"Don't we already have this in our Entra license?" — the answer for MSPs

First, what Microsoft actually delivers, because it is real. Administrative units give scoped delegation over parts of the directory. Custom roles let you assemble a rights set for a specific need. PIM makes privileges temporary instead of standing. Lifecycle Workflows automate tasks at hire, role change and departure. If your client has one tenant, a strong IT team and the time to configure all of this properly, they will get far — and you should tell them so.

But for an MSP, the model breaks in three places.

The first is the chain. Microsoft has delegation, and Microsoft has automation — but not the chain where a person with no rights at all submits a structured request, the right person approves, and an automation layer executes exactly what was approved with one consolidated trail. Those building blocks exist separately; the connection is yours to build and maintain. Once, that is a project. Per client tenant, it is product development nobody pays you for.

The second is the architecture. Everything in the Entra license is built for one organisation at a time. PIM configuration, Lifecycle Workflows, administrative units — all of it is set up, monitored and maintained per tenant, with no surface across them. If you operate 300 client tenants, you have 300 separate installations of everything, and no consolidated view of any of them.

The third is the economics. The functionality above does not sit in the base license — it requires P2 and the Governance add-on, and stacked, the list price lands at 17--24 USD per user per month before anyone has spent an hour on implementation. [VERIFY prices against Microsoft's own pricing page before publication.] Be honest about the nuance at the same time: if the client already pays for P2 through E5, the marginal cost of the add-on is the right comparison, not the gross price. Calculate correctly, not in your own favour — clients notice the difference.

Entra Logic is not a replacement for Entra ID; it is the management layer Microsoft has not built for your operating model. Orders instead of direct editing, approval per tenant under each client's own rules, automatic execution against Graph, and the whole portfolio in one surface with cost and license reporting per client. The client keeps their Microsoft platform — you get the governance around it.

So when the question comes, the answer is: "Partly — and what Microsoft provides, we should use. But the chain from request to guaranteed execution, across all the companies, is not in the license. That is what we deliver." An honest answer to this question is, moreover, a trust-building act in itself — the MSP that explains to a client what they do not need to buy gets believed on everything else.