Microsoft Entra ID for Small Business: Plans and Settings

Microsoft Entra ID is the sign-in system behind Microsoft 365. Every user account, password, multi-factor prompt, and group membership in your subscription lives in it, so if you use Microsoft 365 you already use Entra ID. It comes in three editions: Free (included with every Microsoft 365 business plan), P1 (included with Business Premium), and P2 (an add-on aimed at larger or higher-risk organizations). For most small offices the real work is checking a handful of settings, not buying anything.

What Is Microsoft Entra ID?

Microsoft Entra ID is a cloud identity and access management service. In plain terms, it is the directory of who works for you and the gatekeeper that decides whether a sign-in is allowed.

It was called Azure Active Directory (Azure AD) until Microsoft announced the new name on July 11, 2023. Microsoft states that licensing, pricing, and functionality did not change with the rename. If you see “Azure AD” in an older guide or invoice, it is the same product.

You manage it in the Microsoft Entra admin center at entra.microsoft.com. The Microsoft 365 admin center shows a simplified view of the same users and groups.

What Does Entra ID Do in a Small Office?

• User accounts. Each person’s Microsoft 365 account is an Entra ID account. Blocking it blocks Outlook, Teams, OneDrive, and SharePoint together.
• Multi-factor authentication (MFA). The second step at sign-in, such as approving a prompt in the Microsoft Authenticator app. We explain the reasoning in why multi-factor authentication matters.
• Groups. Groups decide who can open which SharePoint sites, shared mailboxes, and Teams.
• Single sign-on. Other business apps can use the same Microsoft sign-in, so staff have one account to protect instead of many.
• Admin roles. Roles such as Global Administrator control who can change settings for the whole organization.
• Device records. Work computers that are joined or registered appear here, which is what lets Microsoft Intune manage them.
• Sign-in and audit logs. A record of who signed in, from where, and whether it succeeded.

Which Entra ID Edition Does Your Microsoft 365 Plan Include?

List prices below are Microsoft’s United States prices per user per month with annual billing, as of September 2026, from Microsoft’s small and medium business security pricing page, Entra pricing page, and 2026 pricing update. Business Basic and Business Standard went up on July 1, 2026. Business Premium did not.

Your plan	List price	Entra ID edition	What that means
Microsoft 365 Business Basic	$7.00	Free	Accounts, groups, MFA through security defaults
Microsoft 365 Business Standard	$14.00	Free	Same as Basic, plus self-service password reset for cloud accounts
Microsoft 365 Business Premium	$22.00	P1	Adds Conditional Access, 30 days of sign-in logs, automatic device enrollment
Entra ID P1 add-on	$7.00	P1	Adds P1 features to a Basic or Standard user
Entra ID P2 add-on	$10.00	P2	Adds risk-based sign-in policies and Privileged Identity Management

Microsoft’s Entra licensing page confirms that P1 is included in Business Premium and Microsoft 365 E3, and that P2 is included in Microsoft 365 E5. For Business Premium customers, P2 also comes inside the Microsoft Defender Suite for Business Premium add-on.

One detail that surprises people: self-service password reset (letting staff reset a forgotten password themselves) is not part of the Free edition. Microsoft’s SSPR licensing page lists it as available from Business Standard upward.

If you are weighing the upgrade, our Business Premium vs Business Standard comparison covers the rest of what changes.

What Are Security Defaults?

Security defaults are a single on or off switch that applies Microsoft’s baseline identity protections. They are free and available on every edition. According to Microsoft’s security defaults documentation, turning them on:

• Requires every user to register for MFA
• Requires administrators to complete MFA at every sign-in
• Prompts other users for MFA when Microsoft judges it necessary
• Blocks legacy authentication (older mail protocols such as IMAP, POP3, and basic SMTP that cannot do MFA)
• Blocks device code flow, a sign-in method that attackers abuse in phishing
• Requires MFA for anyone opening the Azure portal or Entra admin center

Microsoft says tenants created on or after October 22, 2019 may already have security defaults enabled. To check:

1. Sign in to entra.microsoft.com with an administrator account.
2. Go to Entra ID > Overview > Properties.
3. Select Manage security defaults.

Two limits are worth knowing. There is no customization, so you cannot exempt one account or treat the office network differently. And staff register with the Microsoft Authenticator app or another authenticator app that generates codes, so everyone needs a phone or tablet that can run one.

Security Defaults or Conditional Access?

Conditional Access is the customizable version: you write your own rules about who must do what to sign in. It requires Entra ID P1. Microsoft’s guidance is direct: organizations on the Free edition should use security defaults, and organizations with P1 or P2 will probably be better served by Conditional Access. You cannot run both, because security defaults must be turned off before Conditional Access policies take over.

We cover the starter policies, report-only testing, and the emergency account you need first in our Conditional Access guide for small offices.

Eight Entra ID Settings to Check

Set aside an hour with an administrator account. Paths are for the Entra admin center as of September 2026.

1. Security defaults or Conditional Access is on. Check the path above. If security defaults are off and Entra ID > Conditional Access > Policies is empty, nothing is requiring MFA.
2. Global Administrator count. Go to Entra ID > Roles & admins and open Global Administrator. Microsoft’s role best practices recommend fewer than five. Microsoft also suggests a separate admin account for administration, so the account that reads email all day is not the one that can change everything.
3. Emergency access accounts. Microsoft recommends two cloud-only emergency accounts with the Global Administrator role, not tied to any one person, so you can still get in if your normal admin is locked out or leaves.
4. Former staff. Go to Entra ID > Users and compare the list with your current payroll. Any account for someone who has left should be blocked and then handled with a proper offboarding checklist.
5. Guest accounts. Under Entra ID > External Identities and in the user list filtered to guests, look for outside people who were invited to a file or Team and no longer need access.
6. Self-service password reset. Go to Entra ID > Password reset. If your plan includes it, enable it for all users and require two verification methods.
7. User consent to apps. Under Enterprise apps > Consent and permissions > User consent settings, check whether any staff member can grant a third-party app access to company mail and files. Many offices prefer to allow only verified publishers, or to require an administrator to approve.
8. Sign-in logs. Go to Entra ID > Monitoring & health > Sign-in logs and look for failed attempts from unfamiliar countries or sign-ins by accounts you thought were unused. Microsoft keeps sign-in logs for seven days on the Free edition and 30 days on P1 and P2.

Separately from these settings, Microsoft now requires MFA for anyone signing in to its admin portals, including the Entra, Intune, and Microsoft 365 admin centers. If an old admin account has no MFA method registered, it will not be able to sign in to manage anything.

Do You Still Need an On-Premises Active Directory Server?

Active Directory is the older, server-based directory that runs on a Windows Server in the office. Entra ID is a different product that lives in Microsoft’s cloud. Microsoft supports running both and syncing them, which it calls hybrid identity.

An office with no server can run on Entra ID alone, with computers joined directly to it. If you do have a server, list what still depends on it (a line-of-business application, file shares, a printer setup) before deciding. Our guide to server vs cloud for small business walks through that decision.

When the Free Edition Is Enough

You may not need P1 if all of these are true: security defaults are on, everyone can use an authenticator app, staff use only company computers in one or two locations, and you have no compliance requirement to control which devices reach company data.

P1 starts to matter when you need exceptions or device rules, for example requiring that phones use a protected Outlook app, allowing a scanner account that cannot do MFA, or keeping more than seven days of sign-in history. P2 is rarely the first purchase for a small office. Its main additions respond automatically to sign-ins Microsoft scores as risky.

Common Mistakes

• Turning security defaults off to fix one problem device, then leaving them off with nothing in their place.
• Using one Global Administrator account for daily email.
• Giving every new hire the same group memberships as the person they sit next to, instead of what the role needs.
• Removing a license from a departed user but leaving the account able to sign in.
• Treating Entra ID as a one-time setup. Every hire, departure, and new app changes it.

Common Questions

Is Entra ID the same as Azure AD?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. The service, prices, and licenses carried over unchanged. Entra is now the family name for Microsoft’s identity products, and Entra ID is the member of that family that every Microsoft 365 customer uses.

Do we have to pay extra for Entra ID?

Not for the basics. The Free edition is included with every Microsoft 365 business plan, and P1 is included with Business Premium. You pay extra only if you add P1 or P2 to a plan that does not include it, at $7.00 or $10.00 per user per month as of September 2026.

Are security defaults enough for a five person office?

Often, yes. Security defaults require MFA and block the older sign-in methods that cannot support it, which addresses the most common account takeover routes at no cost. They stop being enough when you need an exception, want rules based on device or location, or must show an auditor device-level controls.

How do we find out which edition we have?

In the Entra admin center, the Overview page under Entra ID shows the license for your tenant (your organization’s instance of Microsoft 365). You can also check Billing > Your products in the Microsoft 365 admin center and match the plan name against the table above.

How Coastal Growth Co. Can Help

We review Microsoft 365 tenants for small businesses in Orange County: which edition you have, whether MFA is truly enforced, who holds admin roles, and which accounts should no longer exist. You get a plain-English list of what we found and what we would change first, and scope and price are agreed before any paid work. See our Microsoft 365 and cloud services or contact us to start.