Entra ID P1 licensing for two break-glass accounts when Diagnostic settings exports tenant-wide sign-in logs

Polina Zhuravskaya 0 Reputation points
2026-10-20T08:29:32.7733333+00:00

Hello Microsoft team,

We need clarification on the Microsoft Entra ID P1 licensing requirements for monitoring two emergency access (break-glass) accounts.

Our main question is:

Can we purchase and assign only two Entra ID P1 licenses to these emergency accounts and remain compliant if Diagnostic settings exports sign-in logs for the entire tenant, but Azure Monitor alerts evaluate only these two accounts?

We would appreciate clarification on both the licensing requirements and the actual export behavior.

Current environment

  • The organization uses Microsoft 365 Business Standard, not Business Premium.

Our administrator has confirmed that there are currently no Entra ID P1/P2 licenses or Microsoft 365 E3/E5 subscriptions.

Security Defaults is enabled, and we intend to preserve the existing protection.

We have an Azure subscription and an existing Log Analytics workspace.

No Microsoft Entra diagnostic settings are currently configured.

We can view individual users’ sign-in logs in the Entra admin center and download filtered records manually.

The Diagnostic settings page displays this message:

In order to export Sign-in data, your organization needs Azure AD P1 or P2 license.

We understand that Business Standard does not include Entra ID P1, whereas Business Premium does.

Intended monitoring scenario

We are planning two dedicated, cloud-only emergency administrator accounts in the tenant’s onmicrosoft.com domain, following Microsoft’s emergency access account guidance.

We want to detect:

Successful and failed sign-in attempts involving these accounts.

Relevant Microsoft Entra audit events initiated by, or affecting, these accounts.

The proposed monitoring architecture is:

Purchase two Entra ID P1 licenses and assign one to each emergency account.

Configure Microsoft Entra Diagnostic settings to send SignInLogs and AuditLogs to Log Analytics. We may also include NonInteractiveUserSignInLogs to cover non-interactive sign-in activity.

Create Azure Monitor log search alert rules that filter events using the Object IDs of the two emergency accounts.

Send notifications through an Azure Monitor Action Group.

The purpose of purchasing P1 would be to support this monitoring scenario. We are not planning to deploy Conditional Access or other premium features across the organization.

Why the licensing scope is unclear

In Diagnostic settings, we can select log categories and destinations, but we do not see an option to limit the source export to particular users.

Our understanding is therefore that the proposed setting could export events for the entire tenant, with filtering for the two emergency accounts happening after export, in the Log Analytics queries and alert rules.

We have also been advised that only events from users assigned P1 would be exported automatically, but we have not found official documentation confirming this behavior.

Clarifications requested

1. Is the proposed two-license configuration compliant?

If sign-in records for users without P1 are exported to Log Analytics, does restricting the alert queries to the two licensed emergency accounts make two P1 licenses sufficient?

Or must P1/P2 coverage extend to every user whose sign-in records are exported, even when their records are not selected by our monitoring rules?

2. Does export automatically exclude users without P1/P2?

Once sign-in log export is enabled, does Microsoft Entra:

Export events only for users individually assigned a qualifying license; or

Export the selected tenant-wide log categories, potentially including events for users without P1/P2?

Please clarify whether individual license assignment actually controls which users’ events enter the export stream.

3. Who needs the licenses in this scenario?

Please clarify whether the licensing requirement applies to:

The two monitored emergency accounts;

All users whose sign-in events are exported;

Administrators or identities accessing the reports;

Or another defined population.

If coverage is required for everyone represented in the export, please also clarify how guest-user events should be treated.

4. Would restricting collection before storage change the requirement?

Is there a supported way to collect only the two emergency accounts’ sign-in events? Would ingestion-time filtering in Log Analytics change the required license coverage, or only the volume of data stored?

If a scheduled Microsoft Graph query filtered to these two users has different licensing requirements from Diagnostic settings, please clarify those requirements separately.

Documentation reviewed

We reviewed Microsoft’s emergency access guidance:

Manage emergency access accounts in Microsoft Entra ID

We also found these Q&A discussions:

Sign-in log export licensing through Diagnostic settings and Event Hub, which states that a premium license is required for each user whose sign-in logs are exported.

Sign-in activity licensing through Microsoft Graph API, where a Microsoft employee suggests that one license assigned to the user accessing the reporting API may be sufficient.

We recognize that these discussions concern different collection methods and may not establish the requirements for our proposed configuration.

Please provide the applicable Microsoft licensing documentation or Product Terms supporting the answer. If confirmation depends on our purchasing agreement or requires a separate licensing support request, please identify the appropriate channel and the information we should provide.

We want to establish the correct license quantity before purchasing licenses or enabling production export.

Thank you.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-20T08:31:18.3166667+00:00

    Two Entra ID P1 licenses should technically enable the proposed tenant-wide sign-in-log export, because the directly matching accepted Microsoft Q&A guidance states that a single P1 or P2 license is sufficient to ingest organization-wide Entra sign-in logs; obtain written licensing confirmation before production if contractual compliance under your purchasing agreement must be established.^1^

    Direct answers

    1. Are two licenses technically sufficient?
      Yes, based on the accepted Q&A guidance: one Entra ID P1/P2 license enables sign-in-log ingestion, so two also meet that stated technical prerequisite. This guidance addresses service enablement, however—not definitive Product Terms entitlement for every represented user.^1^ The official licensing page lists sign-in logs under both Free and P1/P2 monitoring capabilities, but also says its licensing options are not comprehensive. It does not state that every member or guest appearing in a diagnostic export must receive P1.^2^
    2. Does license assignment determine whose events are exported?
      The documented Diagnostic settings model selects log categories and destinations, not users. Selecting SignInLogs, NonInteractiveUserSignInLogs, or AuditLogs routes those categories from the tenant; the documentation does not describe per-user license assignment as an export filter.^3^ Therefore, do not rely on assigning P1 to the two emergency accounts to exclude unlicensed users’ events. Filtering by the two object IDs occurs when querying or alerting over the data already sent to Log Analytics.
    3. Who must be licensed?
      The available official documentation establishes that the tenant needs an appropriate Entra license for the access method, but it does not identify a per-exported-user population for this scenario.^4^ It also does not conclusively specify, for Diagnostic settings:
      • that every user represented in exported logs needs P1;
      • that only the administrator configuring or reading the export needs P1;
      • how guest records should be counted.
      Consequently, the statement that “every user whose event is exported requires P1” is not established by the supplied official product documentation. The unaccepted Q&A thread on that point should not be treated as binding licensing terms.
    4. Would pre-storage filtering change licensing?
      Diagnostic settings do not offer user-level source filtering. The SigninLogs and AuditLogs tables support workspace transformations, but that describes data-processing capability, not a change to Entra licensing entitlement.^5^^6^ Thus, ingestion-time filtering may reduce retained data or cost, but there is no supplied licensing statement showing that it narrows the required licensed population. Do not use it as the basis for a compliance determination.

    If the organization accepts the accepted-Q&A guidance for technical deployment:

    1. Purchase and assign the two standalone P1 licenses as proposed.
    2. Sign in with at least the documented least-privileged Security Administrator role.
    3. Go to Microsoft Entra admin center → Entra ID → Monitoring & health → Diagnostic settings → Add diagnostic setting.
    4. Select:
      • SignInLogs
      • NonInteractiveUserSignInLogs, if required
      • AuditLogs
    5. Select Send to Log Analytics workspace, choose the subscription and workspace, and save. Microsoft notes that logs can take up to three days to begin appearing.^3^
    6. Scope the Azure Monitor alert queries to the accounts’ immutable object IDs.

    For example:

    let EmergencyAccounts = dynamic([
  "00000000-0000-0000-0000-000000000001",
  "00000000-0000-0000-0000-000000000002"
]);
SigninLogs
| where UserId in (EmergencyAccounts)
| project TimeGenerated, UserId, UserPrincipalName,
          ResultType, ResultDescription, IPAddress, AppDisplayName

    Create separate audit-log logic for events where either the initiator or target matches an emergency-account object ID. Microsoft recommends monitoring every sign-in and audit event for emergency accounts and validating the accounts at least every 90 days.^7^

    Microsoft Graph is a separate access method

    Graph filtering does not establish a different per-user licensing rule. Official Graph guidance requires:

    • a tenant associated with Entra ID P1 or P2;
    • both AuditLog.Read.All and Directory.Read.All;
    • the appropriate reporting role for delegated access.

    Graph is also not recommended for pulling large volumes of activity data because of pagination and performance considerations.^8^

    Obtain contractual confirmation

    Before enabling production export, ask Microsoft licensing support or your licensing reseller/account team to confirm in writing:

    • agreement type and enrollment or agreement number;
    • tenant type and cloud;
    • Microsoft 365 Business Standard quantities;
    • two standalone Entra ID P1 licenses;
    • selected diagnostic categories and tenant-wide routing behavior;
    • alerts limited to two object IDs;
    • member and guest populations;
    • whether ingestion-time transformations are planned.

    For volume licensing, open Microsoft 365 admin center → Help & support and search for manage volume licensing; Microsoft’s support page also provides the volume-licensing request route.^9^

    References

    1. What licenses do I need in order to ingest Entra ID data into my Log Analytics database - Microsoft Q&A
    2. Microsoft Entra licensing - Microsoft Entra | Microsoft Learn
    3. Configure Microsoft Entra diagnostic settings for activity logs
    4. Access activity logs in Microsoft Entra ID - Microsoft Entra ID
    5. SigninLogs
    6. AuditLogs
    7. Manage emergency access accounts in Microsoft Entra ID
    8. How to analyze activity logs with Microsoft Graph
    9. [Work account](https://support.microsoft.com/support/#microsoft-365-volume-licensing-support)
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.