Count what the current stack costs.
Only published list prices appear in the table below. Every other line is a worksheet entry you fill from your own contracts.
Inventing an appliance number would make the whole page worthless the moment you checked it.
The only prices we will print.
Microsoft publishes these. Whether they are a new cost for you depends entirely on your Microsoft 365 tier.
| Plan | List price | Terms | Bundled with |
|---|---|---|---|
| Microsoft Entra ID P1 | USD 7 per user per month | Annual commitment | Included with Microsoft 365 E3 |
| Microsoft Entra ID P2 | USD 10 per user per month | Annual commitment | Included with Microsoft 365 E5 |
| Microsoft Entra Suite | USD 12 per user per month | Annual commitment | Not bundled into E3 or E5 |
If you are standardised on E3 or E5 you pay nothing incremental for the Entra plan itself, and the cost argument for moving off it is weak. We will tell you that rather than pretend otherwise.
The lines to add up.
Fill these from your own renewals. The total is usually larger than the licence line anyone argues about.
- VPN concentrator hardware, plus the refresh you have already been quoted for.
- Annual support and subscription on that appliance.
- Per-user or per-tunnel VPN client licensing, at your actual peak concurrency.
- The separate MFA product, if identity licensing does not already cover it.
- Endpoint management subscription, per endpoint per year.
- A separate remote support or screen sharing tool, if you run one.
- Engineering hours on VPN tickets, split tunnel routing and certificate renewals.
- The one-off project cost of hybrid join and directory sync, if that is the alternative path.
What changes on the bill, and what does not.
What one deployment replaces.
- The VPN concentrator and its client licensing.
- A separate remote access or screen sharing tool.
- A standalone MFA product, where time-based codes satisfy the requirement.
- A separate endpoint management subscription.
- The hybrid join project, where that was only being adopted to enable remote work.
What it does not replace.
- Microsoft 365 itself. Your mail and productivity licensing is untouched.
- Entra features you genuinely use for cloud app governance, Conditional Access or PIM.
- Your firewall, your endpoint protection and your backup platform.
- The Domain Controllers, which stay exactly where they are.
Four vendors, or one.
Three ways to find out if it fits.
AD Readiness Review
Forty-five minutes on your directory and remote access, and a one-page verdict you can circulate.
Book the reviewThe 14-Day Pilot
Five criteria agreed in writing first, then tested on real endpoints. If it fails, you walk.
Plan a pilotTalk to Us
Tell us about your sites, endpoints and directory. We will tell you what the overlay changes.
Talk to us
What people ask about the maths.
01Is Entra ID actually a new cost for us
Only if you are not already on Microsoft 365 E3 or E5. P1 is included with E3 and P2 with E5, so an organisation standardised on those tiers pays nothing incremental for the plan itself. If that is you, the cost argument is weak and we will say so. The argument that still stands is sovereignty and the operational cost of hybrid join.
02Then why does anyone move
Because the licence is rarely the real cost. The real cost is the hybrid join project, running a directory sync as production infrastructure, and accepting that a copy of your directory lives in a vendor cloud. Under data localisation, CERT-In or DPDP requirements that last point is not a cost question at all. It is a constraint.
03Why there are no appliance prices here
Appliance pricing varies enormously by model, throughput, support tier and what your reseller did on the last renewal. Any number we printed would be wrong for most readers and would discredit the rest of the page. Bring your renewal quote to the review and we will work with the real figure.
Bring your renewal quote.
We will total what you run today against one deployment, using your figures rather than ours, and tell you if the maths does not favour us.