20 pages. Microsoft license overlap is not an accident — the bundle architecture is designed so that capabilities sold inside M365 E3 and E5 are also sold standalone, and most enterprises end up paying for both. This report names the nine duplicate SKUs we find most often, shows where each one already lives inside a bundle you license, and gives you the reclaim playbook to strip them out before your next true-up or renewal.
Built for IT asset managers, procurement leads, CFOs, and licensing owners preparing an EA true-up or renewal. No spam. Unsubscribe anytime.
Enter your details for immediate access. Your information is never shared or sold.
Joined 2,400+ IT, procurement, and finance professionals who have used this reclaim playbook
Every entry shows the standalone SKU, the bundle that already includes the same product use rights, and the per-user math on what removing the duplicate returns to your budget. The pattern is consistent: a security or analytics capability lands as a standalone line on the order form while the identical entitlement sits dormant inside an M365 E3 or E5 seat you also pay for.
Defender for Endpoint Plan 2 is a full component of Microsoft 365 E5 and the E5 Security add-on. Enterprises that bought standalone Defender for Endpoint P2 before consolidating to E5 frequently carry both lines for years. The report shows how to confirm activation source in the Microsoft 365 admin center and drop the standalone subscription at the next anniversary.
Microsoft Entra ID P1 (formerly Azure AD Premium P1) is bundled into M365 E3. Buying it as a standalone or as part of a legacy EMS E3 line on top of M365 E3 is one of the most common overlaps we find — conditional access and group-based licensing run from the bundled entitlement, not the duplicate.
Entra ID P2 — the identity governance, PIM, and risk-based conditional access tier — is included in M365 E5 and E5 Security. Organisations that layered EMS E5 onto an E5 seat, or kept standalone P2 after an E5 upgrade, are paying for governance twice. The report covers the reconciliation steps.
Microsoft Intune Plan 1 is included in every M365 E3 and E5 seat. Standalone Intune or legacy EMS lines purchased for a device-management project routinely survive long after those users moved to a full M365 bundle. We show the device-vs-user entitlement check that confirms the overlap.
Power BI Pro is a standard inclusion in Microsoft 365 E5. Standalone Power BI Pro seats assigned to users who also hold E5 are pure duplication. The report quantifies the reclaim and flags where Power BI Premium (capacity, now Fabric F-SKUs) is genuinely additive versus where Pro is simply doubled up.
Defender for Office 365 P2 (Safe Attachments, Safe Links, attack simulation, automated investigation) ships inside M365 E5 and the E5 Security add-on. Standalone Defender for Office 365 lines purchased during a phishing-response initiative are frequently never retired after the E5 move.
Defender for Identity (formerly Azure ATP) is part of M365 E5 and E5 Security. Because it is deployed by the security team rather than the licensing team, the standalone subscription often persists on the order form well past the point where every protected user already holds E5.
Audio Conferencing is included in M365 E5 and is available as a free add-on with E3 in most regions under current Teams licensing. Paying for a separate Audio Conferencing line per user, on top of a bundle that already grants it, is a quiet recurring overlap across large Teams estates.
Windows 10/11 Enterprise E3 is a component of Microsoft 365 E3. Enterprises that also carry a separate per-device Windows Enterprise line through Volume Licensing are licensing the desktop OS twice for the same users. The report covers the device-based vs user-based reconciliation that exposes it.
Overlap is rarely a single bad decision. It accumulates because three structural gaps keep the duplicate invisible at the exact moments you could remove it. Each is covered in the report with the reconciliation step that closes it.
When an enterprise moves users from EMS or standalone security SKUs up to M365 E5, the old lines are supposed to be retired at the next anniversary. In practice the upgrade and the cancellation are handled by different teams, so the standalone subscription keeps renewing alongside the bundle that now includes it — sometimes for three or four cycles.
The Microsoft 365 admin center will happily show a user holding both a bundled and a standalone version of the same service plan. Only one is actually doing the work. Without a service-plan-level reconciliation, the licensing team sees two products and assumes both are needed — when one is dormant and fully removable.
At renewal, the Microsoft account team rebuilds your quote from your current order form, not from a clean entitlement audit. Every duplicate you carried in is re-priced and rolled forward. Strip the overlap before you receive the renewal quote and the baseline the rep anchors to drops with it.
The report is written for the people who own the licensing line items — IT asset managers, procurement, and the finance partners who sign the renewal. Every duplicate SKU is documented with the bundle that already grants it, the admin-center check that confirms the overlap, and the per-user reclaim value.
It reflects the current Microsoft 365 product use rights as of mid-2026, including the Entra and Defender naming in force today and the bundle composition of E3 and E5. Where the 2026 commercial shifts — the move toward MCA-E and the elimination of programmatic EA volume discounts — change how reclaimed budget should be redeployed, the report flags it.
Related reading: our Microsoft 365 license optimization service, the cost optimization advisory, guidance from our independent Microsoft licensing specialists, and the full research library.
"We assumed our E5 migration had cleaned up the old security subscriptions. The entitlement audit found four standalone Defender and Entra lines still renewing underneath E5. We cancelled them at the anniversary and walked into the renewal with a smaller, cleaner baseline."
Head of IT Asset Management, Global Financial Services FirmEvery renewal cycle you carry a duplicate SKU, the account team quotes it forward as if it were essential. An entitlement audit turns that hidden spend back into negotiating room — and budget you can redeploy.