Most enterprise buyers materially overspend on Microsoft EA online services because they fail to map what is already bundled inside the parent SKU against what is being sold as an add-on. The 2026 service-plan map has been reshuffled twice in the past 18 months: Defender for Office 365 P1 bundled into E3, several Intune Suite features moved into E5, and the new E7 Frontier Suite folded in additional Purview and Copilot Studio governance components. The buyer-side discipline is to enumerate the parent-SKU service plan list before accepting any add-on quote, and to disable service plans for users who do not need them. Done well, this single discipline returns 6-14% of M365 EA value per renewal.
If you are preparing an EA renewal and need to know what Microsoft EA online services are included in your current parent SKUs versus what Microsoft's account team has quoted as an add-on, the service-plan map below is the buyer-side reference our advisory team uses across live engagements. The map is current as of the 2026 Product Terms (May 2026 edition). The deeper structural shifts — Defender P1 into E3, Intune Suite into E5, and the E7 Frontier Suite — have each redrawn the service-plan boundaries. Buyers who have not re-mapped against the new boundaries are routinely paying twice for the same capability.
What's included in M365 E3 (2026 baseline)
M365 E3 is the mainstream enterprise SKU and the persona we model as default-included for the broadest population. The 2026 E3 service-plan list:
- Microsoft 365 Apps for Enterprise — the Office desktop suite (Word, Excel, PowerPoint, Outlook, OneNote, Access) with Project and Visio as separate SKUs.
- Exchange Online (Plan 2) — 100 GB mailbox, in-place archive, unlimited archive, eDiscovery hold.
- SharePoint Online (Plan 2) — advanced site features, in-place hold.
- OneDrive for Business (Plan 2) — unlimited storage (subject to Microsoft's tenant-size discretion).
- Microsoft Teams — chat, meetings, calling foundation. Phone System and Audio Conferencing remain add-ons.
- Defender for Office 365 P1 — bundled into E3 in the 2026 reshuffle. Anti-phishing, anti-malware, Safe Links, Safe Attachments. The standalone Defender for Office 365 P1 add-on is now redundant for E3 buyers.
- Microsoft Defender for Endpoint P1 — endpoint protection, attack surface reduction. P2 features remain in E5.
- Microsoft Intune — mobile device and application management (MDM/MAM).
- Microsoft Entra ID P1 — SSO, conditional access, MFA.
- Microsoft Purview Information Protection — manual classification, sensitivity labels. Automatic labelling remains in E5.
- Windows 11 Enterprise upgrade rights for qualifying devices.
What E5 adds over E3
M365 E5 layers four functional pillars on top of E3: advanced security, advanced compliance, advanced analytics (Power BI Pro included), and advanced voice/calling. The 2026 reshuffle also moved several Intune Suite features into E5 as bundled components, which means E5 buyers should disable parallel add-on subscriptions. The E5 service-plan additions:
- Defender for Office 365 P2 — Threat Explorer, Attack Simulator, automated investigation and response.
- Defender for Endpoint P2 — threat and vulnerability management, EDR with deep investigation.
- Defender for Identity — identity threat detection (formerly Azure ATP).
- Defender for Cloud Apps — CASB capabilities (formerly MCAS).
- Microsoft Purview eDiscovery Premium and Audit Premium — legal-hold workflow, custodian management, 10-year audit retention.
- Microsoft Purview Information Protection automatic labelling, DLP, Insider Risk Management, Communication Compliance, Records Management.
- Microsoft Entra ID P2 — Identity Protection (risk-based conditional access), Privileged Identity Management, access reviews.
- Power BI Pro — the entitlement for Power BI consumers and authors at non-Premium scale.
- Microsoft Teams Phone Standard — cloud-PBX capability. Calling Plan minutes remain separately priced.
- Intune Suite components moved into E5 — Endpoint Privilege Management (EPM), Cloud PKI, certain Microsoft Tunnel components. Buyers running standalone Intune Suite alongside E5 should review redundancy.
What E7 Frontier Suite adds over E5
The E7 Frontier Suite is the 2026 top-of-stack productivity SKU. It layers Copilot Studio governance, advanced Purview agents, and a defined set of Frontier-Suite-only services on top of E5. The E7 service-plan additions:
- Copilot Studio platform governance plane — tenant-wide policy, deployment governance, DLP for Copilot Studio.
- Microsoft Purview AI hub and Purview Data Security Posture Management for AI — AI workload visibility, prompt-and-response auditing, content classification of AI interactions.
- Microsoft Defender for Cloud Apps for AI — shadow-AI discovery, third-party AI app inventory and policy.
- Microsoft Entra Internet Access and Microsoft Entra Private Access — the Entra Suite SSE components (Internet Access + Private Access).
- Microsoft Entra ID Governance — advanced entitlement management, lifecycle workflows, advanced access reviews.
- Microsoft 365 Backup — native backup-and-restore for Exchange, SharePoint, OneDrive.
- Microsoft 365 Archive — long-term retention pricing tier for SharePoint.
Whether E7 is the right SKU depends on the persona, not the headline. The full pillar analysis sits at E7 Frontier Suite complete guide; in most engagements, only a subset of personas justify the E7 premium against E5.
Add-on services typically quoted alongside an EA
The following are quoted as add-ons in most 2026 EA proposals. Whether each is genuinely additive depends on whether the underlying capability is already bundled in the parent SKU. The buyer-side discipline is to check the parent-SKU service-plan list first:
| Add-on | In E3? | In E5? | In E7? | Notes |
|---|---|---|---|---|
| Copilot for M365 | No | No | No | Always separate paid add-on across all M365 tiers |
| Agent 365 | No | No | No | Separate add-on; not bundled in any M365 tier as of May 2026 PT |
| Defender for Office 365 P1 | Yes | Yes | Yes | Bundled in E3 from the 2026 reshuffle; standalone P1 redundant for E3+ buyers |
| Defender for Office 365 P2 | No | Yes | Yes | E3 buyers must add P2 separately if needed |
| Intune Suite (standalone) | No | Partial | Partial | EPM/Cloud PKI/Tunnel components moved into E5 in 2026; standalone Intune Suite still adds Remote Help, ServiceNow integration |
| Entra ID P2 / ID Governance | No | Yes (P2) | Yes (Governance) | P2 in E5; full ID Governance is E7 |
| Power BI Pro per-user | No | Yes | Yes | E5 includes Pro; Premium per-user is separate |
| Power BI Premium capacity | No | No | No | Capacity SKU separate from per-user |
| Teams Phone | No | Yes | Yes | Standard in E5; Calling Plan minutes still separate |
| Teams Premium | No | No | No | Always separate add-on |
| Project / Visio | No | No | No | Separate SKUs across all M365 tiers |
| Purview Insider Risk / Comms Compliance | No | Yes | Yes | Both included in E5; standalone purchase redundant |
Build the parent-SKU service-plan map first, then evaluate each proposed add-on against the map. Microsoft's account team is structurally compensated to include redundant add-ons on the quote; the buyer-side counter-proposal removes them explicitly with reference to the relevant service-plan IDs. The May 2026 Product Terms is the authoritative source.
Reconciling redundant add-ons on your EA renewal?
30-minute scoping call. Service-plan reconciliation is one of the standard advisory tracks; typical recovery is 6-14%.
Disabling service plans inside parent SKUs
The other side of service-plan reconciliation is the right to disable specific service plans inside a parent SKU for users who do not need them. The M365 Admin Center supports group-based license assignment policies that can disable service plans on a per-user basis. Disabling service plans does not change the per-seat cost, but it does materially change the security posture, audit-surface exposure, and user-side accessibility of components the buyer does not want active.
The two most common service-plan disable patterns: turning off Yammer (now Viva Engage) for entire regions where the platform is not deployed, and turning off Sway and Forms for high-compliance personas where the public-share defaults are not policy-compliant. The discipline is documented in the M365 Admin Center workflow; the Microsoft 365 licensing pillar guide covers the operational mechanics.
The Microsoft Negotiations briefing
Monthly. Buyer-side EA negotiation moves, audit defense playbooks, 2026 inflection-point intelligence. One-click unsubscribe.
Independent since 2016. Not affiliated with Microsoft Corporation.
Where to take service-plan reconciliation from here
Service-plan reconciliation is one of the T-9 buyer-side work products in the renewal cadence. The output is a parent-SKU service-plan map with a redundant-add-on column, signed off by IT and security before the T-6 counter-proposal phase. The EA renewal preparation page walks the broader cadence; the M365 license audit tool takes the same data inputs and produces a rightsizing recommendation. If the parent-SKU mix is also under negotiation, the counter-proposal playbook walks how the persona-segmented mix is filed alongside the service-plan reconciliation.