Public coverage guide

Microsoft license coverage for ITDR

Clear view of what you get versus what is limited across Business Premium, Entra P1 / Microsoft 365 E3, and Entra P2 / Microsoft 365 E5. This is designed to remove connector setup ambiguity for PM, engineering, and SOC teams.

Last reviewed

September 11, 2026

Coverage labels represent current product behavior with tenant feed prerequisites, not marketing-only SKU claims.

New to Microsoft licensing? Start with the plain-English explainer.

Detection catalog Detection validation Knowledge base Open platform

What changed recently

Feed readiness guidance now aligns with explicit states used in detection validation pages.

Coverage copy is synchronized with current connector behavior and warning handling.

Coverage matrix

What users get by tier

ITDR feature	Entra Free (Business Basic / Standard, Office 365 E-plans, A1)	Business Premium (includes P1)	Entra P1 (Business Premium, M365 E3, F1 / F3, A3)	Entra P2 (M365 E5 / E7, A5, Defender Suite add-on)	Notes
Directory audit detections (OAuth consent abuse, rogue service principals, privileged app changes)	Core	Core	Core	Core	Entra audit logs are available on every tier (7-day retention on Free, 30 on P1/P2). Requires Graph permissions and connector health.
Sign-in detections (brute force, impossible travel, token replay, AiTM, device-code) and attack chains	Unavailable	Core	Core	Core	Microsoft only serves sign-in logs through Graph to P1/P2 tenants. On Entra Free the call returns 403 and 21 of the 31 detections cannot fire; the 10 that remain are the directory-audit, mailbox-rule and workload-inventory rules. Adding P1 turns the rest on with no ITDR change.
Office 365 mailbox-rule detections (BEC inbox rules, notification hiding)	Core	Core	Core	Core	Works on any Microsoft 365 subscription with unified audit logging on. Auto-managed connectors include this consent; delegated connectors need the separate Office 365 step.
Workload identity credential and impersonation detections	Core	Core	Core	Core	Inventory-diff detections that read service principals directly. Not gated by licence.
MFA coverage and Conditional Access posture checks	Unavailable	Core	Core	Core	The MFA registration report and Conditional Access policies are P1 features. On Free these checks show "Requires Entra ID P1" and are excluded from the score.
Just-in-time (PIM) and leaked-credential posture checks	Unavailable	Unavailable	Unavailable	Core	PIM eligibility and leaked-credential intelligence are P2 features. Shown as "Requires Entra ID P2" below that tier.
Risk-enriched sign-in context	Unavailable	Partial	Partial	Enhanced	Non-P2 tenants can return hidden or generic risk context. P2 gives richer risk detail.
Risky users and risk detections APIs	Unavailable	Partial	Partial	Enhanced	Risky-users needs P2. Risk detections return "additional risk detected" without detail below P2. Treat as enrichment.
Security alerts/incidents ingestion from Graph security APIs	Depends	Depends	Depends	Enhanced	Depends on Defender/XDR provisioning and entitlement, not only connector auth mode. Business Premium includes Defender for Business.
Containment actions (disable user, revoke sessions, group removal, app revocation, device lock/wipe)	Core	Core	Core	Core	Graph permissions and admin consent, not licence. Device actions additionally need Intune-managed devices (Intune is in Business Premium, E3+, F1/F3, A3+).

Which plan is which. Entra ID Free ships with Business Basic, Business Standard, the Office 365 E-plans and Microsoft 365 A1. Entra ID P1 comes with Business Premium, Microsoft 365 E3, F1, F3 and A3. Entra ID P2 comes with Microsoft 365 E5 and E7, A5, standalone P2, EMS E5, and the Defender Suite add-on for Business Premium. ITDR reads the tier from the service plans Microsoft reports for each subscribed SKU, so a bundle not named here is still classified correctly.

Microsoft licensing facts on this page were last verified against Microsoft documentation on 2026-09-11. Microsoft changes bundles and pricing on a yearly cadence (most recently July 2026); if a plan is missing or looks wrong, the tier reported inside the app for your tenant is the one to trust. Sources: Microsoft Learn — Product names and service plan identifiers for licensing; Microsoft Learn — Analyze activity logs with Microsoft Graph (P1/P2 required for sign-in logs); Microsoft Learn — Entra data retention (7 days Free, 30 days P1/P2); Microsoft Learn — Authentication methods usage report API (P1/P2 required); Microsoft Learn — Microsoft Entra licensing; Microsoft Learn — Office 365 Management Activity API reference.

Expected warnings

What warnings usually mean

identityProtection/riskyUsers -> 403 Forbidden

Tenant entitlement does not expose this risk feed at the expected depth.

Action: Keep core detections active; treat risk enrichment as partial unless upgrading entitlements.

security/alerts_v2 or /security/incidents -> 403 Unauthorized account not provisioned

Defender security workload is not provisioned for that tenant plan/config.

Action: Do not classify core sign-in/audit telemetry as down; mark security-provider feed as unavailable.

o365_management token fallback or 401 errors

Connector could not use tenant O365 delegated token path reliably.

Action: Run O365 consent for that connector again and verify feed subscription state.

Connector sync status shows synced_with_warnings

One or more optional feeds warned, even while core telemetry may still be flowing.

Action: Check feed-specific run status and event counts before treating tenant as fully degraded.

Microsoft UI checklist

How to unlock expected coverage

Microsoft Entra -> Enterprise applications -> ensure required Graph permissions are admin-consented.

ITDR Connectors -> use the auto-managed connector (one consent covers Graph, Office 365 Management and posture). Delegated connectors still need the separate O365 consent step.

Microsoft Purview / Audit settings -> verify unified audit logging is enabled for the tenant.

Microsoft Entra -> Licensing -> confirm tenant/user SKU baseline (Business Premium/P1/E3/P2/E5) matches expected depth.

Re-run ad hoc Sync now and validate feed-by-feed readiness, not only connector headline status.

Official references

Microsoft Entra licensing Entra sign-in and audit data retention Graph riskDetections API Office 365 Management Activity API