Entra License Types
You manage entra license types by matching user roles to the right directory plan. Admins buy seats in the tenant and link them to security groups. Most teams start with the base plan included in their cloud subscription. They upgrade specific users when those people need stronger login checks or role rules. Giving everyone the highest plan wastes budget, while broad group roles grant too much power. How entra license types work in your directory Microsoft splits its directory plans into four
Microsoft Entra ID (Azure AD): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You manage entra license types by matching user roles to the right directory plan. Admins buy seats in the tenant and link them to security groups. Most teams start with the base plan included in their cloud subscription. They upgrade specific users when those people need stronger login checks or role rules. Giving everyone the highest plan wastes budget, while broad group roles grant too much power.
How entra license types work in your directory
Microsoft splits its directory plans into four main levels for workforce users. The Free tier comes with basic cloud subscriptions and handles user accounts and group sync. It lets your team log in to cloud apps with single sign-on. The Plan 1 tier adds rules that check device health and location before login. It also lets users reset their own passwords and manage dynamic groups. The Plan 2 tier adds risk checks that spot strange login behavior in real time. It also includes privileged role tools so admins only hold high rights for short windows. The Governance tier sits at the top and automates account life cycles and access reviews. Admins assign these seats to groups so new hires get the right plan on day one.
What directory plans solve and where the gap remains
Picking the right plan solves the problem of who can log in to your apps. Conditional rules check user risk, device state, and location at the front door. Role management ensures that an engineer only gets admin rights after an approval step. Still, directory plans stop working once the login step finishes and the session starts. A directory seat cannot see what commands an engineer runs inside a server. It cannot inspect which database rows a user reads during an active session. If an approved user runs a bad query, the identity plan will not stop it. It also will not rewrite sensitive fields like emails, phone numbers, or card numbers in results. Your directory logs show that a user signed in, not what data they touched.
How to size seats for engineering and data teams
Start by listing which team members only need basic app sign-in versus admin roles. Standard business users often do fine on Plan 1 for conditional login rules. Engineers who touch production systems usually need Plan 2 for temporary role activation. Contractors and guests may need governance features so their accounts expire on a set date. Group-based assignment keeps this tidy as people join or leave a project. Even with clean seat assignment, you still need controls inside the session itself. Pairing your directory groups with command-level checks closes the gap after login. You can require peer approval for risky commands and mask national IDs in query output.
Microsoft Entra ID (Azure AD): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Can I mix different directory plans in the same tenant?
Yes, you can buy and assign different plans within one tenant. You link each plan to specific security groups based on what those users need.
Do guest users need their own paid directory seats?
External guests are covered by workload rules based on monthly active users. You only pay extra if guests use advanced identity governance features.
Does a higher directory plan log the SQL queries my team runs?
No, directory plans only log sign-in events, group changes, and role activations. They do not capture database queries, terminal commands, or returned data rows.