# Licence requirements > See which Microsoft licence each baseline needs, and what happens when a tenant or user doesn't hold it. Some baselines only work when the client tenant holds a particular Microsoft licence. The requirement is always on a **service plan** rather than a bundle name: Octiga checks for "Entra ID P1", not for "Microsoft 365 Business Premium". It doesn't apply a baseline to a tenant that lacks its licence. A user who lacks a licence a baseline needs is excluded from that baseline's checks rather than reported as failing. Octiga doesn't warn you when a licence is missing; the lists below and the Service plans fact on every baseline show what each baseline needs. ## Licence groups Five groups of Microsoft licences gate baselines. ### Entra ID P1 or P2 Needed by every Conditional Access baseline, and by dormant-account detection. Either Entra ID P1 or Entra ID P2 satisfies this; no baseline in Octiga requires P2 specifically. **Conditional Access Policy** - [Block Legacy Authentication](https://docs.octiga.io/baselines/conditional-access-policy/cap-legacy-auth/) - [Enforce MFA](https://docs.octiga.io/baselines/conditional-access-policy/cap-enforce-mfa/) - [Require Approved Client Apps](https://docs.octiga.io/baselines/conditional-access-policy/cap-app-protection-policy/) - [Application Enforced Restrictions For Unmanaged Devices.](https://docs.octiga.io/baselines/conditional-access-policy/cap-app-enforced-restriction-unmanaged-devices/) - [Require Compliant Or Hybrid Azure AD Joined Device.](https://docs.octiga.io/baselines/conditional-access-policy/cap-require-compliant-or-hybrid-azure-ad-joined-device/) - [Block Unknown Or Unsupported Device Access](https://docs.octiga.io/baselines/conditional-access-policy/cap-un-supported-device-block/) - [No persistent Browser Sessions](https://docs.octiga.io/baselines/conditional-access-policy/cap-no-persistent-browsers/) - [Restrict Access To Azure Portal](https://docs.octiga.io/baselines/conditional-access-policy/cap-restrict-azure-access/) - [Restrict Access To Microsoft Admin Portal](https://docs.octiga.io/baselines/conditional-access-policy/cap-restrict-microsoft-admin-portal-access/) - [Sign-In Risk-Based Multifactor Authentication.](https://docs.octiga.io/baselines/conditional-access-policy/cap-risky-signin/) - [Securing Security Info Registration](https://docs.octiga.io/baselines/conditional-access-policy/cap-securing-security-info-registration/) - [Octiga Generic Conditional Access Policy](https://docs.octiga.io/baselines/conditional-access-policy/cap-generic/) - [Legacy Auth Conditional Access Policy - DEPRECATED NAME](https://docs.octiga.io/baselines/conditional-access-policy/legacy-auth-conditional-access-policy/) - [MFA Conditional Access Policy - DEPRECATED](https://docs.octiga.io/baselines/conditional-access-policy/mfa-conditional-access-policy/) **Access Management** - [Dormant Admins](https://docs.octiga.io/baselines/access-management/dormant-admins/) - [Dormant Users](https://docs.octiga.io/baselines/access-management/dormant-users/) ### Intune Needed by every device compliance and device configuration baseline. **Intune** - [Android Enterprise - Compliance Policy](https://docs.octiga.io/baselines/intune/android-compliance-policy/) - [iOS/iPadOS - Compliance Policy](https://docs.octiga.io/baselines/intune/ios-compliance-policy/) - [MAC OS - Compliance Policy](https://docs.octiga.io/baselines/intune/mac-os-compliance-policy/) - [Windows 10 Or Later - Compliance Policy](https://docs.octiga.io/baselines/intune/windows10compliance-policy/) - [Windows 10 or later Configuration Policy - Block Password Saving In Google Chrome](https://docs.octiga.io/baselines/intune/configuration-policy-windows-chrome-block-password-saving/) - [Windows 10 or later Configuration Policy - Block Password Saving In Microsoft Edge](https://docs.octiga.io/baselines/intune/configuration-policy-windows-edge-block-password-saving/) - [Windows 10 or later Configuration Policy - Windows LAPS Policy](https://docs.octiga.io/baselines/intune/configuration-policy-windows-laps/) ### SharePoint Online Needed by external sharing, link expiry and storage-warning baselines. **Sharing** - [External (Guest) Users Resharing](https://docs.octiga.io/baselines/sharing/org-external-resharing/) - [Anonymous Links Expiry](https://docs.octiga.io/baselines/sharing/org-links-expiry/) - [SharePoint Storage Warning](https://docs.octiga.io/baselines/sharing/sharepoint-storage-warning/) **Remote Access** - [SharePoint Modern Auth Enforced](https://docs.octiga.io/baselines/remote-access/legacy-auth-protocols-enabled/) ### Defender for Office 365 Needed by Safe Links and Safe Attachments, and by the SharePoint infected-file-download baseline. **Email Security** - [Safe Links Policy (Octiga)](https://docs.octiga.io/baselines/email-security/safe-links-policy/) - [Safe Attachments Policy (Octiga)](https://docs.octiga.io/baselines/email-security/safe-attachment-policy/) **Sharing** - [SharePoint Block Infected Files Download](https://docs.octiga.io/baselines/sharing/sharepoint-infected-files-download/) ### Customer Lockbox Needed by the Customer Lockbox baseline alone. **Access Management** - [Customer Lockbox](https://docs.octiga.io/baselines/access-management/org-customer-lockbox/) > **Note:** The mailbox-protocol baselines (IMAP, POP3, EWS, MAPI, OWA, ActiveSync and SMTP client authentication) carry no licence requirement of their own. Any mailbox Octiga can read is evaluated. ## How to see what a baseline needs Every baseline picker has a **Service plans** column. A dash means no licence is required; a number opens a tooltip listing the specific plans, and any one of them satisfies the requirement. *Screenshot: The Service plans column in the Add Baselines picker* 1. The Service plans column: a dash means no licence is required; a number opens the tooltip The same fact appears on the baseline's own page, in its metadata header row. ## What "skipped for licence" means When you deploy a scheme, the result shows how many baselines were skipped for licence. This is a quiet exclusion, not a failure: the tenant (or the user) doesn't hold a licence one of the incoming baselines needs, so Octiga left it out rather than apply something it can't check. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/) covers the rest of the deploy result, and [Deviations](https://docs.octiga.io/baselines/deviations/) shows what an excluded user looks like day to day. > **Licence: Entra ID P1 or P2:** A tenant without Entra ID P1 or P2 doesn't show deviations on Conditional Access baselines; it is excluded from evaluation instead.