What Identity and Access Management Costs a 50-Person Business

For a 50-person business already on Microsoft 365, identity and access management usually adds $4 to $14 per user per month in licensing, about $2,400 to $8,400 a year, plus a few hundred dollars once for hardware security keys.

Most of what people picture when they hear “identity and access management” is priced for companies with a security department. A 50-person business doesn’t need that version. It needs every account to belong to a real person, a second factor on every sign-in, a sane way to share passwords, and a reliable way to shut all of it off when someone leaves. Those four things are cheaper than the acronym suggests. Much cheaper.

This guide prices them at September 2026 list prices. It’s the cost companion to our piece on why MFA alone isn’t enough, which covers the concepts, and it sits inside the broader cybersecurity work my team does for small businesses. I’ll assume you already run Microsoft 365, since that’s the platform most of our clients run on, and that you’re on Business Standard today. If you’re on Business Premium, skip ahead. Half this bill is already paid.

Watch: Identity and Access Management Cost for 50 People

Video chapters

• 0:00 Intro
• 0:41 The Microsoft Layer, Tier by Tier
• 1:34 Passwords and Security Keys
• 2:12 Three Budgets for 50 People
• 2:43 Who Does the Work
• 3:09 Common Questions

What You’re Actually Paying For

Identity and access management, for a company this size, is the set of accounts, sign-in rules, and permissions that decide who can reach which systems, and how quickly that access ends when someone leaves. In practice it’s one directory of users in Microsoft Entra ID, a second factor on every account, rules about where and how people sign in, a password manager for the logins Microsoft doesn’t control, and a documented offboarding routine.

Only three of those carry a price tag. The Microsoft license tier, the password manager, and the security keys. Everything else is configuration and routine. No invoice attached. That part is labor, and I’ll come back to who pays for it.

The Microsoft Layer, Tier by Tier

Microsoft raised several commercial prices on July 1, 2026. Business Basic went from $6 to $7 per user per month and Business Standard from $12.50 to $14, while Business Premium stayed at $22, according to Microsoft’s 2026 pricing update. Existing customers keep their current price until renewal. Those are annual-commitment prices. Pay month to month and each one runs 20% higher. Annual wins.

Entra prices are from Microsoft’s Entra pricing page. P1 and P2 rose on July 1 as well, from $6 and $9. Same date, same memo.

Standard Plus P1, or Just Buy Premium?

Do the arithmetic once. The decision mostly makes itself. Business Standard at $14 plus a standalone P1 license at $7 comes to $21 per user, one dollar less than Business Premium at $22, and Premium also carries Intune device management and Microsoft Defender for Business, which a 50-person office will want sooner or later anyway. One dollar. That’s the gap. Unless there’s a specific reason to stay on Standard, Premium is the better buy.

What Premium buys on the identity side is Conditional Access. Security defaults, the free option on Basic and Standard, turn MFA on for everyone through the Microsoft Authenticator app, and they’re genuinely better than nothing. Far better. They’re also all or nothing. You can’t say “require a stronger sign-in for the bookkeeper,” or “block sign-ins from countries where nobody works,” or “only allow company-managed laptops to reach the finance folder.” Conditional Access can. Microsoft’s own security defaults documentation says they’re probably not right for organizations that already hold P1 or P2 licenses.

The Two Line Items Outside Microsoft

Microsoft handles the sign-in to Microsoft. Nothing past it. It doesn’t handle the bank portal, the payroll site, the state filing account, or the vendor login someone set up in 2019 with a shared password taped inside a drawer.

That’s the password manager’s job. BitWarden is our recommended system, and it lists its business plans at $4 per user per month for Teams and $6 for Enterprise, billed annually. Teams already includes directory sync and automated provisioning, so accounts appear and disappear with your staff list. Enterprise adds enforceable policies, custom roles, single sign-on, and an account recovery workflow for the day someone forgets their master password. For 50 people the difference is $1,200 a year. Not nothing. More on that choice in the questions below, and in our longer look at choosing a password manager for a small team.

Then there are hardware security keys. CISA calls phishing-resistant MFA “the gold standard” in its fact sheet on implementing phishing-resistant MFA, and says text-message codes should only be used as a last resort. A key can’t be tricked into approving a fake sign-in page, which is exactly the trick that beats app notifications on a bad day. By design.

Not everyone needs one. Keys go to the people whose accounts would hurt most, your Microsoft 365 administrators and whoever approves payments, and each of them gets two. One goes on the key ring. One goes in a drawer. Yubico lists the YubiKey 5 NFC at $58 and the FIDO-only Security Key NFC at $29. The cheaper key handles modern sign-ins fine. Really. It skips the older smart card and one-time-code features, which most small offices never touch.

Hardware sits outside our managed IT agreement. Keys are equipment, like laptops and toner. Budget them the same way.

Three Budgets for 50 People

These figures assume you start on Business Standard at $14, pay annually, and count only what identity adds. Licenses cost the same whoever manages them.

Keys are a one-time purchase on top. Figure $174 for the Floor, which buys six $29 Security Keys covering three admins, and $580 for either of the other two builds, which buys ten $58 YubiKeys covering five people.

A few notes on reading it.

• The Solid row is where most offices our size should land, and not only for identity, since the $8 Premium upgrade also buys device management and endpoint protection.
• Already on Premium? Good. Your Solid build is just BitWarden Enterprise and the keys. About $3,600 a year plus $580 once.
• If your renewal hasn’t come around yet and you’re still paying $12.50 for Standard, the Premium step is $9.50 until it does.
• Governed is for companies with an auditor, a regulator, or a client contract that asks for documented access reviews. Plenty of 50-person businesses don’t.

What P2 and ID Governance Add, and Who Needs Them

Two features come up often in identity conversations. Neither is where a 50-person company should start.

Privileged Identity Management makes administrator rights temporary. An admin requests the role, gets it for a few hours, and loses it automatically. It needs either Entra ID P2 or Entra ID Governance, and Microsoft’s licensing guidance requires a license for every user who’s eligible for a role, every user who approves those requests, and every user who performs or is assigned an access review. So it isn’t a two-seat purchase. It grows. Plan on at least your admins and their approvers.

Access reviews are the other one. They’re scheduled prompts asking managers to confirm who still needs which access, and they need Entra ID Governance for everyone reviewing or being reviewed. At 50 people that’s $4,200 a year. Real money. A documented review done by hand, from a list of accounts and groups, covers the same ground for far less, provided someone actually does it and signs the result.

Risk-based sign-in policies, the kind that challenge a sign-in because the password showed up in a breach dump, are a P2 feature too. Useful. Not first.

The Labor, and Where It Sits

Licenses are the easy line to price. The work is harder to see. Someone has to enforce MFA on every account, write and test the Conditional Access policies, set up the password manager, register the keys, and build the offboarding routine. Then all of it has to stay current as people join and leave. Every time.

In our agreements, MFA enforcement, Conditional Access, and onboarding and offboarding are part of managed IT that starts at $995 a month, the same way our breakdown of cybersecurity costs treats the rest of the security stack. What sits outside it is one-time cleanup work, such as closing old accounts, removing admin rights that drifted, and untangling shared logins. That gets scoped and quoted before anything starts. The assessment that finds those gaps is free. Start there.

Whoever you work with, ask the question directly. Is the identity work in the monthly fee, or is it a project every time someone joins or leaves? Get the answer in writing.

Why Credentials Still Deserve the Money

An honest note on priorities. In Verizon’s 2026 Data Breach Investigations Report, exploited vulnerabilities became the most common way into a breach at 31%, and credential abuse, the previous leader, fell to 13%. Patching matters at least as much as passwords now. Maybe more. For small and midsize businesses in the same report, though, credentials were still among the data compromised in 31% of breaches. Stolen logins remain a prize even when they aren’t the front door. So both matter.

Cyber insurers also care, and they read the fine print. Our look at MFA that’s enforced versus merely available covers what renewal questionnaires actually ask.

Common Questions