Calculating the Licensing Requirement for Entra Conditional Access Policies

After the discussion about the licensing gap prompts shown in the Entra admin center, here’s a PowerShell script to compute the set of user accounts that should have Entra P1 licenses. The information comes from the conditions property of conditional access policies with group and directory role membership expanded to find individual accounts. The set is checked against the set of users licensed for Entra P1 to find the accounts that need to be licensed.

https://office365itpros.com/2026/08/18/find-entra-p1-accounts-to-license/