How to Map Microsoft 365 E3 vs. E5 Security Features to Your Real Risks

Retrospective: this article looks back at events from July 2017, written in 2026 with the benefit of hindsight.

Microsoft 365 E3 and E5 both include significant security capabilities, but they are packaged differently and named inconsistently over the years. Here is how to map what each tier offers to the risks you actually face — and decide whether E5 is worth it.

Start with your risks, not the feature list

Most mid-sized organizations face the same top risks:

Account takeover through phishing and stolen passwords.
Business email compromise and invoice fraud.
Ransomware delivered via email or compromised endpoints.
Data leakage — accidental sharing or deliberate theft.

What E3 covers

Identity: Entra ID P1 — Conditional Access, MFA, basic sign-in reporting.
Devices: Intune for device compliance and app protection.
Email: Exchange Online Protection anti-spam and anti-malware.
Data: sensitivity labels and core data loss prevention for Exchange, SharePoint and OneDrive.

What E5 adds

Identity: Entra ID P2 — risk-based Conditional Access, Identity Protection, Privileged Identity Management, access reviews.
Email: Defender for Office 365 Plan 2 — Safe Links, Safe Attachments, attack simulation, threat investigation.
Endpoints: Defender for Endpoint Plan 2 — EDR and automated investigation.
SaaS and identity: Defender for Cloud Apps and Defender for Identity.
Data and compliance: auto-labeling, Insider Risk Management, Premium audit with longer retention.

How to decide

If you lack an EDR and email threat protection, E5 Security add-ons or full E5 often cost less than separate products.
If you already own third-party EDR and email security, E3 plus targeted add-ons may be more economical.
Mix licenses: E5 for admins, executives and finance; E3 for everyone else, where licensing terms allow.

Most important step

Whichever you choose, configure what you have. An E3 tenant with strong Conditional Access beats an E5 tenant with default settings.