How much does Microsoft Entra ID Governance cost per licensed user? The short answer is 7 dollars per user per month. The useful answer takes a page, because the 7 dollars sits on top of a prerequisite license, applies to a population most buyers undercount, and buys a feature set that overlaps with Entra ID P2 in ways that change which plan to hold. Azure IAM, LLC, an independent identity consulting firm that retires Microsoft Identity Manager (MIM) estates, prices this question for clients every month. The firm’s services are described at https://azureiam.com/.
The list price and the prerequisite
Microsoft’s Entra pricing page lists Entra ID Governance at 7 dollars per user per month, billed on an annual subscription. It is sold as an add-on. Microsoft’s licensing fundamentals documentation states that a tenant buying the standard Governance product must already hold an active subscription containing the Entra ID P1 or P2 service plan. Qualifying products include Entra ID P1 on its own, Microsoft 365 E3 and E5, the academic and government equivalents, and Enterprise Mobility + Security E3 and E5.
The prerequisite is enforced, not advisory. If it is missing or expires, Microsoft’s documentation warns that governance scenarios may stop functioning. A tenant cannot buy Governance as its first Entra product.
Why some tenants pay 7 and others pay 14
The prerequisite is where the per user figure splits in two.
A tenant on Microsoft 365 E3 or E5 already carries P1 or P2 inside the suite. Governance adds 7 dollars per user to a bill that exists today.
A tenant with no premium Entra plan has to buy P1 first. P1 is now 7 dollars per user per month, so the incremental cost of governance becomes 14 dollars. A large share of MIM estates sit in this second group. Their identity platform ran on premises for a decade, Entra ID was a synchronization target fed by Entra Connect, and nobody ever bought a premium plan because MIM did the governance work.
A tenant already on P2, which Microsoft now prices at 10 dollars, has a third path. Microsoft sells a product named Entra ID Governance Step Up for Entra ID P2 that credits the governance capabilities P2 already includes. The public pricing page does not list a price for the Step Up product, so the number comes from a licensing partner or an enterprise agreement quote.
Entra Suite, listed at 12 dollars, is the fourth option. It bundles Governance with Private Access, Internet Access, ID Protection, and Verified ID. It also requires P1 underneath, so a tenant starting from nothing pays 19 dollars for P1 plus Suite, against 14 dollars for P1 plus standalone Governance.
Who has to be counted
Microsoft’s licensing FAQ answers the counting question directly. Governance licenses do not have to be assigned to individual users. The tenant must instead own enough licenses to cover every member user who is in scope of a governance feature, plus every administrator who configures one.
For access reviews the rule is explicit: licenses must cover all employees who review access and all employees whose access is reviewed. For Privileged Identity Management the covered set includes every user with an eligible or time-bound role assignment, every approver, and every reviewer.
The practical effect is that the governed population, not the active user count, drives the bill. A Contoso with 8,000 employees that runs one annual certification of all group memberships needs 8,000 Governance licenses, even if Lifecycle Workflows only ever touch the 600 people who join or leave each year. A Contoso that scopes reviews to its 400 privileged users and uses workflows for joiners and leavers licenses a far smaller set.
Guests are outside this count entirely. Any account with a userType of Guest bills at 75 cents per monthly active guest through a linked Azure subscription, a separate model Azure IAM has covered in its own guidance.
What the add-on buys that P2 does not
Governance is a superset of P2’s identity governance features. The Microsoft feature matrix shows Privileged Identity Management, entitlement management, access reviews, the My Access portal, and separation of duties checks all inside the Governance column. On top of those, the add-on carries the capabilities Microsoft now reserves for it:
Lifecycle Workflows, with custom task extensions to Logic Apps. Access package auto-assignment policies and sponsor-based approvals. Machine learning assisted access review recommendations and reviews scoped to inactive users. Catalog access reviews and custom data provided resources. Cross-tenant synchronization for groups and cross-cloud synchronization. Account Discovery for finding orphan accounts in target applications. Entra roles and SAP business roles inside access packages.
Microsoft’s own FAQ closes the door on the alternative: all generally available features in P2 remain, but no new identity governance capabilities will be added to the P2 product.
That matrix produces a conclusion that surprises many MIM shops. P1 plus Governance, at 14 dollars, delivers PIM and the full governance set. P2’s remaining advantage over P1 is Identity Protection, meaning risk-based Conditional Access and risk detections, which is a security feature rather than a governance one. A tenant choosing between P2 plus Governance and P1 plus Governance is paying 3 dollars per user for Identity Protection, and should price it as that.
The MIM translation
MIM 2016 never presented a number like this. It is licensed through Windows Server client access licenses, and the Synchronization Service, the Portal, and the rules extensions carried no per identity governance fee. Microsoft supports MIM 2016 Service Pack 2 until January 10, 2029, so the move is a budget decision rather than a forced one.
Azure IAM’s arithmetic for the Contoso above, at list price before enterprise agreement discounts:
8,000 employees, no premium Entra plan today: 8,000 times 14 dollars times twelve months is 1,344,000 dollars per year.
8,000 employees already on Microsoft 365 E3: 8,000 times 7 dollars times twelve months is 672,000 dollars per year.
400 privileged users governed, P1 already held: 400 times 7 dollars times twelve months is 33,600 dollars per year, provided the all-staff certification is kept out of scope or moved to a tool licensed differently.
Those three lines are the comparison set. SailPoint IdentityIQ and Identity Security Cloud are priced per governed identity under negotiated terms, and in the firm’s experience the crossover point depends on whether the all-staff review obligation exists in the first place.
Four ways to keep the number honest
First, inventory the populations before counting. Each governance feature has its own scope, and the license count follows the widest scope in use.
Second, ask about the Frontline Worker product. Microsoft lists an Entra ID Governance Frontline Worker license with its own prerequisite for F1 and F3 populations, which matters for Contoso sites with large shift workforces.
Third, price Entra Suite whenever two or more of its other components are already on the roadmap. The 5 dollar gap over standalone Governance can retire a separate secure web gateway or VPN replacement line.
Fourth, keep P2 era features where they are sufficient. Basic access reviews and basic entitlement management still run under P2 and do not require the add-on.
The decision
For a MIM estate already on Microsoft 365 E3 or E5 with a governance scope that stays close to privileged users and joiner and leaver automation, the 7 dollar add-on is usually the simplest exit from MIM. For an estate with no premium plan and a standing all-staff certification obligation, the 14 dollar figure changes the comparison with SailPoint and with a planned MIM extension to 2029. Azure IAM models the per user bill against the actual population counts and review cadences of a MIM estate as part of a fixed fee assessment. A consultation request at https://azureiam.com/contact is the first step.
Azure IAM, LLC
2521 North Main
Unit 1-276
Las Cruces
New Mexico
88001
United States
