ENTRA ID - Licenses and Features Licenses FREE Provides user and group management, on prem directory synchronization and cloud resources, basic reports, self-service password change for cloud users, and SSO across Azure, MS 365, and other SaaS applications. P1 - Everything in Free plus: Hybrid user access both on-prem and cloud resources, advanced administration such as dynamic groups, self-service group management, MS Identity Manager, and Cloud-write back capabilities. P2 - Everything in P1 plus: ENTRA ID Protection for risk-based conditional access to apps, company data, and Privileged Identity Management. PIM allows for discovering, restricting, and monitoring administrators and their access to resources - "just in time" access when needed. Pay as You Go  Self-Explanatory. Pay for features and services with various factors being used to determine cost.