Includes Entra ID Free. Basic CA functionality only.

Includes Entra ID P1 + Intune. Full CA policies including device compliance.

Includes Entra ID P1 + Intune. Full CA policies for enterprise environments.

Includes Entra ID P2 + Intune + Purview + MDCA. Full risk-based policies.

Includes Entra Suite + Intune + Purview + MDCA + extended Defender & Purview stack.

Frontline worker license. Includes Entra ID Free. Limited CA functionality.

Includes Entra ID Free only. Limited CA functionality without EMS add-on.

Includes Entra ID P1 + Intune. Functionally equivalent to M365 E3.

Includes Entra ID P2 + Intune + Defender for Identity. Functionally equivalent to M365 E5 (without Purview/MDCA).

Enterprise Mobility + Security E3. Includes Entra ID P1 + Intune + AIP P1.

Enterprise Mobility + Security E5. Includes Entra ID P2 + Intune + AIP P2 + Defender for Identity + MDCA.

Basic Conditional Access only – limited to MFA-related policies and Security Defaults.

Full Conditional Access policies, named locations, all persona-based policies.

P1 + risk-based policies via Identity Protection (sign-in risk, user risk).

Everything in P2 + Workload Identities + Global Secure Access (ZTNA) + ID Governance.