Microsoft 365 F3 Review: Frontline Licensing and Its Hidden Limits

Fix it now

F3 is the frontline licence: a real identity, Teams, a 2 GB mailbox, web and mobile Office editing, 2 GB of cloud storage, and the full Intune Plan 1 and Entra ID Plan 1 management rights along with Windows 11 Enterprise E3. It is genuinely good value for the right person and it has three hard limits that end rollouts when nobody checks them first.

1. Buy it for shift and frontline staff who share a device or work from a phone: retail, hospitality, manufacturing, logistics, care and field service.
2. Buy it if every worker needs an identity for rotas, payslips, safety documents and Teams without paying an information-worker price for each of them.
3. Buy it because the management rights are not cut down: Intune Plan 1, Entra ID Plan 1 and Windows 11 Enterprise E3 all come with it.
4. Skip it for anyone with their own PC who builds documents, because desktop Office is not licensed and a 2 GB mailbox will not survive that job.
5. Skip it for anyone who must keep years of mail. There is no archive on this plan, only an add-on.
6. Look at F1 below it for people who only read what is published to them: it has no mailbox and its web and mobile Office rights are read-only.

Moving a user from an E plan to an F plan is a data operation as well as a licence change. Remove the old licence and assign the new one in the same operation, and get mailboxes and OneDrive under 2 GB first.

If the fit is obvious you can stop here. The rest covers the three limits in detail, the shared-device and personal-phone patterns, and the add-ons that exist for frontline staff.

Why it happens

Each F3 user gets an account in your directory, a mailbox, Teams, and access to SharePoint and the collaboration services the tenant runs. Teams is the centre of it, because the features built for this workforce live there: shift scheduling, task publishing from head office to sites, and approvals that work on a phone. For most frontline deployments Teams is the product and the rest is supporting cast.

Office is licensed for the web and for mobile devices rather than for installation on a PC. Microsoft’s own comparison of the frontline plans is direct about it: F3 gives full editing in the web and mobile versions of Word, Excel, PowerPoint and OneNote, and desktop apps are not included. F1 below it gives the same applications read-only.

The management rights are the pleasant surprise, and they are the reason F3 is a serious licence rather than a cheap one. It carries Intune Plan 1, Entra ID Plan 1 and Windows 11 Enterprise E3, which means enrolled shared devices, kiosk configuration, conditional access rules and application protection policies on personal phones are all available at the frontline price. Very little in the tier above changes how you would manage these devices.

The first hard limit is the mailbox. Microsoft’s Exchange Online service description puts the F3 mailbox at 2 GB with no archive mailbox included, though one can be bought as an add-on through Exchange Online Archiving. For somebody receiving rotas and internal notices that lasts a long time. For anyone in a mail thread with customers and attachments it fills within months, and the remedies are a retention policy that removes old mail automatically or a different licence.

The second is storage. Cloud storage on the frontline plans is 2 GB per user, not a terabyte. Microsoft’s own migration guidance carries the warning that matters here: OneDrive becomes read-only for users who are over the 2 GB limit after a switch to an F plan. Identify and reduce anyone’s storage before the change rather than explaining it afterwards.

The third is desktop Office, and it is the one that generates complaints. An F3 user cannot install Word, Excel or classic Outlook, and the applications will not activate against an F3 account. Every rollout that fails does so the same way: somebody with a desk and a PC was licensed as frontline to save money, and within a fortnight has asked for Excel, hit the mailbox limit and consumed more support time than the licence difference was worth.

Full reference

F1, F3 and E3 side by side

Designing for shared and personal devices

Two patterns cover most frontline estates. Shared devices are enrolled in Intune, run in a shared or kiosk mode, and sign users out at the end of a shift so the next person starts clean. Teams supports that sign-out model directly, which is what makes shared tablets on a shop floor workable rather than an incident waiting to happen.

Personal phones are the other pattern, and enrolment is usually the wrong answer for them. Application protection policies, included in the Intune entitlement, protect company data inside the Teams and Outlook apps without taking any control of the employee’s device. Combined with conditional access from the Entra ID Plan 1 entitlement, that gives you a defensible position without asking staff to enrol a phone they paid for.

Switching people onto F plans without losing data

1. Find users whose mailbox or OneDrive is over 2 GB before you do anything, because they are the ones this will hurt.
2. Reduce the mailbox with a retention policy, and move OneDrive content to a SharePoint site the team owns.
3. Remove the old licence and assign the F licence in the same operation. Microsoft’s guidance is explicit that removing a licence and reassigning later can affect a user’s data.
4. Expect OneDrive to go read-only for anyone still over 2 GB after the change.
5. Re-check the assignment when people change roles: a promoted supervisor left on a frontline licence becomes a support ticket rather than a saving.

Add-ons and the tier below

• Exchange Online Archiving can be added where a frontline worker genuinely needs mail retention, rather than moving the whole population up a plan.
• Microsoft sells F5 Security and F5 Compliance add-ons for the F1 and F3 SKUs, which carry most of the E5 security and compliance capability at frontline scale.
• F1 is the cheaper tier for people who never send mail and only read what is published to them, since its Office rights are read-only and it has no mailbox.
• Versions of the frontline plans with and without Teams exist, so read the SKU name on the quote.
• Frontline plans are sold under Microsoft’s product terms for frontline workers. If you are unsure whether a role qualifies, check the terms before assigning at scale rather than after.

Mixing plans, which is the normal state

A site with forty frontline staff, three managers and one administrator should be licensed as forty frontline seats and four information-worker seats, not as forty-four of either. Microsoft supports combining Enterprise, Business and standalone plans in one tenant, and the arithmetic almost always favours doing so over standardising everyone on the highest plan somebody needs. Review the split annually, and whenever a site changes shape.

Questions people ask about this