This article is written by the team that builds Casdoor, so we are not neutral, and we say where we think Casdoor fits and where it doesn't. Facts about other products come from their own websites as of November 15, 2026 (listed under Sources) and may have changed. Spotted something out of date? Tell us.
Short answer: Microsoft Entra ID has a free tier, P1 at $7 per user per month, P2 at $10 and Entra Suite at $12, all listed with annual billing that renews automatically. Entra External ID, the customer-facing product, is pay-as-you-go with the first 50,000 monthly active users free. The number that matters for a budget is not the sticker price; it is which bundle already includes the license, and how many users never need P2.
The published prices
| Plan | Price per user per month | What it adds |
|---|---|---|
| Entra ID Free | $0 | MFA, unlimited SSO, self-service password reset; requires an Azure subscription |
| Entra ID P1 | $7 | Conditional Access, passwordless and phishing-resistant authentication, hybrid identity, cross-tenant access, backup and recovery, advanced reports, verifiable credentials |
| Entra ID P2 | $10 | P1 plus Identity Protection, risk-based Conditional Access, premium risk detections, select PIM capabilities, basic entitlement management and access reviews |
| Entra Suite | $12 | Requires P1 or a plan that contains P1; adds continuous adaptive Conditional Access, identity governance, Secure Web and AI Gateway, and real-time risk detection |
Two details in Microsoft's own description are easy to miss:
- P2 is not a superset of every governance feature. The pricing page says some detections and full PIM require additional licenses.
- Entra Suite is a bundle on top of P1, not a replacement. You need P1 or a qualifying plan before adding it.
What the price does not include
A per-user license is the floor, not the bill. Budget separately for:
- External identities. External ID is metered by monthly active users, not covered by internal P1 or P2 seats. The first 50,000 MAU are free; after that it is pay-as-you-go. The public pricing page does not list a per-MAU rate above the free tier.
- Add-on products. Identity Governance, Entra Domain Services and other products have their own prices.
- Microsoft 365 licences. Conditional Access policies often assume device compliance and Microsoft 365 signals. If you are not already paying for those, the identity licence is not the whole cost.
- Implementation and migration. Conditional Access policy design, hybrid identity and application onboarding are project costs, not licence costs.
What it costs at different sizes
The arithmetic is simple, which is the problem. These examples use annual list prices and internal users only:
| Users | P1 per month | P1 per year | P2 per month | P2 per year |
|---|---|---|---|---|
| 100 | $700 | $8,400 | $1,000 | $12,000 |
| 1,000 | $7,000 | $84,000 | $10,000 | $120,000 |
| 5,000 | $35,000 | $420,000 | $50,000 | $600,000 |
Now add the users who need only SSO and MFA. Paying for P2, or even P1, for a frontline worker, a contractor or a partner who signs in twice a month is where identity budgets grow faster than headcount.
This is the case for splitting the population: keep the Microsoft 365 users on Entra ID, and put the applications and user groups that do not need Conditional Access or Identity Protection on a second identity provider with a flat price. The two can federate or run side by side.
The bundle changes the math
Entra ID P1 is included in Microsoft 365 E3 and Business Premium, and P2 is included in Microsoft 365 E5. If you already pay for those bundles, the marginal cost of Entra ID is zero, and replacing it means paying twice unless you also drop the bundle.
That is why most organizations do not replace Entra ID wholesale. They keep it for Microsoft 365 and Windows, and add a second identity provider for customer login, partners, non-Microsoft applications and devices. The question is not "Entra or something else"; it is "which population belongs on which identity provider".
External ID for customer login
If the users are customers rather than employees, the pricing model flips. Entra External ID is pay-as-you-go with 50,000 free MAU, which is competitive at small scale. Above that, the cost depends on a rate Microsoft does not publish on the pricing page, so you need a quote or an Azure calculator session to model it.
Compare it with the alternatives on the same axis: Auth0's free tier stops at 25,000 MAU and paid B2C plans start at $35 per month for 500 MAU; Casdoor Cloud is a flat price per instance with unlimited users. At 100,000 MAU the shape of the bill is completely different between per-MAU and flat-price products.
For the customer-login side, see Auth0 pricing and Auth0 Organizations.
When per-user pricing is the right choice
Per-user pricing is not a mistake. It buys something:
- Conditional Access and Identity Protection are mature, deeply integrated with Microsoft's security products, and recognized by auditors.
- Windows, Microsoft 365 and Teams assume Entra ID. Federating them to a third-party IdP adds complexity that rarely pays for itself.
- No operations. There is no cluster, database or upgrade to run.
The mistake is paying per-user prices for a population that does not use those capabilities.
Ways to reduce the Entra bill
- Check the bundle first. If E3 or E5 already includes P1 or P2, you may be paying for identity twice through a separate line item.
- Right-tier the population. P2 is for people who need risk-based policies and PIM. SSO and MFA are in Free and P1.
- Move non-Microsoft users off per-seat licences. Contractors, partners and customer-facing accounts often fit a flat-price IdP.
- Use External ID for customers, and model the MAU curve before assuming it is cheaper than a flat instance.
- Audit add-ons. Governance and Domain Services have separate prices and are often bought by habit.
A flat-price alternative
Casdoor is an Apache-2.0 identity provider with OIDC, SAML, CAS, LDAP, RADIUS and SCIM, self-hosted for free or run as a dedicated cloud instance from $9 per month with unlimited users. It is not a replacement for Conditional Access or Microsoft 365 integration; it is a replacement for the per-seat identity licence for applications that do not need them.
See Entra ID alternatives for the full comparison, and Entra ID SSO for the application-side setup.
FAQ
How much does Entra ID cost per user? Free is $0, P1 is $7 per user per month, P2 is $10 and Entra Suite is $12, listed with annual billing that renews automatically.
Is Entra ID free with Microsoft 365? P1 is included in Microsoft 365 E3 and Business Premium; P2 is included in Microsoft 365 E5. Check your current bundle before buying a separate licence.
How much is Entra External ID? The first 50,000 monthly active users are free, then it is pay-as-you-go. Microsoft does not publish the per-MAU rate above the free tier on the pricing page, so model it with a quote.
Is P2 worth it? Only for users who need Identity Protection, risk-based Conditional Access, PIM or access reviews. SSO, MFA and Conditional Access are P1 features.
What is the cheapest way to run identity for 5,000 users? If they need Microsoft 365, keep Entra ID and use the bundle. If they only need SSO and MFA for applications, compare a flat-price instance: 5,000 users on P1 is $35,000 per month at list price, before add-ons.
Sources
Product names are trademarks of their respective owners.