CIO Brief: E3 or E5? Making the Microsoft 365 Security Licensing Decision
Retrospective: this article looks back at events from July 2017, written in 2026 with the benefit of hindsight.
The short version: Microsoft 365 E3 includes solid security basics. E5 adds advanced threat protection, risk-based identity controls and stronger compliance tools. Whether E5 is worth the difference depends on what you already own — and whether you will actually configure it.
The real question
E5 costs meaningfully more per user per month than E3. Across a few hundred users, that is a significant annual decision. But the bigger cost is often hidden: paying for security features nobody turns on.
When E5 usually makes sense
- You do not have a modern endpoint detection and response tool or advanced email security, and would otherwise buy them separately.
- You handle regulated or highly sensitive data and need stronger compliance tooling.
- You want risk-based sign-in protection and just-in-time admin access.
- You have — or will hire — people to configure and monitor these tools.
When E3 plus add-ons may be better
- You already own a strong EDR and email security product you are happy with.
- Only certain groups (admins, executives, finance) need advanced protection.
- Your team does not have capacity to operate E5 tools yet.
Questions to ask your team
- Which E5 features would we actually configure in the next six months?
- What third-party tools could we retire if we moved to E5?
- How much of what we already license is turned on today?
The decision
Ask for a license utilization review before any upgrade. Many companies discover they can raise their security significantly with features they already own — and then upgrade only the users who need more.
- Microsoft 365 Arrives (July 2017): Security Bundled Into the Productivity Suite Platform Changes
- How to Map Microsoft 365 E3 vs. E5 Security Features to Your Real Risks How-To & Hardening
- Microsoft 365 Security Baseline Checklist for New Tenants How-To & Hardening