Azure AD Premium P1 vs P2: MFA Licensing Requirements Explained
Question details
An organization needs to determine if a single Azure AD Premium P2 license covers the entire tenant for multifactor authentication (MFA) and whether Kiosk or unlicensed users can use phone or SMS verification.
- Product
- Microsoft Azure Active Directory (Entra ID)
- Device & OS
- not provided
- Scenario
- Planning multifactor authentication deployment across users with varying license types including Exchange Online Kiosk, E1, E3, E5, and limited Azure AD Premium P2 licenses.
- Observed behavior
- Seeking clarification on licensing compliance, specifically whether premium authentication features extend to all users unconditionally when one premium license is active.
Log in to the Microsoft 365 Admin Center or Microsoft Entra Admin Center with global administrator or billing administrator privileges to review your organization's active licenses.
Verify User-Level Entra ID Licensing for MFA
MFA eligibility is tied to the individual user's license for identity features, not just having a single tenant-wide Premium license.
A single Azure AD Premium P2 license will technically unlock premium features (like Conditional Access and Risk-Based MFA) in the admin console for the entire tenant. However, Microsoft's licensing terms require that every user benefiting from these premium features must be individually assigned a P1 or P2 license.
Users with only Exchange Online Kiosk, E1, E3, or E5 licenses are eligible for basic multifactor authentication (such as Security Defaults), but they do not automatically inherit P2 premium capabilities unless licensed directly.
Navigate to the Microsoft Entra admin center and go to Identity > Billing > Licenses to check your available license pool.
If you intend to use advanced Conditional Access policies for MFA, assign the Azure AD Premium P1 or P2 license directly to each user subjected to those policies.
For users without a premium identity license, utilize Security Defaults or per-user MFA to enforce basic authentication via the Microsoft Authenticator app.
Consult your Microsoft billing administrator regarding SMS or phone verification, as certain telecom charges or specific licensing requirements may apply depending on your region and enterprise agreement.
Simplify Your Workflow with WPS Office
Navigating complex enterprise licensing tiers for Microsoft identity and office products can be challenging. If you are looking for a streamlined, highly productive office suite without the complicated subscription management, WPS Office is a perfect alternative.
- 1. Download the Installer: Visit the official WPS Office website to download the free installation package suited for your operating system.
- 2. Install the Software: Run the setup file and follow the simple on-screen instructions to complete the installation in minutes.
- 3. Start Creating: Open the application to instantly view, edit, or create documents with an interface that feels familiar and easy to use.
Frequently Asked Questions
Does one Azure AD Premium P2 license cover my entire tenant for MFA?
No. While a single Premium P1 or P2 license enables the premium features (like Conditional Access) in the administrative portal for the whole tenant, Microsoft requires you to purchase and assign a premium license for every individual user who benefits from or is targeted by these premium features.
Can Exchange Online Kiosk users use SMS for multifactor authentication?
Kiosk users can utilize basic MFA. However, SMS and voice call verification availability can depend on your specific Microsoft agreement. Security Defaults primarily encourage the use of the Microsoft Authenticator app for free, while extensive SMS usage might incur telecom charges or require higher-tier licenses. Always confirm with your billing admin.
What is the difference between Azure AD Premium P1 and P2 for MFA?
Both P1 and P2 include advanced Conditional Access policies for MFA. However, P2 adds identity protection features, such as risk-based Conditional Access, which automatically requires MFA or blocks access if user sign-in risk is detected as high.
