Entra ID P1 / P2 Licence Compliance

The question it answers: Which members benefit from Conditional Access or PIM without holding the matching Entra ID P1 or P2 licence?

Members who benefit from Conditional Access (Entra ID P1) or from risk-based policies and Privileged Identity Management (Entra ID P2) without holding the matching licence. The features keep working - but the tenant is under-licensed, which surfaces in audits and true-ups.

Note

Enabled member accounts only; guests are billed through External ID monthly active users. AAD_PREMIUM_P2 counts as P1 as well. Uses the same CA scoping as the CA Coverage Gaps report.

At a glance

Where in the app	Licensing › Entra P1/P2 Compliance
Workload	Licensing
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	None; Conditional Access policies need Microsoft Entra ID P1 and PIM eligibility Microsoft Entra ID P2 to exist.
Report id (API and MCP)	entra.licensing.entra-premium-compliance

Columns

Column	Key	Type
User	DisplayName	Link
UPN	UserPrincipalName	Text
Requires	Requires	Status
Because	UsedBecause	Text
Current licences	AssignedLicences	Text

What it needs

Licence: None; Conditional Access policies need Microsoft Entra ID P1 and PIM eligibility Microsoft Entra ID P2 to exist.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
Policy.Read.All	Microsoft Graph	Read your organization’s policies
Group.Read.All	Microsoft Graph	Read all groups
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
Organization.Read.All	Microsoft Graph	Read organization information

Data sources it reads

• GET /v1.0/users
• GET /v1.0/identity/conditionalAccess/policies
• GET /v1.0/roleManagement/directory/roleEligibilityScheduleInstances
• GET /v1.0/subscribedSkus

Through the API and MCP

GET /ir-api/v1/reports/entra.licensing.entra-premium-compliance?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.licensing.entra-premium-compliance. The client needs the Read grant for Licensing. See Using the API.