In short: The Microsoft Entra Suite is a per-user add-on that combines five Microsoft Entra products: Private Access (ZTNA), Internet Access (secure web gateway), ID Protection, ID Governance and Verified ID premium capabilities including Face Check. It needs Microsoft Entra ID P1 underneath and is included in Microsoft 365 E7.
What is in the Microsoft Entra Suite
The suite brings together Microsoft's identity security and Security Service Edge (SSE) products so access decisions, network controls and governance all use the same identities and conditional access policies.
| Component | What it does | Read more |
|---|---|---|
| Microsoft Entra Private Access | Zero trust network access to private and on-premises apps, replacing VPNs with Quick Access or per-app access through connectors | Entra Private Access |
| Microsoft Entra Internet Access | Identity-aware secure web gateway: web content filtering, TLS inspection, threat intelligence and conditional access for internet traffic | Entra Internet Access |
| Microsoft Entra ID Protection | Detects risky users and sign-ins and drives risk-based conditional access | Entra ID P1 vs P2 |
| Microsoft Entra ID Governance | Lifecycle workflows, entitlement management, access reviews and Privileged Identity Management | See below |
| Microsoft Entra Verified ID (premium) | Verifiable digital credentials, plus Face Check for high-assurance identity verification | See below |
Private Access and Internet Access together make up Global Secure Access, Microsoft's SSE. They use the Global Secure Access client on Windows, macOS, iOS and Android; branch sites can also forward Microsoft and internet traffic through remote network connections. A third traffic profile, for Microsoft 365 traffic (with compliant network checks and universal tenant restrictions), is included with Entra ID P1 and P2, so you can start using Global Secure Access before buying the suite. For how they compare with other approaches, see our SASE and ZTNA hubs.
Microsoft Entra ID Governance in detail
Governance is the component most organisations underestimate. It answers three questions auditors and insurers ask: who has access, why, and who approved it.
Lifecycle workflows Automated tasks triggered by joiner, mover and leaver events, typically driven by HR data through HR-driven or API-driven provisioning. A leaver workflow can disable the account, remove group and Teams memberships and notify the manager on the last working day, without relying on a ticket being raised. Microsoft documents a limit of 50 workflows per tenant, which is ample for most organisations, and custom extensions can call Logic Apps for steps Microsoft does not provide.
Entitlement management Access packages bundle the groups, Teams, SharePoint sites and applications a role needs. Users request a package, approvers (including managers or sponsors, with multi-stage approval) sign it off, and access expires automatically. Separation of duties rules stop someone holding incompatible packages, and guest access can be granted through connected organisations and then removed when it expires.
Access reviews Scheduled reviews of group membership, app access, guest accounts and privileged roles. Governance adds reviews scoped to inactive users, machine-learning-assisted recommendations, and reviews of PIM for Groups and catalogues.
Privileged Identity Management Just-in-time, time-bound and approved elevation to Entra and Azure roles, also available in Entra ID P2.
Governance needs Entra ID P1 underneath. You can buy Microsoft Entra ID Governance on its own, but the Entra Suite includes all of it.
Verified ID and Face Check
Microsoft Entra Verified ID lets an organisation issue digital credentials, such as a verified employee credential, that the user holds in Microsoft Authenticator and presents when needed. Core Verified ID is included with any Entra ID subscription.
Face Check is the premium part. It compares a live selfie, with a liveness check, against the photo held in the credential, using Azure AI services. The application asking for the check only receives a match confidence score, not the selfie, and Microsoft states that the selfie is discarded after processing rather than stored. Face Check works through Microsoft Authenticator on iOS and Android. The obvious use is the help desk: verifying that the person asking for a password reset or a new passkey really is the account owner, which is exactly the step social engineering attacks target. Outside the suite, Face Check is a separately billed add-on.
Prerequisites, E7 and licensing
The Entra Suite has three licensing points worth knowing:
- Entra ID P1 is a prerequisite. You need P1 or a plan that includes it, such as Microsoft 365 Business Premium or E3.
- It is included in Microsoft 365 E7. Microsoft lists E7 as including the Entra Suite, so E7 customers already hold all five components. See our Defender Suite and E7 guide.
- Each component is also sold on its own. Private Access, Internet Access and ID Governance are available as standalone products, and ID Protection comes with Entra ID P2.
Separately, Microsoft Entra Agent ID gives AI agents their own identities and is available to all Entra customers. Extending Entra security features such as conditional access to those agents needs a Microsoft Agent 365 licence, which is included in E7 but not in the Entra Suite on its own. Pricing for any of these: ask us for a quote.
The suite or individual components?
| Situation | Usually the better fit |
|---|---|
| You want to replace a VPN and nothing else | Entra Private Access standalone, or another ZTNA product |
| You already have P2 and a third-party web gateway | Entra ID Governance standalone |
| You want ZTNA, web filtering and governance together | The Entra Suite |
| You are on Microsoft 365 E5 and considering E7 | Compare E7 with E5 plus the Entra Suite |
| You need help desk identity verification | The Entra Suite (Face Check included) or the Face Check add-on |
The suite tends to make sense once you need at least two of the paid components. If you already run a third-party SSE or SASE platform, Private Access can run side by side with it, but it is worth deciding which platform owns which traffic before you buy.
Microsoft Entra Suite deployment checklist
A practical order for rolling the suite out without disrupting users:
- Confirm every in-scope user holds Entra ID P1 (directly or through Business Premium, E3 or E5) and an Entra Suite licence.
- Start with ID Governance: connect your HR source or API-driven provisioning, then build a leaver lifecycle workflow and test it on a pilot group.
- Move privileged roles into PIM and schedule access reviews for guests and admin roles.
- Deploy the Global Secure Access client to a pilot group and enable the Microsoft traffic profile first, which also works with P1 alone.
- Publish private apps through Private Access one at a time, starting with those users currently reach over VPN.
- Add Internet Access policies for web content filtering, then TLS inspection once certificates are in place.
- Set up Verified ID and Face Check for help desk password resets and new passkey enrolment.
Each step is tested against real sign-in and traffic logs before it is enforced.
How we help
We start by checking which Entra capabilities you already own, then design the rollout: Private Access app by app, Internet Access policies, governance workflows tied to your HR process, and Face Check for the help desk. We test against real users before enforcing anything. Contact us using the form below and ask us for a quote.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does the Microsoft Entra Suite include?
Five products: Microsoft Entra Private Access, Microsoft Entra Internet Access, Microsoft Entra ID Protection, Microsoft Entra ID Governance and the premium capabilities of Microsoft Entra Verified ID, including Face Check.
Do I need Entra ID P1 to buy the Entra Suite?
Yes. Microsoft requires an Entra ID P1 subscription, or a package that includes P1 such as Microsoft 365 Business Premium or E3, for users of the Entra Suite.
Is the Entra Suite included in Microsoft 365 E5?
No. Microsoft 365 E5 includes Entra ID P2, which covers ID Protection and Privileged Identity Management, but not Private Access, Internet Access, full ID Governance or Face Check. Microsoft 365 E7 includes the Entra Suite.
What is Global Secure Access?
Global Secure Access is Microsoft's name for Microsoft Entra Internet Access and Microsoft Entra Private Access together, its Security Service Edge. It is managed in the Global Secure Access area of the Microsoft Entra admin centre.
Can I buy Entra ID Governance without the full suite?
Yes. Microsoft Entra ID Governance is available as a standalone product. The Entra Suite becomes better value when you also want Private Access, Internet Access or Face Check.