Suite or specialist: what Microsoft and Okta include in each tier

Prices below are from the vendors' pricing pages, read on 27 September 2026, per user per month and paid or billed annually.

What does each Microsoft tier include?

• Entra ID Free: included with Microsoft cloud subscriptions; MFA and single sign-on across SaaS apps.
• Entra ID P1, $7.00: adds Conditional Access. Included in Microsoft 365 E3 and Business Premium.
• Entra ID P2, $10.00: adds ID Protection and risk-based Conditional Access. Included in Microsoft 365 E5.
• Entra ID Governance, $7.00: lifecycle workflows, access reviews and entitlement management. Requires P1 or P2.
• Entra Suite, $12.00: requires P1.
• Workload ID, $3.00 per workload identity.

Defender for Identity comes with EMS E5 or A5, Microsoft 365 E5 and the E5 or F5 Security plans, or as a standalone licence whose price is not stated.

What does each Okta tier include?

• Starter, $6: SSO, MFA, Universal Directory and 5 Workflows.
• Core Essentials, $14: adds Adaptive MFA, Lifecycle Management, Access Governance and 50 Workflows.
• Essentials, $17: adds Privileged Access and two admins.
• Professional and Enterprise: priced on request. Identity Threat Protection is an add-on from Essentials up and is included in Professional; the pricing table marks Okta Identity Governance as included from Essentials upward, and a footnote describes it as an add-on.

Okta states a $1,500 annual minimum and a 30-day Starter trial.

What does neither suite document in our sources?

Application coverage. Microsoft covers part of it: account discovery shows app users who match no Entra ID user, and its documentation for apps without provisioning describes a CSV export and manual matching. Okta's pages we read do not describe governing apps outside its integration catalog. Privileged access is partial for both: Okta lists Privileged Access in its Essentials suite, and Microsoft's Privileged Identity Management needs Entra ID P2 or ID Governance licences.

When does a specialist make sense?

• When depth on one job matters more than one console: several certification campaign types (SailPoint), effective permissions down to entitlements (Veza), inline response during authentication (Silverfort), or Active Directory recovery (Semperis).
• When you might change identity provider later: a separate governance platform stays in place.
• When many applications sit outside the catalog: Saviynt documents onboarding disconnected apps inside its IGA, and Orchid Security documents discovering them and feeding the IGA you run.

When does the suite make sense?

• When you already pay for the tier that includes the job.
• When most of your applications are in the provider's catalog.
• When the team is small and one console matters more than depth.

An illustrative calculation

For 1,000 people already on Microsoft 365 E3, P1 is included, so adding Entra ID Governance at $7.00 is $7,000 per month, or $84,000 a year at list price. For 1,000 people on Okta Core Essentials at $14, the list price is $14,000 per month, or $168,000 a year, and that tier also covers sign-in, MFA and directory. The two figures do not compare like for like: one adds governance to sign-in you already own, the other buys both. That is the point of reading tiers by job.