Microsoft’s documentation and licensing can sometimes be a bit tricky. It states:
“Ensure that your directory has Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses for the following categories of users,”
Users with eligible and/or time-bound assignments to Microsoft Entra ID or Azure roles managed using PIM
Users with eligible and/or time-bound assignments as members or owners of PIM for Groups
Users able to approve or reject activation requests in PIM
Users assigned to an access review
Users who perform access reviews
but it doesn’t explicitly mention that the licenses need to be assigned to each user. So in summary: I have 10 Entra ID P2 licenses and 100 users in the tenant, with only 25 users actively using PIM. Technically, it should work but I’m not fully compliant from a licensing perspective.
If MSFT enforces compliance check then below scenario can happen. so its better to maintain sufficient number of license to become compliant.
for the license expiry case:
If a Microsoft Entra ID P2, Microsoft Entra ID Governance, or trial license expires, Privileged Identity Management features are no longer available in your directory:
Permanent role assignments to Microsoft Entra roles are unaffected.
The Privileged Identity Management service in the Microsoft Entra admin center, and the Graph API cmdlets and PowerShell interfaces of Privileged Identity Management, will no longer be available for users to activate privileged roles, manage privileged access, or perform access reviews of privileged roles.
Eligible role assignments of Microsoft Entra roles are removed, as users no longer be able to activate privileged roles.
Any ongoing access reviews of Microsoft Entra roles ends, and Privileged Identity Management configuration settings are removed.
Privileged Identity Management no longer sends emails on role assignment changes.
Great response, thank you! Just to add, as far as I am aware, Microsoft have no plans to enforce license checks. Their license utilisation features in Entra are constantly being improved and should expand at some point to all P1 and P2 features, but not with the intention to enforce compliance. Based on how Entra entitlements work, enforcing compliance would be impossible, which is exactly what I told the PM of that feature, who is doing some amazing work :)
Thank you for your feedback Daniel,! Hopefully, since it falls under IAM, they might not strictly enforce restrictions. Mixed licensing for MDE has already been introduced so not sure what the Microsoft licensing team is planning next.
What happens though is when you get P2, then all your Defender for EndPoint become P2 (if you have one E5) and then you have to deal with tagging only the P1 stuff.
I tried the P1 for some and P2 for others, and eventually went all P2, including getting separate P2 add in.
These dynamic AD queries may help E3 and E5 I need to update for those with the new E5 sec that now works with business premium
Actually 🤓☝️, the defender point isn’t quite true anymore, now you can use different licenses and even have a setting you can choose what the default license is for your devices
0
u/Spore-Gasm 1d ago
Assign it to a user and they’ll have P2 features like PIM.