Azure-docs: AADP1 vs AADP2 Feature Comparison

[aakash-shah]

Please provide clarity showing what reports are available with "Azure AD Premium P1 edition" and "Azure AD Premium P2 edition". For instance, is "Users with leaked credentials" included in AADP1? What specific attributes are not included for "Users with leaked credentials" with AADP1? A matrix/table would be helpful for this.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 198f0e69-af2a-8c82-041a-c5ca4126f02f
• Version Independent ID: 4be57788-f1c2-d6d4-b94a-a59350a618a7
• Content: Azure Active Directory risk detections
• Content Source: articles/active-directory/reports-monitoring/concept-risk-events.md
• Service: active-directory
• Sub-service: report-monitor
• GitHub Login: @MarkusVi
• Microsoft Alias: markvi

[neeleshray-msft]

@aakash-shah Thank you for the feedback. We will review and update accordingly.

[neeleshray-msft]

@aakash-shah

All editions of Azure AD provide you with risky sign-ins reports. However, the level of report granularity varies between the editions:

• In the Azure Active Directory Free and Basic editions, you get a list of risky sign-ins.

• In addition, the Azure Active Directory Premium 1 edition allows you to examine some of the underlying risk detections that have been detected for each report.

• The Azure Active Directory Premium 2 edition provides you with the most detailed information about all underlying risk detections and it also enables you to configure security policies that automatically respond to configured risk levels.

The risky sign-ins report in the Azure AD premium editions provides you with aggregated information about the risk detection types that have been detected. With the Azure AD Premium P1 edition, detections that are not covered by your license appear as the risk detection Sign-in with additional risk detected. With the Azure AD Premium P2 edition, you get the most detailed information about all underlying detections.

[aakash-shah]

@neeleshray-msft
Thanks for the prompt reply! Unfortunately this doesn't clarify what the specific differences are. For instance you wrote "In addition, the Azure Active Directory Premium 1 edition allows you to examine some of the underlying risk detections that have been detected for each report.". It would be helpful for this page to clarify what "some" means, and what "most detailed information" means for each of these reports.

My question originated specifically regarding the "Users with leaked credentials" report and what AADP1 includes vs what AADP2 includes since I am evaluating what is appropriate for our organization and so it would be helpful to see the specific differences between what Azure Basic vs AADP1 vs AADP2 offers for each of these reports so that we can make a more informed decision as to what is appropriate for us.

Thanks!

[neeleshray-msft]

@aakash-shah

In this document you will find a break down of the details that you get in the Azure AD Free and Basic Editions and the list of details that you get with the Premium P1 and P2 editions.

Let us know if this clarifies what you were looking for.

[aakash-shah]

Thanks. Can you please clarify what detections are not covered in the following statement:

With the Azure AD Premium P1 edition, detections that are not covered by your license appear as the risk detection Sign-in with additional risk detected.

I assume that the detections in AADP1 and AADP2 are consistent for all tenants?

Unfortunately I am still unable to answer the question based on this page as to whether AADP1 will include "Users with leaked credentials", and what attributes/information will not be included with AADP1 that will be included on AADP2 regarding "Users with leaked credentials".

Thanks!

[neeleshray-msft]

@aakash-shah

The risk type event would mention "Users with leaked credentials" in both P1 and P2 editions. However the break down of which attributes would be detailed in the respective editions is the question.
We are reaching out to the Engineering Team and would get back to you soon on this.

[aakash-shah]

Thanks! When you gather this information, it would be very helpful to have a table/matrix that shows which risk events are included with each edition, and then also another table/matrix shows what specific attributes are available for each edition. This would help answer any questions people may have.

Thanks!

[Eddieyc]

I've the same question as neeleshray-msft. Is that any update?

[mqunbar]

+1