E5 earns its premium when it displaces spend you already carry — third-party security tooling, a separate telephony platform, standalone analytics, and since July 2026 privilege-management, PKI and security-AI purchases too; it becomes shelfware when bought estate-wide on the strength of a feature list. So the decision is an inventory exercise, not a plan comparison: map what E5’s four component stacks would replace for which users, and the E3/E5 split usually writes itself.
Published 3 November 2025 · Last reviewed 3 November 2025
E3 is the productivity baseline: the Office apps, Exchange, SharePoint, Teams, Windows Enterprise, Entra ID Plan 1, Defender for Endpoint Plan 1, and Purview’s manual layer — retention policies, hand-applied sensitivity labels, basic data loss prevention, eDiscovery Standard. It is a complete workplace platform with foundational, largely manual, security and compliance.
E5 layers four distinct stacks on top. Security: the full Defender suite — Endpoint Plan 2, Office Plan 2, Identity, Cloud Apps — plus Entra ID Plan 2 with risk-based conditional access and identity protection. Compliance: Purview’s automated tier — Insider Risk Management, Communication Compliance, eDiscovery Premium, Audit Premium, auto-applied sensitivity labels, advanced DLP. Voice: Teams Phone with audio conferencing, a full cloud PBX. Analytics: Power BI Pro rights for every licensed user. Each stack replaces a category of product that many organisations buy separately — which is precisely why the comparison is a displacement question rather than a features question.
This guide is general information about two Microsoft commercial plans, not legal or licensing advice for your situation. Plan contents change — Microsoft restructured E5 as recently as mid-2026 — and your contract governs. It names no firms; the firm directory lists Microsoft-capable advisors with balanced pros and cons, listed, not ranked.
Effective 1 July 2026, Microsoft folded four previously separate purchases into E5 and raised its list price to match. Security Copilot arrives with a pooled allocation of 400 Security Compute Units per month for every 1,000 licensed users (capped at 10,000 SCUs; usage beyond the allocation is throttled, not billed). Intune Endpoint Privilege Management brings just-in-time admin elevation that previously required the Intune Suite add-on or third-party privilege tools; Enterprise Application Management adds app lifecycle and trust controls; Cloud PKI replaces on-premises certificate infrastructure. The additions roll out tenant by tenant with 30 days’ notice, and existing customers keep their current pricing until renewal.
Two consequences for the E3-versus-E5 calculation. First, the displacement list grew: organisations paying separately for privilege management, PKI or security AI now have more third-party spend that an E5 step-up can absorb. Second, the timing of your renewal matters more than usual — agreements signed before the uplift carry the old economics until they expire, which makes the months around a renewal the natural window for re-running the plan-mix analysis, ideally as part of broader renewal preparation.
One thing the change did not do: Microsoft 365 Copilot — the productivity assistant — remains a separate add-on on both plans. Buyers stacking E5, the Copilot add-on and the Entra Suite are the audience for Microsoft’s E7 bundle, which packages all three; that is a separate calculation with the same displacement logic.
| DIMENSION | MICROSOFT 365 E3 | MICROSOFT 365 E5 |
|---|---|---|
| Productivity core | Full Office apps, Exchange, SharePoint, Teams, Windows Enterprise | Identical core — the step-up adds no productivity features |
| Identity | Entra ID Plan 1: conditional access, MFA | Entra ID Plan 2: risk-based policies, identity protection, access reviews |
| Threat protection | Defender for Endpoint Plan 1, Defender for Office Plan 1 | Full Defender suite: Endpoint P2 (EDR, threat hunting), Office P2, Identity, Cloud Apps |
| Compliance & governance | Manual labels, retention, basic DLP, eDiscovery Standard | Auto-labeling, advanced DLP, Insider Risk, Communication Compliance, eDiscovery Premium, Audit Premium |
| Voice | Not included; Teams Phone licensed separately | Teams Phone with audio conferencing included |
| Analytics | Not included; Power BI Pro licensed separately | Power BI Pro rights per user |
| Endpoint management extras (from July 2026) | Core Intune; EPM, app management and Cloud PKI are add-ons | Endpoint Privilege Management, Enterprise App Management and Cloud PKI included |
| Security AI (from July 2026) | Security Copilot purchased standalone | Pooled Security Copilot capacity included (400 SCUs/1,000 users, throttled past cap) |
| Microsoft 365 Copilot | Separate add-on | Still a separate add-on — bundled only in E7 |
The pattern is consistent: E3 and E5 do the same productivity work, and every E5 increment is a security, compliance, voice or analytics product that exists somewhere else in the market — possibly already in your budget.
Estate-wide E5 makes sense where the displacement is broad and real: an organisation consolidating onto the Microsoft security stack, retiring a third-party EDR, a separate PBX and standalone BI licensing at the same time. The risk is uniformity — licensing every user for a stack only some consume.
The mixed estate is the most common honest answer: E5 for security teams, regulated roles, executives and heavy-data users; E3 for everyone else. It requires discipline, because several E5 capabilities are tenant-wide programs licensed per user — insider-risk analytics, auto-labeling and advanced audit cover only license holders, so the compliance program’s reach has to be designed around the assignment boundary, not assumed.
E3 plus component add-ons — E5 Security, E5 Compliance, Teams Phone standalone — reconstructs exactly the stacks you need and nothing else. An estate that wants the Defender suite everywhere but telephony nowhere is often structured better this way than on full E5. Mapping which construction is cheapest for your actual consumption is bread-and-butter licensing advisory and optimization work, and the answer shifts whenever Microsoft repackages — as July 2026 just demonstrated.
Buying E5 and deploying E3. The most common failure is paying the step-up while the Defender suite sits unconfigured, telephony stays on the legacy PBX, and Power BI Pro rights go unused. E5’s value is realised through deployment projects, each with an owner and a date; without them, the uplift is shelfware with a renewal cliff.
Double-paying the displacement. The mirror image: stepping up to E5 while the third-party EDR, privilege-management, PKI and conferencing contracts all renew on autopilot. The business case for E5 assumed those lines would end — someone has to actually end them.
Ignoring the assignment boundary in mixed estates. A regulator or litigator will not care that Audit Premium covered the licensed half of the organisation. If a compliance capability is the reason for E5, the license map must match the obligation map.
Treating Copilot as an E5 feature. Two different products share the brand: Security Copilot is now in E5; Microsoft 365 Copilot is not, on any plan below E7. Budgeting as if the add-on were included is a five-minute mistake with a multi-year price tag.
Renewing without re-running the math. Plan contents moved in July 2026 and will move again. A plan mix optimised three years ago reflects a product that no longer exists; every renewal should restate the displacement inventory from scratch, and the choice of who helps you do it matters as much as the analysis.
The suite-versus-stack baseline question →
Which premium to buy first →
The contract the plans sit on →
How to pick the firm for this work →
Firms that model plan mixes →
Every field guide on the site →
Four stacks. Security: the full Defender suite (Endpoint Plan 2, Office Plan 2, Identity, Cloud Apps) and Entra ID Plan 2 versus E3’s Plan 1 tiers. Compliance: Purview’s automated layer — Insider Risk Management, Communication Compliance, eDiscovery Premium, Audit Premium, auto-applied sensitivity labels and advanced DLP — versus E3’s manual labels, retention policies and eDiscovery Standard. Voice: Teams Phone with audio conferencing. Analytics: Power BI Pro rights. Since mid-2026, E5 also includes Security Copilot capacity, Intune Endpoint Privilege Management, Enterprise Application Management and Cloud PKI.
No. Microsoft 365 Copilot — the productivity assistant in Word, Excel, Outlook and Teams — remains a separate per-user add-on on both E3 and E5. What E5 gained in 2026 is Security Copilot, a different product aimed at security teams, with a pooled monthly allocation of Security Compute Units. Organisations stacking E5 plus the Copilot add-on plus Entra Suite are the audience Microsoft’s E7 bundle targets.
Microsoft folded four previously separate purchases into E5: Security Copilot (400 Security Compute Units per month per 1,000 licensed users, capped at 10,000, throttled rather than billed when exceeded), Intune Endpoint Privilege Management, Enterprise Application Management and Cloud PKI. The E5 list price rose alongside, effective 1 July 2026, with existing customers keeping current pricing until renewal. The additions land tenant by tenant with 30 days’ notice.
Yes — E3 and E5 mix freely at the user level, and a mixed estate is the most common pattern. The caveat is that many E5 capabilities are tenant-level in effect but per-user in licensing: auto-labeling, insider-risk analytics and advanced audit only cover the users who hold the license, so a security or compliance program designed around E5 features has a coverage boundary that must match the license assignment.
Often, yes. Both add-ons sit on top of E3 and deliver the corresponding E5 stack without voice and analytics. An estate that needs the Defender suite broadly but Teams Phone nowhere is frequently better structured as E3 plus E5 Security than as full E5 — the right answer falls out of mapping which component stacks are actually consumed, which is licensing-advisory work rather than plan-picking.
No — the Copilot add-on runs on E3. But Copilot surfaces whatever its user can already reach, so oversharing in SharePoint and Teams becomes visible at conversational speed. The governance controls organisations reach for in response — auto-applied sensitivity labels, advanced DLP, Insider Risk Management, Audit Premium — are E5 Purview features, which is why Copilot rollouts are a common trigger for E3-to-E5 step-ups among regulated buyers.
Running the displacement inventory, designing the E3/E5 boundary and timing the change against a renewal is exactly what a Microsoft licensing advisor is for. The directory lists the firms that do this work, with balanced pros and cons, listed, not ranked.
Tell us the vendor, the service you need and where things stand, and we will route your brief to firms that genuinely cover that combination. The directory and matching are free for buyers, no vendor ever sees your brief, and we add no markup.
Our weekly dispatch on vendor audit programs, regional developments and one buyer move. Subscribe to The Licensing Radar.