We just finished rolling out Conditional Access for our external contractors. We’re a small SaaS shop, and the cost jump from Entra ID Free to P1 was significant for us.
I wanted to share our setup and the hard numbers, because I struggled to find this when we were planning. We have about 30 contractors who need occasional access to internal tools. Our main rule is simple: require MFA and block access from outside approved countries. We also set up terms of use for their first login.
The licensing math forced our decision. At roughly $6/user/month for P1, that’s $180/month just for contractors. We decided it was worth it after a near-miss with a compromised email. The break-even for us wasn't about direct ROI, but about avoiding a single incident. Has anyone else found a more cost-effective way to secure external identities without going full P1 for everyone?