Conditional Access
Answer: Microsoft Entra ID P1 is the common baseline; risk-based policies require P2 capabilities.
Administrator playbook
Decide, verify, and document
Use the curated answer as a starting point, then prove the outcome against the target tenant or device.
What it means
- P1 supports standard Conditional Access
- P2 adds Identity Protection risk signals
What to check next
- Verify every benefiting user is appropriately licensed
- Confirm the exact policy features used
Verify success
- Confirm the SKU is assigned to every benefiting user or covered device.
- Confirm the required service plan is enabled, not merely present in the tenant.
- Re-test the exact feature after license propagation and record the result.
Escalate when
- Microsoft documentation and the tenant SKU/service-plan view disagree.
- The feature remains unavailable after assignment and normal propagation.
- A purchase or renewal decision depends on contract-specific product terms.
Copyable admin briefAnswer, next checks, source, and review date
List subscribed SKUs
Get-MgSubscribedSku | Select-Object SkuPartNumber,ConsumedUnits,PrepaidUnitsRead-only. Confirms tenant inventory; it does not prove that a service plan is enabled for a specific user.
Evidence to preserve
- Exact feature and workload
- Users or devices benefiting from it
- Assigned SKU and enabled service plans
- Tenant region and purchase channel