Loading page
Feature matrix for Entra ID, Intune, and Microsoft 365 SKUs. Licensing changes; treat this as a planning sheet, not a quote.
| Feature | Entra ID P1 | Entra ID P2 | Intune Plan 1 | Intune Suite | M365 Business Premium | M365 E3 | M365 E5 |
|---|---|---|---|---|---|---|---|
SSO / app gallery Identity | Yes | Yes | — | — | Yes | Yes | Yes |
Conditional Access Identity | Yes | Yes | — | — | Yes | Yes | Yes |
Authentication strengths / phishing-resistant MFA Identity | Yes | Yes | — | — | Yes | Yes | Yes |
Identity Protection (risk-based CA) Identity | — | Yes | — | — | — | — | Yes |
Privileged Identity Management Identity | — | Yes | — | — | — | — | Yes |
Entra application proxy Identity | Yes | Yes | — | — | Yes | Yes | Yes |
Intune device management Endpoint | — | — | Yes | Yes | Yes | Yes | Yes |
App protection (MAM) Endpoint | — | — | Yes | Yes | Yes | Yes | Yes |
Windows Autopilot Endpoint · Needs Intune + a Windows entitlement. | — | — | Yes | Yes | Yes | Yes | Yes |
Endpoint Privilege Management Endpoint | — | — | — | Yes | — | — | — |
Remote Help Endpoint | — | — | — | Yes | — | — | — |
Microsoft Tunnel / MAM-WE Endpoint | — | — | — | Yes | — | — | — |
Windows LAPS with Entra / Intune Endpoint · Windows Enterprise + Intune or GPO. Cloud backup needs Entra. | — | — | Yes | Yes | Yes | Yes | Yes |
Defender for Endpoint P2 Threat | — | — | — | — | — | — | Yes |
Defender for Endpoint P1 / Business Threat | — | — | — | — | Yes | Partial | — |
Purview DLP / sensitivity labels (full) Compliance | — | — | — | — | Partial | Partial | Yes |
Yes / add-on / partial. Business Premium is capped at 300 seats. Confirm with a CSP before you buy. Related: Intune Win11 checklist · LAPS age calculator.