Microsoft launched the Entra Suite in July 2024 as a $12/user/month bundle combining five previously disparate identity and security products. For organisations that need more than Entra ID P2 alone, the Suite is one of the better-value bundles in the Microsoft commercial catalogue — delivering what would cost $24–$30/user/month standalone for less than half the price. But the suite economics only make sense if you need at least three of the five included components. This guide breaks down exactly what is in the bundle, what it replaces, and how to negotiate it effectively.
Independent Advisory. Zero Vendor Bias.
500+ Microsoft EA engagements. $2.1B in managed spend. 32% average cost reduction. We negotiate on your behalf — never Microsoft's.
View Advisory Services →What Is Included in the Entra Suite?
The Entra Suite at $12/user/month includes all of the following products as of 2026:
| Product | What It Does | Standalone Price | Replaces |
|---|---|---|---|
| Microsoft Entra ID P2 | Advanced identity protection, PIM, risk-based Conditional Access | $9/user/month | Azure AD Premium P2 |
| Microsoft Entra Private Access | ZTNA — per-app access to private resources without VPN | $3/user/month | Corporate VPN, Zscaler ZPA, Palo Alto Prisma |
| Microsoft Entra Internet Access | SWG — internet traffic filtering, Microsoft 365 traffic protection | $5/user/month | On-premises web proxy, Zscaler ZIA |
| Microsoft Entra ID Governance | Access reviews, lifecycle workflows, entitlement management | $7/user/month | SailPoint, Saviynt, manual joiner-mover-leaver processes |
| Microsoft Entra Verified ID Premium | Decentralised identity credential issuance and verification | $3/user/month | Manual verification processes, third-party identity verification |
| Total standalone value | $27/user/month | ||
| Entra Suite | $12/user/month |
The stated saving is 56% vs standalone. In practice, some standalone products are available at EA-discounted rates that narrow the gap — but the Suite still represents compelling value when you need three or more of the included products.
The Entra Permissions Management Inclusion (Critical Nuance)
Microsoft's marketing materials sometimes list Entra Permissions Management as part of the Suite. The reality is more nuanced. Permissions Management (formerly CloudKnox) is a cloud infrastructure entitlement management (CIEM) tool that bills per cloud resource, not per user. The Entra Suite provides access to Permissions Management's discovery and reporting capabilities, but full remediation and enforcement features require separate resource-based licensing. Do not assume the Suite covers your entire CIEM requirement — the per-resource cost for Permissions Management can be significant at scale for organisations with large AWS, Azure, or GCP footprints ($8/resource/month).
When the Entra Suite Makes Financial Sense
Scenario 1: M365 E3 Users Needing Security Uplift
An organisation on M365 E3 ($36/user/month) that needs Private Access (VPN replacement), Internet Access (web proxy replacement), and basic Identity Governance is spending $15/user/month on three standalone products. The Entra Suite at $12 covers all three plus adds Entra ID P2 (worth $9 standalone) for $3 less. This is the clearest value case.
Scenario 2: M365 E5 Users Adding SSE Capability
An organisation on M365 E5 already has Entra ID P2. The incremental value of the Entra Suite is Private Access ($3), Internet Access ($5), ID Governance ($7), and Verified ID ($3) — $18 in standalone value — for $3 additional per user per month above what Entra ID P2 alone costs via E5. If you need Private Access + ID Governance + Internet Access, the Suite at $3 incremental over the P2 you already own is essentially free.
Scenario 3: ZTNA + Identity Governance Only
Private Access ($3) + ID Governance ($7) standalone = $10/user/month. The Suite at $12 adds Internet Access and Verified ID for $2 more. If you are evaluating a web proxy refresh simultaneously, the Suite is the rational choice. If you are definitively keeping an existing SWG solution, buy standalone products at $10 vs paying $12 for unused Internet Access capability.
Get an Independent Second Opinion
Before you sign your next Microsoft agreement, speak with an adviser who has no commercial relationship with Microsoft.
Request a Consultation →Entra Suite vs Competing Identity & SSE Bundles
| Vendor | Bundle | Typical Price | Comparable Components |
|---|---|---|---|
| Microsoft | Entra Suite | $12/user/month (list); $9–$10.50 EA | IDaaS + ZTNA + SWG + IGA + Verified ID |
| Zscaler | Business Bundle | $18–$25/user/month | ZIA (SWG) + ZPA (ZTNA) — no IGA or Verified ID |
| Okta | Workforce Identity Cloud | $15–$25/user/month | IDaaS + IGA + PAM (no built-in SSE) |
| Palo Alto | Prisma Access + AI Access | $12–$20/user/month | SSE (ZTNA + SWG) — no IGA |
| Ping Identity | PingOne Cloud Platform | $15–$22/user/month | IDaaS + SSO + IGA |
Microsoft's Entra Suite has a significant price advantage against comparable bundles from Zscaler, Okta, and Palo Alto when evaluated on a per-component basis. The caveat is maturity — Zscaler and Palo Alto have deeper SSE feature sets, and Okta has more mature IGA capabilities. For organisations already standardised on Microsoft infrastructure, the integration simplicity of the Entra Suite often outweighs the feature gaps.
Global Secure Access: Entra Internet Access Deep-Dive
Entra Internet Access, included in the Suite, provides three distinct capabilities:
1. Microsoft 365 traffic profile — Routes M365 traffic through Microsoft's global PoP network, bypassing MPLS backhaul and improving Teams/Exchange performance. This is significant for branch offices where internet access currently routes through a central hub.
2. Secure Web Gateway — URL filtering, web content categories, FQDN-based policies, TLS inspection (Preview as of early 2026). Replaces basic on-premises proxy functionality but lags behind mature SWG vendors in policy granularity and bypass detection.
3. Conditional Access integration — Security tokens issued by Global Secure Access can be used as conditions in Entra Conditional Access policies, enabling "require compliant network" as an access condition — a Zero Trust signal source that traditional VPNs cannot provide.
Important maturity caveat: As of early 2026, Entra Internet Access does not support full DLP (Data Loss Prevention) for outbound web traffic — a key capability of mature SWG platforms. Organisations with strict data exfiltration requirements should evaluate whether Entra Internet Access meets their compliance obligations before replacing an existing SWG investment.
Identity Governance: What You Get in the Suite
Entra ID Governance (included in the Suite) covers the joiner-mover-leaver lifecycle and access entitlement management. Key capabilities:
- Lifecycle Workflows — Automated onboarding/offboarding tasks triggered by HR system events (Workday, SAP SuccessFactors, BambooHR via API)
- Entitlement Management — Access packages combining app assignments, group memberships, and SharePoint sites; self-service request with approval workflows
- Access Reviews — Scheduled reviews of group memberships, app assignments, and privileged roles with automated enforcement
- Privileged Identity Management (PIM) — Just-in-time privileged access for Entra roles and Azure RBAC (requires P2, included in Suite)
- Separation of Duties — Incompatible access package policies to prevent conflicting entitlements (SOD enforcement)
For organisations running manual joiner-mover-leaver processes or using spreadsheets for access reviews, the ID Governance component alone generates measurable ROI. A 2,000-person organisation processing 400 joiners/movers/leavers per year at 2.5 hours of manual effort per event is spending approximately $48,000/year on identity administration. Lifecycle Workflows typically reduces this by 70–80%.
EA Negotiation Tactics for the Entra Suite
Tactic 1: Competitive Bundle Comparison
Present Microsoft with a documented Zscaler or Okta bundle evaluation showing higher per-user pricing for fewer capabilities. Microsoft's commercial team is authorised to respond to competitive comparisons with additional EA discounts (typically 10–20% beyond standard EA levels). Ensure the comparison is on identical components — Zscaler ZIA+ZPA vs Entra Internet Access+Private Access, not a full Zscaler enterprise suite against the Entra Suite.
Tactic 2: Phase the Deployment, Lock the Price
Negotiate the Entra Suite for your full user population on a three-year EA term, but commit to staged deployment: 25% of users activated in year one (pilot/IT/security team), 75% in year two, 100% by month 18 of year two. The three-year commit gets you the lowest price; the phased deployment reduces operational risk and year-one pressure. Microsoft's FastTrack team provides free deployment support for qualifying Entra Suite customers, typically worth $40,000–$80,000 in implementation services.
Tactic 3: Use the M365 E5 Upgrade Conversation as Leverage
If your Microsoft account team is pitching M365 E5 upgrades, the Entra Suite conversation is a useful counterweight. E5 at $21/user/month above E3 is a significant commitment; the Entra Suite at $12 delivers comparable identity and SSE value without upgrading the full M365 stack. Use this optionality to extract better pricing on whichever path you choose — Microsoft will sharpen the E5 price when it sees you are seriously evaluating the Entra Suite as an alternative.
📄 Free Guide: Microsoft Identity & Zero Trust Licensing Guide
Complete framework covering Entra Suite, Private Access, Zero Trust deployment, and EA negotiation strategy.
Download Free Guide →Entra Suite vs M365 E5 Security Add-On: Key Differences
| Feature | Entra Suite ($12) | M365 E5 Security Add-On (~$12) |
|---|---|---|
| Entra ID P2 | ✓ | ✓ |
| Entra Private Access (ZTNA) | ✓ | ✗ |
| Entra Internet Access (SWG) | ✓ | ✗ |
| Entra ID Governance | ✓ | ✗ |
| Defender for Endpoint P2 | ✗ | ✓ |
| Defender for Office 365 P2 | ✗ | ✓ |
| Defender for Identity | ✗ | ✓ |
| Microsoft Defender for Cloud Apps | ✗ | ✓ |
At the same approximate price point, the Entra Suite and the M365 E5 Security Add-On serve entirely different needs. Entra Suite is for identity modernisation and network security (SSE/ZTNA). M365 E5 Security is for endpoint and email threat protection. Organisations that need both require both — they are not alternatives to each other. This is a nuance that Microsoft's commercial team sometimes glosses over when pitching "security."
Related Microsoft Identity Licensing Guides
- Microsoft Identity & Zero Trust Licensing: Complete Guide
- Microsoft Entra Private Access Licensing: ZTNA Guide
- Entra ID P1 vs P2: Feature and Pricing Comparison
- Microsoft Entra ID Governance Licensing Guide
- Entra Cross-Tenant Access Licensing
- Entra Certificate-Based Authentication Licensing
- Zero Trust Network Access vs VPN: Licensing Guide
- Microsoft 365 Defender Licensing Comparison 2026