Skip to content

Est. 2011·Microsoft Partner 7033487·Delivery under 3 min·Support 7 days a week

Your vault is empty.

Review

Microsoft 365 E3 vs E5: What the Security and Voice Add-Ons Are Worth

11 min read Updated October 4, 2026 Microsoft Licensing Guides

Fix it now

E3 is already a complete platform: Entra ID P1, Intune Plan 1, Defender for Endpoint Plan 1, Defender for Office 365 Plan 1 and Windows 11 Enterprise E3. E5 lifts identity to P2, both Defender products to Plan 2, adds Defender for Identity, full Defender for Cloud Apps, Power BI Pro and Teams Phone. Neither plan has a seat ceiling.

  1. Buy E5 across the board if the compliance obligation genuinely applies to everyone, because the Purview components are hard to scope to a subset.
  2. Buy E3 plus the Microsoft Defender Suite for a small high-risk group if that group is genuinely a small fraction of headcount.
  3. Price Power BI Pro and Teams Phone separately first. If most seats already buy both, they close much of the gap on their own.
  4. Do not budget E5 as a phone system. Teams Phone needs a separate PSTN connection – a Calling Plan, Operator Connect, Teams Phone Mobile or Direct Routing.
  5. Check the current SKU names. Microsoft renamed E5 Security to the Microsoft Defender Suite and E5 Compliance to the Microsoft Purview Suite on 1 October 2025.
  6. Confirm what can be scoped before designing a mixed estate. Users who benefit from a service must be licensed for it.

If the requirement applies to the whole workforce, stop here and price E5. Below is exactly what the upgrade contains, and how to build the mixed alternative without a compliance gap.

Why it happens

The interesting question is never whether the E5 components are good. It is whether you need them on every seat, because Microsoft sells most of the same capability as targeted add-ons on top of E3. The real comparison is E3 plus a considered set of add-ons against E5 across the board.

Start by being accurate about what E3 already contains, because it is more than the phrase ‘the productivity plan’ suggests. Microsoft’s enterprise plan comparison puts Entra ID P1, Intune Plan 1, Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Office 365 Plan 1, Microsoft Purview and Windows 11 Enterprise E3 in E3. Defender for Cloud Apps is present at discovery level only, Defender for Identity is absent, Power BI Pro is not included and Teams Phone is not included.

E5 changes six of those rows. Entra ID moves to P2, which brings Identity Protection and risk-based conditional access, Privileged Identity Management and access reviews. Defender for Endpoint moves to Plan 2, adding endpoint detection and response, automated investigation, advanced hunting with six months of retention and Microsoft Threat Experts. Defender for Office 365 moves to Plan 2, adding Threat Explorer, Threat Trackers, attack simulation training and automated investigation and response. Defender for Identity appears, Defender for Cloud Apps becomes full protection, and Power BI Pro and Teams Phone are included.

A small group would cause serious damage if compromised, and the rest would not

You have this one if Finance, executives, IT administrators, legal and anyone with the customer database sit apart from a much larger population of ordinary staff.

  1. Price E3 for everyone plus the Microsoft Defender Suite for the subset. Microsoft renamed this add-on from Microsoft 365 E5 Security on 1 October 2025; it contains Entra ID P2, Defender for Identity, Defender for Office 365 Plan 2, Defender for Endpoint Plan 2 and Defender for Cloud Apps.
  2. Add Power BI Pro for whoever needs it and Teams Phone for whoever makes calls, then compare the total against E5 for everyone.
  3. Mixed licensing wins where the subset is genuinely small and loses where it turns out to be half the company. Do the count before the design.

The compliance obligation covers the whole workforce

You have this one if Supervision, retention, insider risk or discovery obligations that apply to every mailbox and every conversation rather than to a named group.

  1. This is where E5 across the board is the honest answer, because the Purview components are the hardest part of the stack to scope to a subset.
  2. The add-on route is the Microsoft Purview Suite, renamed from Microsoft 365 E5 Compliance on 1 October 2025. It contains Information Protection and DLP, Insider Risk Management, Adaptive Protection, Microsoft 365 Copilot data protection, Compliance Manager, audit retention policies and audit insights, and eDiscovery workflows and analytics.
  3. Price E3 plus the Purview Suite for everyone against E5 for everyone. Once the add-on is going on every seat, the bundle usually wins.

You already buy Power BI Pro and Teams Phone separately

You have this one if Most seats carry both as separate line items on the current bill.

  1. Both are included in E5 and neither is in E3, so run the comparison again with those two line items removed from the E5 side.
  2. For a lot of organisations those two alone close most of the difference, and the security capability arrives as a by-product.
  3. Be precise about Teams Phone, though: it is the calling system, not the calls. Microsoft states that to use PSTN telephony the account must be licensed with Teams Phone and also equipped with a PSTN solution.

Full reference

E3 and E5, component by component

Component Microsoft 365 E3 Microsoft 365 E5
Office apps, Exchange, SharePoint, OneDrive, Teams Yes Yes
Windows edition rights Windows 11 Enterprise E3 Windows 11 Enterprise E5
Microsoft Entra ID Plan 1 Plan 2
Microsoft Intune Plan 1 Plan 1
Microsoft Defender for Endpoint Plan 1 Plan 2
Microsoft Defender for Office 365 Plan 1 Plan 2
Microsoft Defender for Identity Not included Included
Microsoft Defender for Cloud Apps Discovery only Full protection
Microsoft Purview Included Included, with the advanced components
Power BI Pro Not included Included
Teams Phone Not included Included; PSTN connectivity bought separately
Seat ceiling None None

What the two add-ons contain, under their current names

Microsoft renamed both mini-suites on 1 October 2025, and quotes still circulate under the old names. Microsoft 365 E5 Security is now the Microsoft Defender Suite: Entra ID P2, Defender for Identity, Defender for Office 365 Plan 2, Defender for Endpoint Plan 2 and Defender for Cloud Apps. Microsoft 365 E5 Compliance is now the Microsoft Purview Suite: Information Protection and data loss prevention, Insider Risk Management, Adaptive Protection, Microsoft 365 Copilot data protection, Compliance Manager, audit retention policies and audit insights, and eDiscovery workflows and analytics.

Those two lists are the whole of the mixed-licensing design. If you can name the users who need each list and that set is small, E3 plus add-ons is cheaper. If you cannot, E5 is simpler and usually not much dearer once Power BI Pro and Teams Phone are counted.

The scoping rule that decides whether a mixed estate works

Several E5 components operate at tenant level, and Microsoft’s position is that users who benefit from a service must be licensed for it. Its identity governance licensing guidance is the clearest published example of how literally that is meant: an access review of a group with 75 member users and one group owner acting as reviewer requires 76 licences – 75 for the reviewed users and one for the reviewer.

Apply the same test before relying on a partial deployment. For each component you intend to buy for a subset, ask who it evaluates rather than who reads its output. A service that inspects your directory or your cloud application traffic is protecting everyone, and Microsoft expects everyone to be licensed. Components that genuinely scope to assigned users, such as endpoint protection tiers tied to onboarded devices, are the ones a mixed design can rest on.

Teams Phone is not a phone bill

This is the most common budgeting mistake in the E5 case. Teams Phone gives you the calling system: numbers, call queues, auto attendants and Teams as a telephone platform. It does not connect you to the public telephone network. Microsoft states that to use PSTN telephony services the user account must be licensed with the Teams Phone application and also equipped with a PSTN solution from a provider of choice, and publishes four routes: a Microsoft Teams Calling Plan, Operator Connect, Teams Phone Mobile, or Direct Routing through a certified session border controller. Price the connectivity separately on both sides of the comparison.

Which to standardise on, by situation

  • A large organisation with a small high-risk group and no workforce-wide compliance burden: E3 for everyone, Microsoft Defender Suite for the group.
  • A regulated firm subject to retention, supervision or insider risk obligations across the workforce: E5, because the Purview components apply to everybody by design.
  • An organisation already paying separately for Power BI Pro and Teams Phone on most seats: run the comparison again with those removed from the E5 side.
  • An organisation with no dedicated security team: E5 is easier to defend, because Plan 2’s automated investigation and response does work that would otherwise need people you do not have.
  • A mixed workforce including frontline staff: look at the frontline plans for that group rather than putting E3 or E5 on people who share a device and need little more than email.
  • An organisation on the Business plans approaching 300 seats: compare E3 against Business Premium before assuming E5 is the destination, and note that Business Premium carries endpoint detection and response that E3 does not.

When a licence is the actual fix

Where the compliance or security requirement applies across the whole workforce rather than a subset, Microsoft 365 E5 covers it without assembling a stack of add-ons, and it removes the licence-mapping exercise mixed estates create. Arco supplies E5, E3, the Microsoft Defender Suite and the Microsoft Purview Suite – the add-ons formerly sold as Microsoft 365 E5 Security and E5 Compliance. Send us your headcount, the size of your genuinely high-risk group, and whether you already pay for Power BI Pro or Teams Phone separately, and we will price both routes properly on your own figures. If the mixed design is cheaper we will say so, and we will tell you which components cannot be scoped to a subset before you rely on one.

Questions people ask about this

Can I license some users E3 and others E5 in the same tenant?

Yes, and it is common. The caveat is that several E5 components operate at tenant level, and Microsoft’s rule is that users who benefit from a service must be licensed for it. Its identity governance guidance gives the arithmetic explicitly: an access review covering 75 users with one reviewer needs 76 licences. Scope what can be scoped and confirm the position on anything that cannot.

Does E5 include phone calls?

No. E5 includes Teams Phone, which is the calling system – numbers, call queues, auto attendants. Microsoft states that to use PSTN telephony the account must hold Teams Phone and also be equipped with a PSTN solution: a Microsoft Teams Calling Plan, Operator Connect, Teams Phone Mobile, or Direct Routing through a certified session border controller. Budgeting E5 as an all-in phone system is a common and expensive mistake.

What are the E5 Security and E5 Compliance add-ons called now?

Microsoft renamed them on 1 October 2025. Microsoft 365 E5 Security is now the Microsoft Defender Suite: Entra ID P2, Defender for Identity, Defender for Office 365 Plan 2, Defender for Endpoint Plan 2 and Defender for Cloud Apps. Microsoft 365 E5 Compliance is now the Microsoft Purview Suite. Quotes still circulate under the old names, so check which product a line item is.

Does E3 include any mail threat protection?

Yes. Microsoft’s enterprise plan comparison puts Microsoft Defender for Office 365 Plan 1 in E3, which gives Safe Attachments, Safe Links and anti-phishing policies with impersonation protection. E5 lifts it to Plan 2, adding Threat Explorer, Threat Trackers, attack simulation training and automated investigation and response. This is a common error in older comparisons that treat E3 as having no mail protection at all.

Is there a seat ceiling on E3 or E5?

No. Microsoft’s plan options guidance describes the enterprise plans as supporting an unlimited number of users, in contrast to the 300-seat limit that applies across the Business family in a tenant. You may also combine Enterprise, Business and standalone plans within a single account, which is how most organisations manage the transition.

Was this article helpful?

Your feedback helps us improve our documentation.

Related articles

Review Software Assurance: What It Actually Buys and When to Skip It Review External Connector or CALs? Licensing People Outside Your Organisation Review Intune Plan 1 vs Plan 2: What You Already Own and What Costs Extra Review Running Office on a Terminal Server: Which Licences Are Even Allowed?
← Back to Knowledge Base