For many organisations, identity has become the new security perimeter.

Employees access Microsoft 365, cloud applications and business data from:

• offices
• homes
• mobile devices
• managed laptops
• personal networks
• locations around the world

That flexibility is valuable.

It also means an attacker who obtains a valid identity may no longer need to break through the office firewall.

They can simply attempt to sign in through the same cloud services your employees use every day.

Multi-factor authentication and standard Conditional Access remain essential.

But businesses increasingly need to answer more difficult questions:

Is this sign-in risky?

Does Microsoft believe the account credentials may have been compromised?

Does this administrator genuinely need permanent Global Administrator access?

Should this user still have the permissions they were granted six months ago?

That is where advanced Microsoft Entra security becomes particularly important.

Microsoft Entra ID P2 remains one of the main ways to obtain those capabilities.

But in 2026, businesses should understand exactly what P2 provides—and how it now fits alongside Microsoft Entra ID Governance and the wider Microsoft Entra Suite.

What Is Microsoft Entra ID P2?

Microsoft Entra ID is Microsoft's cloud identity and access-management platform, previously known as Azure Active Directory.

It controls areas such as:

• user identities
• authentication
• application access
• administrator roles
• Conditional Access
• identity risk

Microsoft Entra ID P1 provides important capabilities including Conditional Access and other identity-management features and is included with products such as Microsoft 365 Business Premium. Microsoft confirms that Entra ID P2 is available separately and is also included in Microsoft 365 E5.

P2 adds particularly important capabilities around:

Microsoft Entra ID Protection

and:

Privileged Identity Management — PIM.

Those two areas are the strongest reason many organisations consider moving beyond P1.

The Important 2026 Licensing Change

This is the section I would add most prominently.

Historically, people often thought:

Need PIM or advanced identity governance? Buy Entra ID P2.

That is no longer the complete picture.

Microsoft now offers:

• Microsoft Entra ID P2
• Microsoft Entra ID Governance
• Microsoft Entra Suite

with overlapping advanced identity capabilities.

Microsoft says:

PIM can be licensed through either Entra ID P2 or Entra ID Governance.

Microsoft also states that all currently generally available Identity Governance features already in P2 remain available, but new Identity Governance and Administration capabilities will no longer be added to the P2 SKU.

That means P2 is still highly relevant.

But organisations planning a broader identity-governance strategy should also assess whether:

Entra ID Governance

or:

Microsoft Entra Suite

is a better long-term fit.

1. Microsoft Entra ID Protection Detects Identity Risk

One of the strongest P2 capabilities is Microsoft Entra ID Protection.

Identity Protection analyses sign-in and account activity for signs that an identity may be compromised.

Microsoft says it provides risk information around:

• risky users
• risky sign-ins
• identity detections

and allows risk to be integrated into Conditional Access policies.

This is valuable because a compromised account does not always behave obviously.

An attacker may:

• access email
• search SharePoint
• read Teams conversations
• inspect payment processes

for days before doing anything dramatic.

Identity risk detection gives security teams another signal beyond:

“The password was correct.”

2. Risk-Based Conditional Access

Standard Conditional Access is already powerful.

It can evaluate things such as:

• user
• application
• device
• location

and apply controls such as MFA.

With Entra ID Protection, Conditional Access can also react to:

user risk

and:

sign-in risk.

Microsoft confirms that full risk policies require Entra ID P2 or Microsoft Entra Suite.

For example:

Normal sign-in

User signs in from their usual managed laptop.

Access proceeds normally.

Higher-risk sign-in

Microsoft detects suspicious sign-in behaviour.

Policy can require stronger verification.

High-risk user

The identity itself is believed to be compromised.

Policy can block access or require remediation.

That creates a much more adaptive identity-security model than simply requiring the same challenge for every sign-in.

3. Privileged Identity Management Reduces Permanent Admin Access

This is probably the strongest reason to consider P2 for administrators.

Many businesses still have several people permanently assigned roles such as:

• Global Administrator
• Exchange Administrator
• SharePoint Administrator
• Security Administrator

That means highly privileged access is available:

24 hours a day

even when nobody is actively administering anything.

Microsoft Entra Privileged Identity Management allows organisations to make users eligible for privileged roles instead of assigning those permissions permanently.

When access is required, the administrator activates the role.

Depending on configuration, activation can require:

• MFA
• justification
• approval
• time-limited access

Microsoft explicitly describes PIM as providing just-in-time and time-bound privileged access.

That dramatically reduces standing privilege.

Why Standing Administrator Access Is Dangerous

Suppose a normal user account is compromised.

That is serious.

Suppose a permanently active Global Administrator account is compromised.

The potential impact is much greater.

An attacker may be able to:

• change authentication settings
• create administrators
• alter Conditional Access
• register applications
• access sensitive information
• weaken security controls

PIM cannot make administrator compromise impossible.

But it reduces the period during which those powerful roles are active.

That follows one of the most important security principles:

give people only the privilege they need, only when they need it.

PIM for Groups Is Important Too

PIM is not limited to directory roles.

Microsoft also supports PIM for Groups, allowing membership or ownership of selected groups to become eligible and activated temporarily.

That can be useful when group membership itself grants:

• application access
• privileged capability
• sensitive data access

Again, eligible users need appropriate licensing through Entra ID P2 or Entra ID Governance.

4. Access Reviews Help Reduce Privilege Creep

Access accumulates.

Employees:

• change roles
• move departments
• join projects
• receive temporary access
• cover colleagues

and permissions are often never removed afterwards.

Over time, an employee may have far more access than their current job requires.

Entra governance capabilities can support recurring access reviews so organisations periodically confirm whether users still need:

• roles
• group membership
• application access

The current Hamilton Group article is right to highlight this.

But I would now be careful about presenting advanced access governance purely as a P2 story because Microsoft's licensing direction increasingly separates Identity Governance as its own product family.

5. It Improves Identity Incident Response

Without identity-risk tooling, an investigation may begin only after:

• employee reports phishing
• finance spots suspicious activity
• customer receives strange email
• security team notices unusual logs

Identity Protection can surface risk earlier and allow policy to react automatically.

Depending on configuration, a risky event might trigger:

• stronger authentication
• password remediation
• access blocking

before an administrator manually investigates.

Microsoft explicitly positions Identity Protection as a system for detecting, investigating and remediating identity-based risks.

That does not replace:

• SOC monitoring
• incident investigation
• Defender
• security expertise

but it can reduce the amount of time a suspicious account remains unrestricted.

6. P2 Supports a Better Zero Trust Model

Zero Trust is often simplified to:

Never trust, always verify.

The important part is that trust is not granted permanently because:

• the user knows the password
• the device is inside the office
• yesterday's sign-in was legitimate

Advanced Entra controls allow access to be influenced by current identity risk.

That means:

same username

can receive:

different security treatment

depending on current conditions.

A normal login may proceed.

A suspicious login may require stronger verification.

A genuinely high-risk account can be blocked.

That is much closer to the way modern cloud identity should work.

7. Microsoft 365 Business Premium Does Not Include Full P2

This remains one of the most important licensing points for SMEs.

Microsoft confirms that Microsoft 365 Business Premium includes Microsoft Entra ID P1, not full Entra ID P2.

Business Premium is still an excellent SME security package.

It gives organisations capabilities including:

• Conditional Access
• Intune
• Defender for Business
• Microsoft 365 productivity services

depending on configuration.

But it does not automatically provide the full P2 Identity Protection and PIM capabilities.

If an SME wants advanced identity-risk detection or just-in-time privileged-role management, licensing needs to be reviewed separately.

Microsoft 365 E5 Does Include Entra ID P2

For larger organisations, Microsoft says Entra ID P2 is included with:

Microsoft 365 E5.

That means an organisation already using E5 may already own the technology.

The real question then becomes:

Has it actually been configured?

Buying P2 does not automatically:

• remove standing Global Administrators
• create PIM policies
• configure risk-based Conditional Access
• review access

The licence provides capability.

The security value comes from implementing it.

Do You Need P2 for Every Employee?

This needs nuanced wording.

PIM licensing needs to cover users who benefit from or interact with PIM in the relevant licensed scenarios, including eligible privileged-role users and certain approvers/reviewers. Microsoft publishes specific licensing examples for this.

Identity Protection, meanwhile, is most valuable when the users whose identity risk you want to evaluate are appropriately licensed.

So do not use:

“We bought one P2 licence and switched the feature on.”

as the licensing strategy.

That may make a technical option appear in the portal without making the organisation properly licensed.

Microsoft licensing should be matched to the users and features actually being consumed.

Should Only Administrators Get P2?

For some SMEs, administrators are the obvious first area to evaluate because PIM provides such a strong reduction in privileged risk.

But compromised standard accounts matter too.

A normal employee account can still be used to:

• send internal phishing
• access SharePoint
• steal files
• impersonate employees
• target finance

So the business decision should consider:

who needs PIM

and separately:

who should be protected by full identity-risk capabilities.

Those may not be the same population.

Entra ID P2 vs Entra ID Governance

This distinction deserves its own section now.

Entra ID P2

Strong fit when you need capabilities including:

• Identity Protection
• PIM
• existing P2 governance capabilities

Entra ID Governance

Microsoft's newer governance-focused product, adding additional identity-governance functionality and also licensing PIM.

Microsoft says new IGA functionality will be added to the Governance product rather than Entra ID P2.

Microsoft Entra Suite

Broader identity and network-access package combining services such as:

• Identity Protection
• Entra ID Governance
• Private Access
• Internet Access
• Verified ID

according to Microsoft's current licensing documentation.

This means businesses should no longer automatically conclude:

“We need advanced Entra security, therefore P2 is definitely the only licence to buy.”

Review the actual capability requirements first.

P2 Is Not a Replacement for Strong MFA

Another thing I would make explicit:

Do not buy P2 while basic identity hygiene is still weak.

Before advanced controls, businesses should already have:

• MFA
• properly designed Conditional Access
• protected administrator accounts
• limited legacy authentication
• sensible emergency-access accounts

P2 enhances those foundations.

It does not make weak identity architecture safe by itself.

PIM Should Not Be Rolled Out Blindly

A poorly implemented PIM deployment can cause serious operational problems.

Before changing privileged roles:

1. Inventory current administrators.
2. Identify which roles truly need permanent access.
3. Create emergency-access arrangements.
4. Convert appropriate accounts to eligible access.
5. Configure activation requirements.
6. Test activation.
7. Validate monitoring and alerts.
8. Document recovery procedures.

Do not accidentally leave the organisation without usable administrative access.

Microsoft itself protects against removal of the last active Global Administrator and Privileged Role Administrator assignments in PIM-related workflows.

Use Conditional Access Report-Only Mode

Before enforcing major risk-based Conditional Access changes, test them.

Microsoft's Identity Protection deployment guidance explicitly recommends evaluating Conditional Access policies in Report-only mode before enforcement.

That lets IT understand:

• who would be blocked
• which applications are affected
• whether exclusions are correct

before causing a Monday-morning lockout.

Who Should Consider Advanced Entra Controls?

I would strongly consider them where an organisation:

• depends heavily on Microsoft 365
• has several privileged administrators
• handles sensitive customer information
• has finance/payment risks
• operates in regulated sectors
• uses contractors and guests extensively
• has experienced account compromise
• needs stronger auditability
• is implementing Zero Trust

The more valuable the identity, the stronger the argument.

The Business Case Is Not “More Microsoft Security”

Boards rarely need to hear:

“We need Entra ID P2 because it includes PIM.”

A better explanation is:

Our administrators currently retain powerful access continuously. Moving to just-in-time privileged access reduces the time those permissions exist and therefore reduces the potential impact of a compromised administrator account.

Or:

We currently authenticate users based largely on credentials and static access policies. Identity Protection allows us to react automatically when Microsoft detects evidence that the account or sign-in may be compromised.

Those are business-risk arguments.

They are much easier to justify.

A Practical Identity Security Roadmap

For many SMEs I would approach it like this:

Stage 1 — Get P1 foundations right

• MFA
• Conditional Access
• separate administrator accounts
• device compliance
• secure authentication

Stage 2 — Protect privileged access

Introduce:

• PIM
• eligible roles
• time-limited activation
• approval where appropriate

Stage 3 — Introduce risk-based identity controls

Use:

• Identity Protection
• user risk
• sign-in risk
• automated remediation

Stage 4 — Improve governance

Review:

• privileged roles
• groups
• application access
• guest access

Stage 5 — Review licensing direction

Decide whether the organisation is best served by:

• Entra ID P2
• Entra ID Governance
• Microsoft Entra Suite

rather than continuing to add licences piecemeal.

Why Advanced Entra Identity Security Is Critical Now

The biggest change in modern cyber security is not that passwords stopped mattering.

It is that correct credentials no longer prove the person using them is legitimate.

A modern identity system needs to understand:

• account risk
• sign-in risk
• privilege
• device state
• authentication strength
• application sensitivity

and react accordingly.

Entra ID P2 remains an extremely strong way to add that capability.

But the wider 2026 Microsoft identity platform has evolved.

The strategic question is now:

Which combination of Identity Protection, PIM and Identity Governance capabilities does the organisation need—and which Entra licence provides them most sensibly?

How Hamilton Group Can Help

Hamilton Group can help businesses review Microsoft Entra and Microsoft 365 identity security, including:

• Microsoft Entra ID P1 and P2
• Microsoft Entra ID Governance
• Microsoft Entra Suite
• Microsoft Entra ID Protection
• Privileged Identity Management
• Conditional Access
• MFA
• administrator security
• access reviews
• licensing optimisation

The objective is not simply to buy a higher-tier licence.

It is to reduce standing privilege, detect compromised identities earlier and build access controls that respond to real risk.

Visit hgmssp.com or call 0330 043 0069 to discuss Microsoft identity security.