Business Premium, F1 and F3 include it, so a company already on one of those has it. On every other plan it is bought on its own.
What Conditional Access does
A policy reads several things about a sign-in and returns one of three answers. P1 decides on rules somebody wrote; reacting to a sign-in that merely looks unusual is Entra ID P2.
Require a second factor before a sign-in is allowed.
Block a sign-in coming from an unexpected place, or from a device the company does not manage.
Reset a forgotten password back to the on-premises directory.
Which plans include it
Every plan compared on this site, and whether Conditional Access is part of it.
Plan
Per person, per month
Included
Microsoft 365 Business Basic
$9
Not included
Microsoft 365 Apps for business
$13
Not included
Microsoft 365 Business Standard
$18
Not included
Microsoft 365 Business Premium
$28
Included
Microsoft 365 F1
$4
Included
Microsoft 365 F3
$13
Included
Where a plan does not include it, Microsoft Entra ID P1 supplies it at $9 a seat.
Where it stops
Risk-based policies — the ones that react to a sign-in looking unusual rather than to a fixed rule — are not part of P1. Those need Entra ID P2.
Worth knowing
The plans below Business Premium carry the free tier of Entra ID, not P1. Security defaults are available to everyone.
Security defaults switch multi-factor authentication on for everyone, and they are available on every plan. Microsoft Entra ID P1 is what makes the rule conditional: a second factor when the sign-in comes from somewhere unexpected, or from a device the company does not manage.
P1 covers rules written in advance: this place, this device, this application. P2 adds risk-based sign-in policy and access reviews, and reacts to a sign-in that looks unusual rather than to a fixed rule. It is $13 a seat.
