Decision guide

Entra ID P1 vs P2 — and what GSA actually costs

The single most common misconception we hear: "we already pay for Microsoft 365, so Global Secure Access is free." It isn't — only the Microsoft traffic profile is included with Entra ID P1/P2. Here's the full picture.

01The Entra ID tiers

Prices below are Microsoft's published list pricing, USD, on an annual commitment, and they change — always confirm current terms on the Microsoft pricing page before budgeting.

Entra ID Free — core identity, MFA, SSO. No Conditional Access, no Application Proxy, no GSA.
Entra ID P1 (from ~$6/user/mo) — Conditional Access, Application Proxy, hybrid identity. Includes the Microsoft traffic profile for GSA at no extra cost. Bundled in Microsoft 365 Business Premium and E3.
Entra ID P2 (from ~$9/user/mo) — everything in P1 plus risk-based Conditional Access, Privileged Identity Management (PIM) and Identity Protection. Bundled in Microsoft 365 E5.

02The Global Secure Access licences

GSA is licensed separately on top of Entra ID P1/P2:

Microsoft traffic profile — M365/Entra traffic steering. Included with P1 or P2, no extra GSA licence.
Entra Private Access — per-app private access (the VPN replacement). Standalone add-on (from ~$5/user/mo) or included in the Entra Suite.
Entra Internet Access — internet/SaaS security (the SWG). Standalone add-on (from ~$5/user/mo) or included in the Entra Suite.
Entra Suite (from ~$12/user/mo) — bundles Private Access, Internet Access, ID Governance, PIM and more in one licence.

03The mistake to avoid

Assume "we have Microsoft 365" means "we have GSA." It doesn't. Most Business Premium / E3 customers are entitled to the Microsoft traffic profile only. Private Access and Internet Access are separate add-ons. Conversely, some customers over-buy by assuming they need the full Entra Suite when a single add-on plus their existing P1/P2 covers the actual use case.

04How to check what you already own

Open the Microsoft Entra admin center → Identity → Billing → Licenses (or the Microsoft 365 admin center) and look for the SKUs assigned to your users. Check whether Entra ID P2 is present (needed for risk-based Conditional Access), and whether any GSA add-on or Entra Suite licence is assigned before you scope a rollout.

Typical SMB starting point: if you're on Business Premium (which includes P1) and want per-app access to a handful of on-prem apps, the only extra you likely need is Private Access — not the whole Entra Suite. A 5-minute licensing review can save thousands a year.

Sources: Microsoft Entra pricing · Microsoft Entra licensing docs

Keep reading

By Passbeck architecture team · Last reviewed 5 Oct 2026