Microsoft 365 add-on licensing is the second-largest line item in most 2026 EAs — behind only base seat costs and ahead of Azure for many mid-market estates. The reason: Microsoft has spent five years moving features out of the base SKU and into priced add-ons (Copilot for Microsoft 365, Defender P2 step-ups, Entra ID P2, Intune Suite, Teams Premium, Sales Copilot, Service Copilot, Industry Cloud entitlements). The blended cost of an “E3 user with everything turned on” in 2026 is materially higher than an E5 user was five years ago — and you do not get an E5 user out of the deal. We catalogue every add-on, the rate, and the rationalisation move for each.
Why Microsoft 365 add-on licensing matters in 2026
Microsoft 365 add-on licensing is the layer of paid SKUs that sit on top of a base M365 seat — E3, E5, Business Premium, Frontline F3, or F1. Three years ago the add-on stack was small: a handful of compliance and security add-ons most enterprises ignored. Today it is the fastest-growing line item on the M365 invoice. Copilot for Microsoft 365 added $30 per user per month in 2024. Defender for Office 365 P2 and Defender for Endpoint P2 moved out of E3 (P1 stayed in, P2 step-up is now an add-on for E3 estates). Entra ID Governance arrived as a paid add-on in 2024. Intune Suite arrived in 2023. Teams Premium has continued at $10 per user per month. The cumulative effect: an organisation that bought E3 in 2022 thinking it was a complete seat will find in 2026 that the “complete seat” is now E3 + Copilot + Defender P2 + Entra P2 + Intune Suite + Teams Premium — an effective per-user cost that approaches or exceeds the headline price of E5.
The structural play Microsoft is running here is simple: keep the base SKU competitive, move differentiated value into add-ons, capture the upgrade revenue without disrupting the base contract. The buyer-side response has to be equally structural: catalogue every add-on, validate utilisation, and rationalise where the value is not real. Random sampling across 80+ M365 estates we audited in 2025 found a median of 27% of add-on spend was on entitlements with under 15% active utilisation.
The 2026 add-on catalogue with list prices
| Add-on | List price (PUPM) | Pairs with | Common waste pattern |
|---|---|---|---|
| Copilot for Microsoft 365 | $30 | E3 / E5 / Business Premium | Sub-30% MAU at 90 days |
| Defender for Office 365 P2 step-up | $3 | E3 | Mass-assigned when E5 estate is mixed |
| Defender for Endpoint P2 step-up | $3 | E3 | Same |
| Defender XDR (formerly 365 Defender) add-on | varies | E3 | Bought standalone when E5 sleight-of-hand would have been cheaper |
| Entra ID P1 step-up | $6 | E3 without bundled P1 | Already bundled in E3 — don’t double-buy |
| Entra ID P2 | $9 | E3 | Bought for “PIM” when only a handful of admin users need it |
| Entra ID Governance | $7 | Any seat | Sold as compliance must-have, used by 5% of buyers |
| Intune Suite | $10 | E3 / E5 | Mass-assigned, only EPM and Cloud PKI deliver real value |
| Teams Premium | $10 | Any Teams user | Used for meeting transcription only — 60%+ have free equivalents |
| Microsoft 365 Backup | $0.15/GB stored | Any seat | Storage budget grows uncontrolled |
| Microsoft 365 Archive | $0.05/GB/month | Any seat | Same as Backup — missing retention policy turns this into a runaway |
| Sales Copilot | $50 | Sales roles | Bought before D365 Sales licence assignment is rationalised |
| Microsoft 365 E5 Compliance step-up | $12 | E3 | Sold as audit defence, only PIM + Records Mgmt drive real value |
| Microsoft 365 E5 Security step-up | $12 | E3 | Same as Compliance — granular components are cheaper standalone |
| Power BI Pro / PPU | $10 / $20 | Any seat (E5 includes Pro) | Pro mass-assigned when consumption is in viewer-only mode |
| Project / Visio plans | $10–$55 | Any seat | Plan 5 assigned where Plan 3 or web-only would suffice |
The mass-assignment problem
The single highest-impact pattern across the add-on stack is mass-assignment — the practice of provisioning an add-on to every user in a security group rather than to the users who actually need it. Microsoft sells this approach because it locks in revenue independent of utilisation. Buyers tolerate it because the alternative requires utilisation telemetry they often do not have wired up. The result is structural overspend.
Three add-ons are particularly susceptible:
- Copilot for Microsoft 365. Median 90-day MAU we observe across 80+ enterprises: 26–42% depending on industry. Microsoft’s benchmark for “good” sits at 30%. If your enterprise sits below 30% MAU and you have mass-assigned, half your Copilot spend is on inactive users.
- Entra ID P2. The high-value feature is Privileged Identity Management (PIM), which is needed for admin users only. The mass-assignment to all users typically saves no real risk and costs $9 per non-admin user per month. A 5,000-seat enterprise with 200 admin users mass-assigned Entra ID P2 spends $432K on the 4,800 non-admins per year.
- Intune Suite. The valuable components are Endpoint Privilege Management (EPM), Endpoint Analytics, and Cloud PKI. The valuable component user-base is typically 10–30% of total users. Mass-assigned, the Intune Suite delivers $10 per user per month to Microsoft regardless.
Stack Copilot ($30) + Defender P2 step-ups ($6) + Entra ID P2 ($9) + Intune Suite ($10) + Teams Premium ($10) onto an E3 base, and the per-user cost reaches $99 PUPM — without considering any compliance, Power BI, or Project add-on. That is more expensive than E5 + Copilot ($57 + $30 = $87). The buyer-side discipline is to verify that the “E3 plus add-ons” path actually beats the “E5 plus Copilot” alternative on a TCO basis.
The rationalisation playbook
- Pull the assignment report. Microsoft Admin Centre exports per-user licence assignment. Aggregate by add-on.
- Pull the utilisation telemetry. For Copilot, the Copilot dashboard exports 28-day active users. For Defender, the Security Centre reports per-user policy hits. For Entra P2, the PIM activation report shows who has actually used PIM. For Intune Suite, the EPM and Endpoint Analytics consoles show coverage.
- Define active threshold. Anyone below 4 active sessions per 28 days is a candidate to deprovision. Below 1 active session per 28 days is unambiguous.
- Build the deprovisioning batch. Stage it. Run it at month-end so the next invoice reflects the new count.
- Reassign at need. Self-service add-on request via Service Catalogue closes the “but what if I need it later” objection.
- Build the rate baseline for renewal. The add-on utilisation rate becomes the negotiation leverage at EA renewal in 2026.
The bundle-versus-standalone decision
Microsoft increasingly bundles individual products into priced add-on suites. The decision discipline:
- E5 step-up vs add-on stack. Compare the E5 step-up cost ($24 PUPM over E3 in 2026) against the cumulative cost of the standalone add-ons you would buy. For users who would use four or more of the bundled features, E5 step-up beats the stack. For users who use one or two, standalone wins.
- Intune Suite vs Intune Plan 2 + standalone components. Suite is $10 PUPM. If you only need EPM ($4) and Cloud PKI ($1.50), buying the components is cheaper.
- E5 Compliance vs standalone PIM + Records Management. Same logic. E5 Compliance is $12 PUPM but most enterprises use only two or three of the included features.
Anonymised case study: $1.84M annualised on a 12,000-seat estate
A 12,000-employee professional services firm carried an add-on stack of Copilot ($30, 11,000 seats), Entra ID P2 ($9, all 12,000), Intune Suite ($10, all 12,000), Teams Premium ($10, all 12,000), and E5 Compliance step-up ($12, all 12,000). Annual add-on spend: $9.1M. Telemetry pulled across 90 days showed Copilot 31% MAU, Entra P2 PIM activation by 240 users (2%), Intune EPM coverage on 1,800 endpoints (15%), Teams Premium meeting-feature usage 14%, E5 Compliance feature usage concentrated on Records Management for 2,200 users. We rationalised: Copilot reduced to 4,200 seats (high-MAU only); Entra ID P2 to 600 admin and privileged users; Intune Suite to 2,400; Teams Premium to 1,800; E5 Compliance to 2,200. New annual spend: $4.6M. Net annualised saving: $1.84M after a $590K shift to standalone PIM and EPM for users who actually used them. Net per-seat M365 cost dropped 22%.
Microsoft 365 add-on licensing is the largest controllable cost in most 2026 M365 estates. The discipline is unglamorous — telemetry, deprovisioning, batch reassignment — but the dollar return is the highest per hour of any optimisation activity in the Microsoft stack. Layer the add-on rationalisation with the July 2026 price increase response strategy and the E5 vs E7 decision for your renewal cycle, and the add-on stack moves from cost overhang to negotiation lever.