3-year view · published prices only
What remote access to your own directory actually costs.
Most vendor cost comparisons work by quietly assuming you pay full list for everything on their side of the table. This one states its conditions out loud — including the one that makes our own argument weaker.
Read this before you use any Entra cost argument
Entra ID P1 is included with Microsoft 365 E3, and P2 is included with E5. If your organisation is standardised on those tiers, you are already paying for the Entra plan and moving off it saves you nothing on that line. Any vendor telling you that four hundred users means four hundred times seven dollars, without first asking your M365 tier, is either not checking or hoping you will not.
Where ControlIT changes the maths for an E3 or E5 customer is not the licence. It is the VPN appliance, the separate MFA and RMM subscriptions, the hybrid-join project, and running Azure AD Connect as production infrastructure — plus the part that is not a cost at all: the directory never leaving your control.
The published numbers
These are Microsoft list prices, in USD, on annual commitment, reflecting the 1 July 2026 increase. They are the only prices on this page we will print, because they are the only ones published.
| Plan | List price | Terms | Already bundled? |
|---|---|---|---|
| Microsoft Entra ID P1 | USD 7 / user / month | Annual commitment | Included with Microsoft 365 E3 |
| Microsoft Entra ID P2 | USD 10 / user / month | Annual commitment | Included with Microsoft 365 E5 |
| Microsoft Entra Suite | USD 12 / user / month | Annual commitment | Not bundled into E3 or E5 |
Microsoft changes list pricing, regional pricing differs, and EA or CSP agreements differ again. Verify against your own agreement before this reaches a board paper.
The lines you fill in yourself
We will not print an appliance price, because appliance pricing varies by model, throughput, support tier, and whatever your reseller did at the last renewal. Any number we invented would be wrong for most readers. Bring your renewal quote instead.
- VPN concentrator hardware, plus the refresh you have already been quoted for
- Annual support and subscription on that appliance
- Per-user or per-tunnel VPN client licensing, at your actual peak concurrency
- The separate MFA product, if identity licensing does not already cover it
- RMM or endpoint-management subscription, per endpoint per year
- A separate remote-support or screen-sharing tool, if you run one
- Engineering hours spent on VPN tickets, split-tunnel routing, and certificate renewals
- One-off project cost of hybrid join and Azure AD Connect, if Entra is the alternative path
What ControlIT does and does not take off the bill
Typically replaces
- The VPN concentrator and its client licensing
- A separate remote-access or screen-sharing tool
- A standalone MFA product, where TOTP satisfies the requirement
- A separate RMM subscription
- Azure AD Connect and the hybrid-join project, where Entra was only being adopted to enable remote work
Does not replace
- Microsoft 365 itself — your mail and productivity licensing is untouched
- Entra features you genuinely use for cloud-app governance, Conditional Access, or PIM
- Your firewall, your endpoint protection, or your backup platform
- The domain controllers themselves, which stay exactly where they are
Questions about the maths
Is Entra ID actually a new cost for us?
Only if you are not already on Microsoft 365 E3 or E5. P1 is included with E3 and P2 is included with E5, so an organisation standardised on those tiers pays nothing incremental for the Entra plan itself. If that is you, the cost argument for moving off Entra is weak and we will say so — the argument that still stands is sovereignty and the operational cost of hybrid join, not the licence line.
Then why does anyone move off Entra for this?
Because the licence is rarely the real cost. The real cost is the hybrid-join project, running Azure AD Connect as production infrastructure, and accepting that a copy of your directory lives in a vendor cloud. For organisations under data-localisation, CERT-In, DPDP, or air-gap requirements, that last point is not a cost question at all — it is a constraint.
Why are there no Fortinet or Cisco numbers on this page?
Because appliance pricing varies enormously by model, throughput, support tier, and what your reseller actually did on the last renewal. Any number we printed would be wrong for most readers and would discredit the rest of the page. Bring your renewal quote to the review and we will work with the real figure.
What does ControlIT itself cost?
It is licensed per site and per endpoint rather than per user, self-hosted, with no per-user identity fee. There is no published rate card because deployment size, module mix, and whether you want it managed change the number materially. See the pricing posture page for what is and is not charged for.
Do you produce this as a spreadsheet?
Yes. During the readiness review we build it against your actual contract values — appliance renewal, client licences, M365 tier, endpoint count — and you keep the working file whether or not you proceed.
How current are the Microsoft prices on this page?
They reflect published list pricing following Microsoft’s 1 July 2026 increase, in USD, on annual commitment. Microsoft changes these, regional pricing differs, and your EA or CSP agreement may differ again — treat this table as a starting point and verify against your own agreement before it reaches a board paper.
Build this against your actual contracts
During the 45-minute readiness review we fill this in with your appliance renewal, your client licences, your M365 tier, and your endpoint count. You keep the working file either way.