azure, or any Microsoft cloud service — you already have it. The question is whether the free tier is enough for your security requirements.

Yes, Microsoft Entra ID Has a Free Tier: What's Included

The free tier of Microsoft Entra ID is more capable than most people realize. It is automatically provisioned when you create an Azure account or sign up for any Microsoft 365 plan.

Limitations to be aware of: The free tier does not include Conditional Access policies (the rules that say "block this user if they are logging in from an unusual location"), no advanced identity protection, no group-based app assignment, and no access reviews. These all require Premium P1 or P2.

One limitation trips up almost everyone, so it is worth spelling out: bare Entra ID Free gives users self-service password change — a user who knows their password and wants a new one. Self-service password reset, the case that actually saves you help desk calls because the user has forgotten their password, is not in Entra ID Free. It starts at Microsoft 365 Business Standard, and is included in Business Premium and Entra ID P1/P2. Writing the new password back to on-premises Active Directory needs Business Premium or P1/P2.

For a five-person startup using Microsoft 365 for email and Teams for collaboration, the free tier covers everything you need. For a 50-person company with compliance requirements or remote workers accessing sensitive data, you will likely outgrow it.

Does Microsoft 365 Include Entra ID?

Yes — every Microsoft 365 subscription automatically includes Entra ID. When you sign up for Microsoft 365, Microsoft creates an Entra ID tenant for your organization behind the scenes. You are already using it for user logins, whether you know it or not.

The version you get depends on your M365 plan:

This is the detail most guides miss: if you are running Microsoft 365 Business Premium — which many SMBs do for the enhanced security features — you already have Entra ID Premium P1 included at no additional charge. You do not need to buy a standalone Entra ID license.

To access your Entra ID admin portal from Microsoft 365, go to the Microsoft 365 Admin Center, then navigate to Identity in the left sidebar. Alternatively, go directly to entra.microsoft.com.

How to Create Microsoft Entra ID for Free

If you are starting from scratch without an existing Microsoft 365 subscription, here is how to set up a free Entra ID tenant in under ten minutes. The identity features cost nothing, but plan for the sign-up itself: Azure verifies your identity by phone and by credit card.

1. Create a free Azure account
   Go to azure.microsoft.com/free. You will need a Microsoft account (or create one for free). Sign-up includes identity verification by phone and by credit card — it has to be a real card, not a prepaid or virtual one, and Azure places a small temporary verification hold on it. The free Azure account includes Entra ID Free automatically.
2. Access the Entra ID portal
   After signing in to the Azure portal, search for "Microsoft Entra ID" in the top search bar, or navigate directly to entra.microsoft.com.
3. Verify your tenant name
   Your tenant was created automatically during sign-up. It will have a default domain like yourcompanyname.onmicrosoft.com. You can add a custom domain (e.g., yourcompany.com) under Custom domain names.
4. Create your first users
   Navigate to Users > All users > New user. Assign them a role (at minimum, the default User role is fine for most employees).
5. Create groups and assign apps
   Under Groups, create security groups for your teams. Use groups to assign access to applications rather than assigning permissions to individual users.
6. Enable MFA
   Under Entra ID > Authentication methods, enable Microsoft Authenticator for your users. In the free tier, you can enforce MFA using Security Defaults — a pre-configured baseline that covers the most common attack vectors. Security Defaults themselves are switched on under Entra ID > Overview > Properties > Manage security defaults.
7. Verify your setup
   Test by signing in as one of your new users. Confirm MFA prompts are working. Check Sign-in logs under Monitoring to verify successful authentication.

How Much Does Microsoft Entra ID Cost? Paid Plans Breakdown

Microsoft offers two paid tiers above the free plan. Prices are per user per month, billed annually — list prices as of September 2026; check the Microsoft Entra pricing page for current figures.

Conditional Access is the headline feature of Premium P1. It lets you build rules like: require MFA when users sign in from outside the corporate network, block legacy authentication protocols, or restrict access to compliant Intune-managed devices only. Conditional Access is also the cornerstone of a Zero Trust in Microsoft 365 strategy. For any business with remote workers or compliance requirements, this is the single most valuable feature you are missing in the free tier.

Privileged Identity Management (PIM) in Premium P2 enables just-in-time admin access — admins request elevated privileges when needed rather than having them permanently assigned. The Entra PIM licensing requirements count people, not roles: you need Entra ID P2 (or a Microsoft Entra ID Governance licence) for every user with an eligible or time-bound assignment, for every user who can approve or reject an activation request, and for every user who is assigned to or performs an access review. This dramatically reduces your attack surface. If you have multiple Global Admins or Azure RBAC roles, PIM is worth every cent.

How Does This Compare to Competitors?

Okta Workforce Identity starts at around $2/user/month for SSO only — but MFA, lifecycle management, and device trust add up quickly. A comparable feature set to Entra ID Premium P1 costs $8–12/user/month with Okta. Auth0 is primarily a developer-focused CIAM platform and does not map cleanly to the same use cases. For Microsoft-centric organizations, Entra ID's native integration with M365, Azure, and Intune makes it the default choice by a wide margin.

Is Entra ID Really Free for Azure Cloud Applications?

If you are building or running applications on Azure, you can use Entra ID for authentication at no additional cost in most scenarios. The free tier covers authentication for your Azure resources and any app you register in the Microsoft app gallery.

Here is where it stays free:

• Authenticating users to your Azure-hosted web app or API
• Service-to-service authentication using Managed Identities
• B2B guest collaboration (your partners accessing your shared resources)
• App registrations for custom OAuth 2.0 / OIDC applications

Here is where costs can appear as you scale:

• Customer-facing identity: If external users sign up for your app themselves, that is a separate service with a different pricing model. Do not start a new project on Azure AD B2C — it has not been available to buy for new customers since 1 May 2025 (existing customers are supported until at least May 2030, and Azure AD B2C P2 was discontinued on 15 March 2026). The current product is Microsoft Entra External ID, whose core features are free for the first 50,000 monthly active users, then pay-per-use.
• Conditional Access for workload identities: Applying Conditional Access to service principals (not just human users) requires a separate Workload Identities Premium add-on. Managed identities are not covered by Conditional Access at all, regardless of licence — govern those with access reviews instead.
• External ID for workforce: If you are allowing external partners to authenticate using their own identity providers with advanced policies, you may need the External ID offering.

Free vs. Paid: Which Entra ID Plan Do Small Businesses Need?

Here is a practical decision framework based on team size and requirements:

Stay on the Free Tier If:

• You have fewer than 20 users, all working from the same location or on company devices
• You are using Microsoft 365 Business Basic or Standard and have no remote work security concerns
• You have no regulatory compliance requirements (HIPAA, SOC 2, ISO 27001, NIS2, GDPR article 32)
• All your apps are in the Microsoft ecosystem (Teams, SharePoint, Exchange)

Upgrade to Premium P1 If:

• You have remote workers accessing company resources from personal devices or public networks
• You need to enforce device compliance (Intune enrollment) as a condition for access
• You want to block legacy authentication (SMTP, IMAP, POP3) — a major attack vector
• You need self-service password reset with on-premises Active Directory writeback
• You have compliance requirements that mandate documented access controls
• You are already on Microsoft 365 Business Premium — you have P1 included, use it

Upgrade to Premium P2 If:

• You have privileged admin accounts that need just-in-time access controls (PIM)
• You need automated access reviews for compliance (SOC 2 Type II, ISO 27001)
• You want risk-based Conditional Access that automatically tightens requirements when suspicious sign-in behavior is detected
• You are subject to NIS2, GDPR, or financial sector regulations that mandate identity governance controls

The smartest move for most growing SMBs: start with M365 Business Premium. You get Exchange, Teams, SharePoint, Intune, Defender for Business, and Entra ID Premium P1 bundled for roughly $22/user/month. Buying those services separately costs significantly more. See also: smart M365 add-ons that stretch your licensing investment further.

Conclusion: Start Free, Upgrade Strategically

Microsoft Entra ID is genuinely free for the basics — and those basics cover a surprising amount of ground. If you already have a Microsoft 365 subscription, you have Entra ID right now. The real question is not "is it free?" but "am I using what I already have?"

Enable Security Defaults at minimum. Set up MFA for all users. Review your app registrations. For most small businesses, that alone closes the majority of identity-related attack vectors without spending a single additional euro.

When you are ready to go further — Conditional Access, device compliance enforcement, or identity governance — Premium P1 via Microsoft 365 Business Premium is the most cost-effective path. Premium P2 is the right choice once you have admin accounts and regulated data that demand tighter governance.

Need help assessing your current identity configuration or planning a migration to a more secure tier? Visit easym365.de for Microsoft 365 security consulting tailored to SMBs.

Frequently Asked Questions