Microsoft 365 licence tiers, compared on what they actually include
Most licence comparisons are a feature table with sixty rows and no opinion. Here is what actually changes as you move up the tiers, and where we see organisations paying for capability nobody uses.
Three families, not one ladder
Microsoft sells three separate product families, and the confusion usually starts from treating them as one continuous ladder. Business plans (Basic, Standard, Premium) are capped at 300 seats and priced for that market. Enterprise plans (E1, E3, E5) have no seat cap and carry a different compliance and eDiscovery baseline throughout. Frontline plans (F3) are priced for staff who need mobile access and shift-based tools but not a permanent desk and inbox. An organisation of 150 people is not choosing a rung on a ladder from F3 to E5 — it is choosing which family fits which group of people, and possibly more than one.
What Business Premium actually buys you
Business Standard gets you the desktop Office apps and Exchange, Teams and SharePoint — essentially productivity, not security. Business Premium is the meaningful step up, and it is a security step, not a productivity one: Microsoft Intune for device management, Defender for Business, Entra ID P1 with conditional access, and Defender for Office 365 Plan 1 for phishing and malware filtering on top of the basics.
For most organisations under 300 seats, Business Premium is where the Essential Eight controls we assess against — application control, MFA enforcement, patching visibility — actually become achievable inside the licence you are already paying for, rather than needing a third-party tool bolted on. If your organisation is still on Business Standard for cost reasons, model the cost of the third-party tools you are using to cover that gap before assuming Premium is the more expensive option.
Why E3 exists once you outgrow Business
E3 is the enterprise workhorse, and organisations move to it for two reasons that have nothing to do with the 300-seat cap: a larger mailbox and unlimited archive under Exchange Plan 2, and Standard eDiscovery for genuine legal and compliance holds. E3 also includes everything Business Premium has from a security standpoint, so the move from Premium to E3 is rarely a security upgrade — it is usually a mailbox, compliance or Windows licensing decision.
The mistake we see most often here is organisations moving their whole tenant to E3 because two or three people in legal or finance need eDiscovery, when a hybrid approach — covered below — would have done it for a fraction of the cost.
E5 is a security decision, not a productivity one
E5 adds Microsoft Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Entra ID P2 with Identity Protection and Privileged Identity Management, Microsoft Sentinel integration, Advanced eDiscovery and Compliance, and Power BI Pro. None of that is productivity — it is a genuine security operations and compliance upgrade, and it prices accordingly.
E5 is worth it when you are running detection and response as a real practice and need the telemetry Sentinel and Defender P2 provide, or when regulatory obligations demand Advanced Compliance features specifically. E5 is not worth it as a blanket licence for staff who never touch any of that — which describes most organisations that have it tenant-wide today.
Mixing tiers on purpose
The organisations getting this right are not choosing one tier for everyone. A common, defensible pattern: E3 or E5 for the small group who genuinely need advanced compliance or security telemetry — usually leadership, finance, legal and IT; Business Premium for everyone else, which covers the Essential Eight baseline at a materially lower cost per seat; F3 for frontline or shift staff who need mobile Teams and basic access without a full mailbox.
This only works if it is deliberate. Licence sprawl — a mix of tiers that accumulated through history rather than design — is the more common pattern, and it usually means someone is both overpaying and under-protected at the same time, on different seats.
What to check before your next renewal
- Run a per-seat utilisation review before renewing — which E5 or E3 features each licensed user has actually touched in the last 90 days.
- Confirm your Essential Eight controls are actually configured, not just licensed. Business Premium and E3 include the tools; neither turns application control or conditional access on for you.
- Ask what changed in the last twelve months. Microsoft has repriced and repackaged tiers before, and a licence agreement negotiated two renewals ago may no longer reflect what is actually on offer.
- Model the hybrid split above against your actual headcount by function before accepting a single-tier renewal quote.
Questions
Is Business Premium secure enough without E3 or E5?
For most small and mid-sized organisations, yes — Business Premium covers the Essential Eight baseline: application control, MFA and conditional access, and phishing filtering. E3 and E5 add compliance and advanced threat capability that matter for specific roles and regulatory obligations, not for every seat.
Can we mix Business and Enterprise licences in one tenant?
Yes, and it is the normal pattern once an organisation is large enough to have genuinely different needs by role. The tenant itself does not need to be uniformly licensed — individual users are assigned the licence that fits their function.
Do we need E5 for cyber insurance purposes?
Rarely as a blanket requirement. Insurers ask about controls — MFA, endpoint detection, backup — not specific SKUs. Business Premium or E3 configured properly usually satisfies what an insurer's questionnaire actually asks; see our guide to the renewal questionnaire for what gets asked in practice.
Find out what you are actually licensed for
A technology assessment includes a licence utilisation review — what you are paying for, what is actually configured, and where the gap is.