Microsoft has bundled Defender for Office 365 Plan 1 (MDO P1) into Microsoft 365 E3 effective the 2026 commercial cycle. The list price of E3 rises by roughly $2 per user per month to absorb a SKU that previously listed at $2.00/user/month standalone — on paper, neutral. In practice, the move collapses an entire add-on revenue line, narrows the price gap between E3 and E5, and removes the strongest cost-justification argument that buyers used to keep their phishing protection separate from the E3 base. If your renewal sits inside this 2026 cycle, the new E3 stack changes the math on E5 upgrade pressure, on third-party email security alternatives, and on what you should accept at the table. The July 2026 M365 price increase sits directly on top of this bundling change, so the combined effect is heavier than the bundle alone suggests.
What changed in 2026
For most of the last six years, Defender for Office 365 Plan 1 existed as a discrete add-on SKU. Enterprises on Microsoft 365 E3 who wanted Safe Attachments, Safe Links, anti-phishing for impersonation, and the basic post-delivery investigation tooling had to bolt MDO P1 on at $2.00 per user per month under the EA, with corresponding line items on every true-up. CSP buyers paid similar economics with monthly billing. Microsoft 365 E5 always included MDO P2 (which includes everything in P1 plus Threat Explorer, Automated Investigation and Response, Attack Simulator, and a richer hunting surface). The line in the sand was clean: E3 plus add-on, or E5.
In 2026, Microsoft has erased that line. MDO P1 is now embedded in Microsoft 365 E3 with no separate SKU on the price list for new E3 deals, and a forced inclusion at renewal for incumbent E3 tenants. The list price of E3 has moved up by roughly $2 per user per month to absorb it — arithmetically a wash if you were already paying for MDO P1. For the larger share of enterprises that were not buying MDO P1 (running third-party email security or accepting Exchange Online Protection alone), the change is a forced uplift you did not ask for.
This is not a Microsoft generosity move. It is a deliberate SKU collapse that does two commercial things at once: it kills an add-on revenue line that was easy to cancel, and it narrows the price gap between E3 and E5 so the next step-up looks less daunting. Both effects favour Microsoft. Both effects need to be defended against at your next renewal.
This is the same playbook Microsoft ran with Intune (folded into E3 in 2017) and with the original Defender for Endpoint P1 collapse. Whenever an add-on SKU shows healthy attach rates but easy churn, Microsoft pulls it into the base suite, takes the equivalent dollar in a list price rise, and removes the buyer's ability to cancel it independently.
The $2 price arithmetic and why it isn't neutral
The arithmetic Microsoft will show you is symmetric. Before: E3 at $36.00/user/month plus MDO P1 at $2.00 if you bought it — effective $38.00 for the security-attached buyer. After: E3 at approximately $38.00/user/month with MDO P1 included. Same wallet, more value, no objection.
Three things break that arithmetic in real procurement:
- Buyers who never had MDO P1 attached. Roughly 40–55% of E3 customers in our engagement base did not carry MDO P1 in 2025. For those tenants, the $2 uplift is a net new spend they cannot opt out of. At 10,000 seats that is $240K per year you did not have on your last renewal.
- Buyers running third-party email security. Proofpoint, Mimecast, Abnormal Security, and IRONSCALES customers in particular were the deliberate non-MDO segment. They now pay for MDO P1 inside E3 plus the third-party tool. The duplicate-spend posture forces a make-or-break decision at renewal.
- Buyers who had MDO P1 at discounted rates. Heavy negotiators historically pulled MDO P1 into the 30–50% off bracket when bought alongside other security adds. That discount disappears when the SKU disappears. The new bundled list rate effectively rolls back the discount.
What the MDO P1 bundle kills (and what survives)
The bundle eliminates a discrete add-on line item and the negotiation surface that came with it. Several adjacent buying behaviours are now harder.
Killed: The "swap MDO for Proofpoint" cancellation, which used to recover $24/user/year. The "we'll buy MDO at renewal but cut it again next year" lever. The selective enablement strategy where you bought MDO P1 only for executive users while leaving frontline users on EOP — no longer possible because the licence is now per-user-population-wide inside E3.
Survives: The third-party email security decision, but on harder economics. Microsoft 365 advisory engagements in 2026 are spending more time than ever modelling the three-way trade-off between Proofpoint/Mimecast retention, MDO P1 (which you now pay for anyway), and MDO P2 (the upgrade path into E5). The right answer is no longer obvious and depends heavily on your incident history and detection telemetry maturity.
Why E5 just got harder to refuse
The strategic effect of the bundle is the narrowing of the gap between E3 and E5. With MDO P1 in E3, the residual delta to E5 covers MDO P2 (Threat Explorer, AIR, Attack Simulator), Defender for Identity, Defender for Cloud Apps, Defender for Endpoint P2, Power BI Pro, Audio Conferencing, and a number of compliance components. The list price gap remains roughly $21–23 per user per month, but the perceived value gap has shrunk because the base E3 stack now looks "more secure" on a marketing slide.
Microsoft sales motion in 2026 leans hard into this narrowing: "you've already accepted MDO P1, the next step is just AIR and Attack Simulator, that's not a big leap." That framing is wrong — MDO P2 is qualitatively different from P1 and the operational maturity needed to use AIR is non-trivial — but it is the framing you should expect to hear and prepare to push back on. Our E5 vs E7 comparison walks the residual delta SKU by SKU.
Negotiation leverage you still have
The bundle removes one lever but does not remove the negotiation entirely. Three angles continue to work in 2026.
1. Refuse the uplift as separate from the July 2026 price increase. Microsoft will try to combine the MDO bundling uplift with the broader July 2026 E3 price increase in a single number on your renewal quote. Demand a line-item separation. The MDO uplift is a discrete event with a discrete dollar figure; conflating it with the general price increase obscures both. Once separated, the MDO uplift can be discounted as a goodwill gesture without touching the broader price increase — Microsoft has more room to move on the bundle absorption than on the headline rate.
2. Pull MDO P2 into E3 at marginal cost. If you are going to be inside MDO P1 regardless, the marginal cost of MDO P2 across the EA renewal is materially less than the list delta suggests. Concession patterns in March–May 2026 EA renewals show MDO P2 attach prices of $1.20–$1.50 per user per month for E3 customers willing to commit to the upgrade for the full three-year term. That is half the standalone list rate and well below the implied price inside E5.
3. Use the bundle as the rationale for a fresh competitive review. The discount profile your incumbent LSP gave you in 2023 on MDO P1 is dead. That fact gives you cover to invite a competing LSP to bid on the renewal, since the cost stack has materially changed. Concurrent Unified Support pressure compounds the leverage.
Anonymised case study: 8,400-seat manufacturing client
An 8,400-seat industrial manufacturer with a 1 March 2026 EA renewal sat exactly in the bundle window. They ran Proofpoint for email security and had never carried MDO P1. The Microsoft quote presented the new E3 list with bundled MDO P1 as a 5.4% all-in increase, blaming "value uplift in the suite." Our intervention split the increase into its components: 2.9% from the July 2026 price uplift, 1.8% from the MDO bundle absorption, and the residual from EA volume tier collapse. The client kept Proofpoint, accepted the MDO P1 bundle as unavoidable, declined MDO P2, and used the line-item transparency to negotiate the bundle absorption down by 60% as a renewal goodwill. Net renewal year-one impact: 3.1% instead of 5.4%, saving $312K in year one and $968K over the three-year term.
Action plan before your next renewal
- Map MDO P1 attach status at the SKU level today. Pull your current EA price sheet. If MDO P1 was already on it, the bundle is neutral on your wallet. If it was not, you have a real new line item coming.
- Force line-item separation in the renewal quote. Demand the MDO bundling uplift be quoted as a discrete number, separate from the July 2026 price uplift. Microsoft will resist; the data they share when forced to break it apart is exactly the data you need to negotiate it.
- Decide on third-party email security in the same cycle. The economics of running Proofpoint or Mimecast alongside the now-mandatory MDO P1 have shifted. Run the all-in cost model in the same negotiation cycle, not as a separate exercise six months later.
- Test the MDO P2 attach economics. Ask for an MDO P2 upgrade quote inside E3 alongside the renewal. The 2026 attach pricing on this specific SKU is more flexible than the headline E5 step-up.
- Coordinate with your EA tier-collapse strategy. The bundle interacts with the volume tier change in ways your LSP will not volunteer. Model both together or you will leave money on the table on each independently.
The MDO P1 bundle is not catastrophic on its own, but it is the third lever Microsoft has pulled in the same renewal cycle (volume tier collapse, July 2026 price increase, MDO bundling) and each one compounds. Treat them as one negotiation, not three.