Microsoft 365 Licensing: The Complete Enterprise Guide

The M365 Licensing Landscape

Microsoft 365 is not a product. It is a portfolio of 40+ services bundled into licence tiers designed to maximise Microsoft revenue, not enterprise value. Understanding which tier you need, which add-ons are necessary, which services are already included in what you have, and how to negotiate the whole stack is the difference between a strategic asset and a chronic budget drain.

In 2026, the average large enterprise pays between $26 and $57 per user per month for their primary M365 licence. That range exists entirely because of tier selection, add-on accumulation, and negotiation outcomes — not because of any genuine difference in business need. Our engagements consistently find 20–35% recoverable savings in M365 estates that have not been independently reviewed in the past 18 months.

The M365 Tier Architecture

Microsoft 365 licences exist across three commercial segments — Enterprise, Business, and Frontline — each with a different tier structure and commercial architecture.

Enterprise Tiers

The $21/user/month gap between E3 and E5 is the single most important pricing decision in your M365 stack. Most enterprises upgrade the entire organisation to E5 to get one or two E5-only features — then discover that 60–70% of their users derive no value from the E5 premium features. The correct approach is population segmentation: E5 or E5 Security/Compliance add-ons for the users who genuinely need premium capabilities; E3 for the remaining population. A 5,000-user organisation that carries 3,500 unnecessary E5 licences is overpaying by approximately $1.76M over a three-year EA term.

For a detailed analysis of which population genuinely needs E5, see our M365 E3 vs E5 comparison.

Business Tiers: When They Apply

Microsoft 365 Business Premium ($22/user/month, capped at 300 users) includes Entra ID P1, Intune, Defender for Business, and M365 Apps. It is a viable option for organisations under the 300-user cap that do not need Exchange Online Plan 2, archiving, eDiscovery, or Entra ID P2. For organisations that have outgrown Business Premium, the migration path is to E3 — not Business Premium plus an accumulation of add-ons that exceed E3 pricing. For the comparison, see our Business Premium vs E3 analysis.

Frontline Worker Tiers

Microsoft 365 F1 ($2.25/user/month) and F3 ($8/user/month) exist for workers who do not use a dedicated PC or whose primary access is via shared device or mobile. The F1/F3 decision depends entirely on whether the worker population needs full Office apps (F3 provides web + mobile apps; F1 provides web only) and whether MDM enrolment via Intune is required (F3 includes Intune Plan 1; F1 provides Intune MAM-only). Misclassifying knowledge workers as frontline workers creates audit risk; failing to use frontline SKUs for genuine frontline populations creates unnecessary spend of $28–$34/user/month versus $2.25–$8. See our frontline worker licensing guide for the classification framework.

The Four M365 Overspend Mechanisms

In our 500+ engagements, M365 overspend consistently traces to four mechanisms — often operating simultaneously.

Mechanism 1: Default E5 Acceptance

Microsoft account teams present E5 as the "standard" enterprise tier in 2026. That framing is commercially motivated: E5 generates 58% more revenue than E3 per user. The correct question is not "why would we not take E5?" but "which of our users genuinely need E5-only features, and what is the incremental annual cost per user for those features?" The answer for most organisations is 15–30% of the user population genuinely needs premium security, compliance, or telephony features. E5 for the remaining 70–85% is waste.

Mechanism 2: Add-On Duplication

The second mechanism is purchasing standalone add-ons that are already included in the base E3 or E5 licence. The most common duplications:

• Entra ID P1 standalone on top of M365 E3 (E3 includes P1) — $6/user/month wasted
• Intune Plan 1 standalone on top of M365 E3 or E5 (both include Intune Plan 1) — $8/user/month wasted
• Defender for Business standalone for M365 E3/E5 users (E3 includes Defender for Business) — duplicate
• Exchange Online Plan 1 standalone for E3 users (E3 includes Exchange Online Plan 2) — duplicate
• Power BI Pro standalone for M365 E5 users (E5 includes Power BI Pro) — $10/user/month wasted

Add-on duplication analysis consistently recovers $3–$12/user/month across an enterprise M365 estate.

Mechanism 3: Ghost Licences

The third mechanism is unused licences. Microsoft EA true-up mechanics mean you add users during the year and pay for them at true-up, but departing users remain on the licence count unless actively harvested. The average enterprise has 12–18% ghost licences in their M365 estate — licences assigned to departed employees, contractors, service accounts, and test users. At E3 rates, 15% ghost licences on a 10,000-seat estate costs approximately $648K over a three-year term. Our M365 licence harvesting guide covers the systematic recovery process.

Mechanism 4: Missed Mixed-SKU Deployment

The fourth mechanism is uniform SKU deployment across non-uniform populations. Most enterprise user populations are heterogeneous: executive users with collaboration-heavy workflows, operational staff with primarily email and document needs, field workers on mobile devices, and kiosk workers on shared devices. A single SKU applied uniformly across this population means overpaying for the lowest-value users and potentially underpaying for the highest-value users (who may need E5 features that E3 doesn't provide). A proper mixed-SKU model — E5 for executives and security/compliance roles, E3 for knowledge workers, F3 for operational staff, F1 for kiosk/shared device workers — routinely saves 20–30% on M365 line items compared to uniform E3 or E5 deployment.

Key M365 Components: What's In and What Costs Extra

The M365 bundle is deliberately complex. Microsoft's bundle architecture ensures that most organisations are paying for capabilities they don't use while also paying extra for capabilities they need that should be in the bundle. Understanding the inclusion boundaries is foundational to cost optimisation.

Microsoft Teams

Teams is included in all M365 E3/E5 licences and F3 licences. Phone System (the PBX replacement capability that enables Teams as a telephony platform) is included in E5 but requires a separate add-on for E3 ($8/user/month Teams Phone Standard). PSTN calling — the ability to make and receive calls to/from external phone numbers — requires either Calling Plans (Microsoft-provided PSTN, $12–$30/user/month depending on plan and region), Operator Connect (carrier-provided PSTN connectivity), or Direct Routing (enterprise-managed PSTN). The most common Teams telephony overspend is purchasing E5 for the Phone System inclusion when the E3 + Teams Phone Standard add-on ($8) would suffice — saving $13/user/month for telephony users. See our Teams Phone licensing guide.

Microsoft 365 Apps

M365 Apps for Enterprise (the Office client application suite) is included in E3 and E5. For organisations that need productivity apps without the full M365 services stack, M365 Apps for Enterprise standalone ($12/user/month) is an option — but only where the SharePoint, Teams, Exchange, and security services genuinely aren't needed. The more common scenario is organisations purchasing M365 Apps on top of an existing E3 deployment, creating a full duplication. The Apps licensing guide at microsoft-365-apps-licensing-guide.html covers the suite vs standalone decision and 5 scenarios where standalone beats the bundle.

Security: Defender, Entra, and Intune

E3 includes: Defender for Business (endpoint security for SME-scale environments), Entra ID P1 (conditional access, MFA, SSPR), Intune Plan 1 (MDM and MAM). E5 adds: Defender for Endpoint P2 (advanced threat protection, EDR), Entra ID P2 (PIM, Identity Protection, Access Reviews), Microsoft Defender XDR (SIEM-adjacent correlation), Defender for Cloud Apps (CASB). The security stack inclusion boundaries drive two common errors: (1) purchasing Defender for Endpoint P2 standalone ($5.20/user/month) on top of E5 (which already includes it), and (2) purchasing standalone Entra P2 for users whose E3 base does not include it, without first evaluating whether E5 Security ($12/user/month) or selective P2 population segmentation is more economical. For detailed security stack analysis, see our Microsoft security licensing guide and rationalise Microsoft security licensing.

Compliance: Purview and eDiscovery

E3 includes basic Purview capabilities: information protection (manual sensitivity labels, standard DLP, standard retention policies), standard eDiscovery (search and export, not Premium), and standard audit (90-day log retention). E5/E5 Compliance adds: Purview eDiscovery Premium (custodian management, advanced analytics, review sets), Communication Compliance (policy-based monitoring for regulatory requirements), Insider Risk Management, Records Management with disposition workflows, and Purview Audit Premium (one-year log retention, high-value audit events). The E5 Compliance add-on ($12/user/month on top of E3) is functionally equivalent to E5's compliance features without the security and telephony premium — the most cost-efficient path for organisations that need premium compliance but not premium security. See our M365 compliance add-ons guide.

Microsoft 365 Copilot

M365 Copilot ($30/user/month) is not included in any M365 E3 or E5 licence. It is a standalone add-on requiring an M365 E3/E5 base licence (M365 Apps for Enterprise does not qualify). The $30/user/month represents $360K/year for 1,000 users — making Copilot the most commercially significant M365 add-on decision most enterprises will make in 2026. The ROI case, prerequisite requirements, deployment governance, and negotiation strategy for Copilot are covered in our M365 Copilot licensing guide.

How M365 Is Licensed in an Enterprise Agreement

Understanding M365 EA mechanics is essential for cost management and negotiation. M365 licences in an EA are purchased as annual commitments per user, with true-up at the anniversary date to account for headcount growth. The key commercial features of M365 in an EA:

Price Lock

EA pricing for M365 is locked for the three-year term at the rates agreed at signing. Microsoft's pricing for M365 has increased significantly over the past decade — the 2022 commercial price increase moved E3 from approximately $32 to $36/user/month and E5 from approximately $54 to $57/user/month. Organisations renewing their EA have one opportunity every three years to lock the next period's pricing. The negotiation at renewal is the primary commercial lever on M365 costs. For a detailed framework, see our M365 cost reduction at renewal guide.

True-Up Mechanics

The EA true-up requires you to report and pay for any user increases above the committed licence count at the anniversary date. The mechanics create a systematic overpayment risk: organisations that fail to actively harvest licences for departed users continue paying for them at true-up. Our M365 true-up guide covers the harvesting process, reporting mechanics, and how to use the true-up process as a commercial lever.

Volume Tiers and Discount Architecture

M365 EA pricing is structured in volume tiers: 1–2,399 users (Level A), 2,400–5,999 users (Level B), 6,000–14,999 users (Level C), and 15,000+ users (Level D). Moving to the next tier threshold unlocks a discount step — typically 8–15% — that applies to all M365 products. For organisations near a threshold boundary, a credible model of user growth to the next threshold can be used as a negotiation lever to obtain Level B or C pricing before the headcount formally crosses. Microsoft deal desk has authority to apply next-tier pricing as a commercial concession in renewal negotiations. See our benchmark Microsoft EA pricing guide for volume tier context.

The Add-On Ordering Architecture

M365 add-ons — Copilot, Viva, Teams Phone, E5 Security, E5 Compliance — are ordered at the per-user level and must be assigned to users who already have a qualifying base licence. The commercial risk is add-on proliferation: organisations that add M365 Copilot for the executive population, Teams Phone Standard for telephony users, E5 Compliance for legal and HR, and Entra ID P2 for IT administrators end up with a blended M365 cost of $55–$75/user/month without explicitly deciding to approach E5 spend levels. An annual add-on architecture review that maps each add-on to its user population and validates that it is not already covered by the base licence is standard practice in well-governed M365 estates.

M365 vs Google Workspace: The Commercial Comparison

Microsoft's most significant enterprise pricing lever is the threat of Google Workspace migration. A credible, independently benchmarked Google Workspace alternative evaluation — particularly for knowledge worker populations — consistently unlocks 10–20% Microsoft discount authority in EA renewal negotiations, regardless of whether Google is genuinely being considered.

Google Workspace Enterprise Plus ($18/user/month) provides a comparable productivity suite for document creation, email, and collaboration. The gaps that matter commercially are: no native endpoint management equivalent to Intune, no Azure Active Directory equivalent (Entra ID), no equivalent to the E5 security stack, and the significant application migration cost for Microsoft-native document workflows. For purely productivity-focused populations, Google provides a credible pricing anchor. For security-driven or compliance-driven populations, the M365 bundle depth makes direct comparison difficult. See our M365 vs Google Workspace analysis for the full comparison framework.

M365 Negotiation Strategy

M365 is negotiable. Microsoft account teams treat M365 as a list-price product, but that is a commercial position, not a fact. In our 500+ engagements, every M365 renewal of meaningful scale has been negotiated below list price when approached correctly.

The Four Primary M365 Negotiation Levers

Lever 1: Volume commitment and tier anchoring. Present your credible three-year headcount projection and the resulting volume tier it supports. If your organisation is growing toward a higher tier, negotiate current pricing at the higher tier in exchange for the commitment. If your organisation is stable or shrinking, use that stability as leverage to preserve current tier pricing rather than accepting a tier reduction.

Lever 2: SKU mix reconfiguration. Presenting a mixed-SKU model (E5 for some users, E3 for others, F3/F1 for frontline workers) forces Microsoft to either accept a lower total M365 commitment or discount E5 to retain full-E5 penetration. The SKU reconfiguration analysis is both a genuine optimisation and a commercial lever.

Lever 3: Competitive alternative documentation. A documented, costed Google Workspace evaluation — even if it is a strategic review rather than a live migration plan — unlocks discount authority that does not exist in a competitive-context-free renewal. Microsoft's competitive response programme gives regional deal desk authority to approve discounts of 10–18% for renewals where Google is a documented alternative.

Lever 4: Azure MACC and M365 cross-product bundling. Organisations with significant Azure consumption can negotiate M365 pricing as part of a broader Azure MACC commitment. The Azure-M365 bundle creates deal desk authority above what either product generates alone. For details, see our Azure MACC negotiating leverage guide.

M365 Licensing Governance

M365 is not a set-and-forget licence. The platform changes continuously — new features, new capabilities, new add-ons — and the commercial architecture evolves with each Microsoft fiscal year. Organisations that review M365 licensing only at renewal are systematically overpaying between renewals. A minimum governance cadence for M365 includes:

• Monthly: Licence assignment audit — identify inactive licences, departed users, and service accounts. Run via Microsoft 365 Admin Centre Licence report and Microsoft Entra ID sign-in activity export.
• Quarterly: Add-on population validation — confirm each add-on (Copilot, E5 Security, E5 Compliance, Teams Phone, Viva) is assigned only to the user populations where it is justified and actively used.
• Pre-renewal (12–18 months before EA expiry): Full licence stack review — tier mix analysis, add-on duplication check, frontline worker classification review, competitive benchmark, and negotiation strategy development.

Organisations with structured M365 governance programmes spend an average of $4.20/user/month less on M365 than organisations without one — a saving of $504K/year for a 10,000-user estate.