Is Entra ID Governance included in E5? No, here's the gap

No. Microsoft 365 E5 includes Microsoft Entra ID P2, and P2 already comes with a real slice of governance — Privileged Identity Management, access reviews, and the core of entitlement management. What it does not include is the product Microsoft actually calls Microsoft Entra ID Governance. That's a separate subscription, and for an E5 tenant it shows up as an add-on with its own SKU.

Here's Microsoft's own wording, from its licensing documentation: “Microsoft Entra ID P2 is available as a standalone product or included with Microsoft 365 E5 for enterprise customers.” Nothing in that sentence mentions Governance, because P2 and Governance are two different products with two different prerequisites.

What Entra ID Governance actually is

Microsoft's definition is specific: Entra ID Governance is “an advanced set of identity governance capabilities available for Microsoft Entra ID P1 and P2 customers.” It's sold as six products — Microsoft Entra ID Governance, Microsoft Entra ID Governance Step Up for Microsoft Entra ID P2, Entra ID Governance Frontline Worker, and three government-cloud variants — and Microsoft says these six “differ only in their prerequisites.” All six give you the same capability set; the SKU you buy just depends on what you already have.

For a tenant that already has E5 (and therefore already has P2), the relevant product is Microsoft Entra ID Governance Step Up for Microsoft Entra ID P2. Its prerequisite, per Microsoft Learn, is a subscription containing the AAD_PREMIUM_P2 service plan — examples given include Microsoft Entra ID P2 itself and Microsoft 365 E5/A5/G5. In plain terms: if you're already on E5, this is the SKU that adds Governance on top of what you have, rather than making you re-buy P2 a second time.

What E5 / Entra ID P2 already gives you

This is the part worth knowing before you buy anything else, because it's more than most IT leads assume. As of September 2026, per Microsoft Learn, P2 already includes:

Capability	What it covers
Privileged Identity Management (PIM)	Time-bound, just-in-time role activation for Entra and Azure roles
PIM for Groups	Eligible (time-bound) ownership and membership of groups, including PIM Conditional Access controls
Access reviews (core)	Self-reviews and group reviews, including decision helpers for reviewers assessing inactive users
Entitlement management (core)	Access packages covering groups and teams, applications, and SharePoint sites; users requesting access for themselves; admins directly assigning users, including guests
Approval options	Multi-stage approvals with alternate approvers, specific approvers, managers as approvers, and internal or external sponsors as approvers from an assignee's connected organization
Access package lifecycle	Expiration of assignments, managing the lifecycle of external users, separation of duties, Conditional Access scoping
My Access portal	The self-service portal itself, plus My Access search
Identity governance dashboard	Also included with P1

That's a genuinely usable governance baseline. If your organization's whole ask is "let people request access, route it through approvals, and let it expire," P2 alone already does that.

What the Governance add-on gives you that E5 doesn't

The capabilities below are gated to Microsoft Entra ID Governance or Microsoft Entra Suite in Microsoft's own features-by-license table — P2 does not include them. We've paired each with the plain-English reason a mid-market IT lead ends up caring about it:

Governance-only capability	Why it matters in practice
Lifecycle Workflows, plus custom extensions (Logic Apps)	Automates the joiner/mover/leaver process itself — the thing most tenants still do by hand in a checklist or a ticket
Machine-learning-assisted access reviews	Surfaces recommendations on a review instead of leaving a manager to rubber-stamp fifty rows they don't remember approving
Reviews scoped to inactive users, without needing active users in the same review	Lets you certify only the accounts that look stale, instead of burying that signal inside a review of everyone
"Mark guest as governed," plus inactive-guest insights and reporting	Gives you a way to see and flag guest accounts nobody remembers inviting
Auto-assignment policies for access packages	Grants access automatically to a defined population instead of waiting for each person to request it
Entra roles in access packages (preview)	Lets an access package include an Entra admin role, not just apps and groups
Verified ID, Entra ID Protection and Microsoft Purview Insider Risk Management integrations	Feeds those signals into governance decisions rather than keeping them siloed
Managers requesting access on behalf of employees; sponsors as approvers (from the assignee's own profile)	Extends who can initiate or approve a request beyond the requester and their connected-organization contacts
PIM custom extensions for role activation (preview)	Lets a role activation trigger custom logic instead of just a built-in approval

How to decide whether you need it

This isn't a decision that needs a Microsoft rep to make for you. Run through this short list first:

• Is your joiner/mover/leaver process still manual? If provisioning and de-provisioning run on a checklist, an email, or "someone remembers," Lifecycle Workflows is the feature you're actually asking for.
• Do you have guest sprawl you can't currently see? If nobody can answer "which external accounts still need access," the inactive-guest insights and "mark guest as governed" capabilities are built for exactly that gap.
• Are auditors asking for access certifications you can't produce cleanly today? P2's access reviews can run a certification. Governance's ML-assisted reviews and inactive-user scoping make that certification faster to produce and easier to trust.
• Do you need access to expire or auto-assign without a person requesting it each time? Auto-assignment policies are Governance-only; P2's entitlement management is request-driven.

If the honest answer to all four is "no, not right now," Entra ID P2 — which you already have with E5 — may be enough. That's a legitimate outcome, and it costs nothing to reach it.

The ways to actually get it

If you decided you need it, there are four paths, and which one applies depends on what you already hold:

• Already on E5 (P2)? Add Microsoft Entra ID Governance Step Up for Microsoft Entra ID P2 — the SKU built for tenants that already have the AAD_PREMIUM_P2 service plan.
• On P1 only (E3, Business Premium)? The base Microsoft Entra ID Governance SKU is the one to add — its prerequisite is P1 or P2, and Microsoft's own examples for that prerequisite include Microsoft 365 E3/E5/A3/A5/G3/G5.
• Want the wider bundle instead of Governance alone? Microsoft Entra Suite includes Governance plus Entra Private Access, Entra Internet Access, Entra ID Protection and Entra Verified ID. Microsoft's product page lists it at $12.00 user/month, paid yearly — that page does not list a standalone price for Entra ID Governance itself, so check current figures with your licensing provider before budgeting.
• Already planning a move to Microsoft 365 E7? Per Microsoft Learn, E7 “also includes all ID Governance features through the Entra Suite and Agent 365,” so no separate Governance purchase is needed on top of it.

A Global Administrator in a qualifying tenant that already holds a prerequisite product can also request a trial of Entra ID Governance directly from the Microsoft 365 admin center, per Microsoft Learn, which is a reasonable way to see the ML-assisted reviews and Lifecycle Workflows against your own data before committing to a purchase. Government tenants have their own equivalent SKUs — Entra ID Governance for Government and the P2 add-on for Government — available in GCC, GCC High and DoD clouds, per Microsoft Learn.

One thing worth saying plainly: we're a consultancy, not a licensing reseller. We don't sell, bill, or discount Microsoft licenses, and nothing above is a quote. What we do is help you work out which of these SKUs actually matches a gap you have — then build the Lifecycle Workflows, access reviews, or entitlement management catalog that makes the license worth what you paid for it.

As of September 2026, per Microsoft Learn, that's the shape of it: E5 gives you P2's governance baseline for free within the bundle, and the Governance product is a deliberate, separate add-on for the capabilities P2 was never built to include. Microsoft can and does revise this table, so treat today's answer as current, not permanent.

Sources

Feature-to-license claims above are drawn from the "Features by license" table in Microsoft's Microsoft Entra ID Governance licensing fundamentals (updated 2026-09-14), read and parsed column by column rather than from its flattened prose, which drops empty cells. Provisioning features from that table are deliberately excluded here because we could not verify their columns with confidence.

Broader licensing context — which Microsoft 365 plans include Entra ID P1, P2 and the Entra Suite — comes from Microsoft Entra licensing (updated 2026-07-28). The $12.00 user/month Entra Suite figure is quoted from Microsoft's Entra ID Governance product page, which lists no standalone price for Entra ID Governance itself.

If you'd rather have someone map your current licenses against your actual joiner/mover/leaver and access-review gaps before you buy anything, scope it with us.