The Complete Office 365 and Microsoft 365 Licensing Comparison

I’ve only met one other person that could write the complete Office 365 and Microsoft 365 licensing comparison. That person is Glenton Davis, Sr. Product Marketing Manager at Microsoft. (Although, I did stump him on a few CAS unified labeling features…after he schooled me about the new Microsoft 365 Security E5 plan.) To put it another way: Microsoft subscriptions are confusing.

What did I just buy?

Or if you work in sales—what did I just sell? Microsoft has no shortage of comparison charts. Here are a few links that I used for reference to write this article:

When I see that Office 365 E3 sort of includes AIP, I always need to refer to my notes for clarification. As of December 2019, here is the full Office 365 and Microsoft 365 Licensing Comparison including pricing. (Full XLSX here)

Update: April 2020 Licensing Updates are live! And yes, Microsoft decided to rename a bunch of Office 365 products as Microsoft 365 but did not add any EMS or Windows 10 features to the products. These changes are purely cosmetic and I have left products under the Office 365 umbrella in the chart.

In summary: “Microsoft 365 Business” now means “limit of 300 users.” The only bundle of Office 365, EMS, and Windows 10 in the M365 Business family is the M365 Business Premium plan.

Microsoft 365 Office 365 EM+S Windows 10
M365 Business Enterprise
Business Premium
A1 *
E3 + (E5 Sec)
E3 + (E5 Comp)
Retail $4.00 $10.00 $20.00 N/A $32.00 $44.00 $42.00 $57.50 $8.30 $5.00 $12.50 $12.00 $4.00 $8.00 $20.00 $35.00 $8.80 $14.80 N/A $7.00 $11.00
Nonprofit ? $2.50 $5.00 N/A $8.00 $14.00 $12.20 $23.00 N/A $0.00 $3.00 $3.00 N/A $0.00 $5.00 $15.20 $2.50 $6.00 N/A $1.80 $3.10
EDU Faculty N/A N/A N/A $30.00 $5.75 $9.75 $9.00 $10.75 N/A N/A N/A $2.30 N/A $0.00 $3.30 $8.00 $1.90 $3.30 N/A $2.20 $6.30
EDU Student N/A N/A N/A $30.00 $4.25 $7.75 $7.00 $8.00 N/A N/A N/A $1.80 N/A $0.00 $2.50 $6.00 $1.90 $3.30 N/A $1.60 $5.70
Government N/A N/A N/A N/A $32.00 $44.00 $42.00 N/A Retail Retail Retail $12.00 $4.00 $8.00 $20.00 $35.00 $8.80 $14.80 N/A Retail Retail
Standard Services
Max Users Any Any 300 Any Any Any Any Any 300 300 300 Any Any Any Any Any Any Any Any Any Any
Install Office on 5 Computers X X X X X X X X X X
Office Online RO X X X X X X X X X X X X X X
OneDrive 2 GB 1 TB 25+ TB 25+ TB 25+ TB 25+ TB 1 TB 1 TB 1 TB 1 TB 2 GB 1 TB 5+ TB 25+ TB
Stream RO X P1 P1 P1 P2 P1 P1 P2
Exchange Online EOK1 P1 P2 P2 P2 P2 X P1 EOK1 P1 P2 P2
Exchange Online Mailbox Size 2 GB 50 GB 100 GB 100 GB 100 GB 100 GB 50 GB 50 GB 2 GB 50 GB 100 GB 100 GB
Exchange Online Archive Size Add-on 50 GB Unlmtd Unlmtd Unlmtd Unlmtd 50 GB 50 GB Add-on 50 GB Unlmtd Unlmtd
SharePoint Online X** SOK1 P1 P2 P2 P2 P2 X P1 SOK1 P1 P2 P2
SharePoint Online DLP   X X X X X X
SharePoint Online eDiscovery       X X X X X X X X
SharePoint Online Insights   X X X X X X
Teams X X X X X X X X X X X X X
E3 Azure Active Directory Premium P1 X X X X X X X X X
Conditional Access X X X X X X X X X
Multifactor Authentication (Azure) X X X X X X X X X
Self Service Password Reset for AD X X X X X X X X X
Azure Information Protection Plan 1 X X X X X X X OME X X
Azure Rights Management X X X X X X X X X X X X
Microsoft Intune X X X EDU X X X X X X
Microsoft Advanced Threat Analytics X X   X X X X X X
E5 Azure Active Directory Premium P2 X X X
Azure Information Protection Premium P2 X X X
Azure Advanced Threat Protection for Users X X X
Microsoft Cloud App Security CAD X X X
Office 365 SafeDocs X X X X
Office 365 ATP
P1 Anti-Phishing X X X X
Anti-Spoofing X X X X
Malware Detection X X X X X X X X X X X X X
Safe Attachments X X X X
Safe Links X X X X
P2 Attack Simulator X X X
Automated Investigation and Response X X X
Threat Intelligence X X X
Windows 10
Pro Azure AD Join X X X X X X X X X X X
BitLocker X X X X X X X X X X X
Manage with Intune X X X X X X X X X X X
Windows Hello for Business X X X X X X X X X X X
E3 Attack Surface Reduction Rules X X X X X X X
Virtualization Rights X X X X X X
WD Application Conrtol Guard X X X X X X X
WD Application Guard X X X X X X X
WD Credential Guard X X X X X X X
WD Device Guard X X X X X X X
WD Exploit Guard X X X X X X X X
WD Remote Desktop Credential Guard X X X X X X X
  Windows Virtual Desktop (WVD) X X X X X X
E5 Microsoft Defender ATP X X X
Audio Conferencing X X
Common Area Phone
Domestic and International Calling Plan
Domestic Calling Plan
Meeting Room
Meeting Room without Audio Conferencing
Phone System X X
Skype for Business Online P1 P2 P2 P2 P2 P2 P2 P2 P2 P1 P2 P2 P2
Advanced Auditing X X X
Advanced Compliance X X X
 – Advanced Data Governance X X X
 – Advanced eDiscovery X X X
 – Customer Lockbox X X X
Azure App Proxy X X X       X   X
Bookings X X X X X X X X
Data Subject Requests X X X X X X X             X X
Delve     X X X X X X X X   X X X
Exchange ActiveSync X X X X X X X X X X X X
Exchange Inbox Rules X X X X X X X X X X
Exchange Online Archiving X X X X X X X X X X
 – Archive Mailbox X X X X X X X X X X
 – eDiscovery X X X X X X X X X X X X X
 – Litigation Hold X X X X X X       X X
 – Mailbox Backup X X X X X X X X
 – Retention Policies X X X X X X X
Exchange Public Folders X X X X X X X X X
Flow (Power Automate) K1 X X X X X   X X X X X X X
Forms F1 E1 E3 E3 E3 E5 E1 E1 E1   F1 E1 E3 E5
InfoPath X X X X   X X
Information Barriers X X X
Insights by MyAnalytics X X X X X X X X X X
Kaizala Pro X X X X X X X X X X X X X
MileIQ       X
MyAnalytics (Full) X X
Office 365 Cloud App Security Discovery ? X X X X X X X X
Office 365 Data Loss Prevention X X X X X X X X
Office 365 MFA (Not Azure MFA) X X X X X X X X X X X X X X X
Office 365 Shared Computer Activation X X X X X X X X
Office Message Encryption X X X X X X       X X
Planner X X X X X X X X X X X X
Power BI Pro X X
PowerApps X X X X X X X X X X X X
Premium Encryption X X X
Privileged Access Management X X X
StaffHub (Shifts) X X X X X X X X X X X X
Sway ? X X X X X X X   X X X X
To-Do ? X P1 P2 P2 P2 P3 X P1 X X X P2 P3
Visio Online Plan 1
Visio Online Plan 2
Voicemail X X
Whiteboard ? F1 P1 P2 P2 P2 P3 P1 P1 P1   F1 P1 P2 P3
Yammer X X X X X X X X X X X

* Microsoft 365 A1 is a one-time purchase.
** Unclear if this is read-only. Will update in the future.

Include Other Vendors When Making Your Microsoft 365 Licensing Comparison

At Infused Innovations, we prefer when our customers purchase a given feature set only once. Too often, we see a company purchase Enterprise Mobility + Security (EM+S) for the sole purpose of enabling Self-Service Password Reset (SSPR) with writeback for on-premises AD. That same company also owns Okta for SSO, AirWatch for MDM, and Netskope for CASB.

When we explain to the CFO that they already own EM+S, which contains similar functionality as those three other vendors, it’s usually a pretty quick discussion to get approval to start a proof of concept deployment standardizing on Microsoft 365. The budget that was allocated for the other vendors can then be used to purchase new security features like Microsoft Defender ATP and Azure Sentinel.

Circle the solutions you have deployed above. Is the price more than $57/user/mo?

Infused Innovations partners with a few other security vendors to fill some gaps, including KnowBe4, CyberArk, and SecPod, but Microsoft’s 60+ security products cover most customer’s needs. The added benefit to standardizing on Microsoft services is that they all integrate with the Microsoft Intelligent Security Graph, which allows the services to worth with each other and reduce false positives.

Even if you think you have a good grasp of your Microsoft 365 and Office 365 Licensing, I’d encourage you to sign up for one of our free cyber security assessments to have one of our experts review what you already own and create a strategic cyber security roadmap for your organization.

Which Microsoft 365 licensing plan should I buy?

I already expressed my thoughts that you’re (likely) on the wrong Microsoft license. For an organization of any size with an online presence, you should seriously consider one of the Microsoft 365 plans. (Unless you have purchased parts of the bundle through an EA, non-profit, or educational SKU.)

Just as you can purchase a new car without adaptive cruise control to save money in exchange for having to manually turn cruise control on and off, you can purchase Office 365 by itself to reduce your initial costs at the expense of having manually review logs. But with the projected shortfall of 3.5 million cyber security professionals by 2020, you may actually be increasing your overall costs if you don’t invest in automation now.

Microsoft spends over $1 Billion a year on security research and uses AI to interpret 6.5 trillion signals daily via the Intelligent Security Graph. With over 3,500 security engineers, it’s possible that Microsoft has more employees in its cyber security department than you have in your entire organization. All you have to do to take advantage of this combined risk intelligence and automation is purchase the correct Microsoft 365 license. And as of September 2019, you can now ingest your Microsoft 365 threat analytics data into Azure Sentinel for free!

Are you an educational organization? Read up here. Are you a non-profit organization? Read up here.

Micorosft 365 F1 for Frontline Workers

In April 2020, Microsoft changed the old Microsoft 365 F1 plan to Microsoft 365 F3. The new M365 F1 plan has no email or OneDrive storage. It’s essentially Microsoft Teams plus EM+S E3 to provide a secure device to access Microsoft Teams on.

What appears to be an oversight, is that EMS E3 appears to be available for only $4/mo now if you add the M365 F1 plan to any Office 365 plan. We’ll see if Microsoft addresses this by restricting licensing assignments.

Here’s a comparison of the Microsoft 365 Frontline worker plans:

Comparison chart of Microsoft 365 F1, F3, and Office 365 F3 plans.

Microsoft 365 F3 Licensing Comparison to Office 365 F1

At only $10/user, firstline workers, employees that only need email, and contractors are a few types of users that would benefit from the Microsoft 365 F3 license. The business value for investing in M365 F3 licenses include:

  • Foster culture and community: By utilizing Microsoft Teams, your employees will have access to persistent chat, and provide your firstline workers access to the same corporate resources in SharePoint Online that are used by the rest of your organization.
  • Train and upskill employees: Microsoft Teams can serve as your source of institutional knowledge. Train and upskill your employees, creating opportunities for workers to develop, grow, and apply their skills.
  • Digitize business process: Give your firstline workers and contractors access to your organization’s modern digital workflows that are embedded in SharePoint, Flow, and Teams.
  • Minimize risk and cost: Make sure your organization’s data is only accessed from compliant devices and reduce your attack surface for potential breaches.
Microsoft 365 F3 provides the following productivity tools:
  • Exchange Online Kiosk
  • SharePoint Online Kiosk
  • Microsoft Teams
  • 2 GB of OneDrive Storage
  • Office Online for web versions of Word, Excel, and PowerPoint

The main reason to upgrade to the Microsoft 365 F3 plan from Office 365 F1 is to add mobile security features. These include:

  • Multifactor Authentication (MFA)
  • Conditional Access
  • Intune for MDM and data sandboxing
  • Office Message Encryption
  • eDiscovery
  • Microsoft Advanced Threat Analytics

Infused Innovations also recommends adding Office 365 Advanced Threat Protection (ATP) P1 to this plan to help protect users from phishing attacks.

What is Microsoft 365 Business?

Microsoft 365 Business with Azure AD P2

If you have fewer than 300 employees and are currently using Office 365 E3, you need to switch to Microsoft 365 Business right now. Both 365 licensing plans are priced at $20/mo and Microsoft 365 Business adds Windows 10 Pro licensing, along with all the security features that you need to keep your organization secured. The price to value ratio is immense for M365 Business.

Microsoft 365 Business includes most of the security features from Microsoft 365 F3 plus the Office 365 ATP P1 benefits. This allows you to deploy MFA to all your users without them noticing.
Update 4/21/2020: M365 Business now includes Conditional Access and full AAD P1.

Infused Innovations recommends deploying Microsoft 365 Business with the Azure AD P2 add-on ($9/mo) to gain the following benefits:

  • Azure AD Identity Protection
  • User Risk Profiling, including
    • Impossible Travel
    • Stolen credentials
    • Anomalous behavior
  • Automatically force password changes for breached accounts
  • Automatically require MFA challenges for high-risk users

Microsoft 365 E3 with Microsoft 365 E5 Security (Formerly Identity Threat Protection)

Microsoft 365 E3 with Microsoft 365 E5 Security is the new “hero” SKU if your organization doesn’t need VoIP or Power BI. Pricing for the Microsoft 365 E5 Security add-on is $12/mo and can only be added to the Microsoft 365 E3 plan, which is $32/mo. The M365 E5 Security add-on gives you the following advanced features to your M365 E3 plan:

  • Azure ATP
  • Azure AD P2
  • Office ATP P2
  • Microsoft Cloud App Security
  • Microsoft Defender ATP

The five SKUs above provide comprehensive cybersecurity licensing to detect breaches and perform digital forensics across the entire attack chain. The P2 features of Microsoft SKUs also add automation features that respond to breaches at the speed of the cloud. Human minds can no longer keep up with modern attacks. Microsoft 365 E3 with Microsoft 365 E5 Security provides enterprise-class security features for your organization.

Microsoft 365 E3 is also the entry-level plan to allow access to Windows Virtual Desktop from a non-Windows 10 Pro device. All lower level Microsoft 365 plans require at least Windows 10 Pro to access WVD.

Microsoft 365 E5 Licensing Comparison

Microsoft 365 E5 allows you standardize on the entire Microsoft security and productivity stack for your organization for $57/mo. As previously mentioned, Microsoft 365 E5 adds VoIP integration to the Microsoft 365 E3 + Microsoft 365 E5 Security plan.

The other important SKU that you receive is Azure Information Protection P2. AIP P2 allows you to automatically apply encryption templates to documents based on regular expression templates. Microsoft will be releasing a new unified labeling experience to use across your AIP, DLP, and Cloud App Security policies. Update 5/2019: The new unified labeling experience has been released.


Unless you’re on Microsoft 365 E5, licensing and pricing plans are confusing. Fortunately, Microsoft is trying to simplify and consolidate their bundles around the features that fit common roles across multiple industries.

However, you’re probably asking yourself something like: I already own Windows 10 Pro licenses—do I need Microsoft 365 Business? Or, I have a volume license for Windows 10 Enterprise-how can I license only Microsoft Defender ATP? The easiest answer is to schedule a call using the form below to speak with one of our licensing experts. Prices change every month and Microsoft releases new Office 365 plans several times a year. Keeping up to date with Microsoft licensing can feel like a full-time job by itself. Which is why it’s important to select a Microsoft Gold partner to help guide you through the maze of licensing and Microsoft 365 pricing plans.

Change Log

94 thoughts on “The Complete Office 365 and Microsoft 365 Licensing Comparison

    1. Adam Kolarik

      Hi Dan,
      excellent job, I have same question as Jesse. Is there some posibility to get such xls file for internal usage?
      Thank you for your help

  1. Alexander

    your spreadsheet says, that conditional access is not included in Microsoft 365 F1 and later, that conditional access is one of the main reason for upgrading from O365 to M365. Is conditional access included in M365 or not?

    Thank you in advance.
    Best regards,

    1. Dan Chemistruck

      Conditional Access is included in the following Microsoft 365 SKUs: F1 / E3 / E5.

      Microsoft 365 Business does not include conditional access at the moment. The spreadsheet has been updated.

  2. Glenton Davis

    Dan – I love this! Awesome work! I love the Executive Briefing Center, meeting great customers like you, and talking about epic stuff. I’ll definitely brush up on those CASB nuances for next time 😉

    Looking forward to it. Talk soon.

    1. Dan Chemistruck

      A blank means that I’m fairly certain it’s not included but I don’t have a reference to a Microsoft document one way or another yet. The “-” means not included with a verified statement from Microsoft.

  3. Chris

    We’ve purchased E3 + EMS E5 and then were surprised to find out that Defender ATP wasn’t included.

    We can’t seem to find any information regarding EMS E5 including Defender ATP other than this blog. Can you confirm if the above table/content is incorrect about ATP being included in EMS E5?

    1. Dan Chemistruck

      Defender ATP is only included with Windows 10 E5, Microsoft 365 E5, or Microsoft 365 E3 + Microsoft 365 E5 Security as correctly indicated on the table. EMS E5 does not include Defender ATP and the table above does not state that it does either. (EMS E5 is a green column, currently 4th from the right side of the table.) I believe you are looking at the Microsoft 365 E3 + E5 Security column, which is different from Office 365 E3 ($20) + EMS E5 ($14.80).

      If you purchased Microsoft 365 E3 ($32) (you didn’t specify which E3 was purchased) and bought EMS E5 as an add-on, then I would swap EMS E5 with Microsoft 365 E5 Security ($12) instead to get access to Defender ATP. M365 E5 Security can only be purchased as an add-on to M365 E3 and no other SKUs. Feel free to request a licensing review at the bottom of the page if you would like assistance from our sales team.

      1. Chris

        Hi Dan,

        Thanks for getting back to me so quickly and your response is very helpful. I can see where we went wrong now as we were confusing E5 Security with EMS E5. We’ll look at swapping those add-ons. Thats great.

  4. Ingve Skaret

    Azure AD Premium P1 is not included in M365 Business. They have a new version called “Small Business”, but i can’t seem to find any information about it. I first noticed this when i tried accessing Sign ins in a tenant with M365 Business licenses. I have compared M365 Business and AAD P1 in the Office-portal to verify.

  5. Rico Ho

    This is the best information on security and its financial considerations that I have ever seen in a one place. Thank you for sharing.
    Do you know of any product/service that analyzes Microsoft audit logs and combines it with information from the dark web so that you know how many of your accounts are already compromised? how many bots/websites are impersonating your credentials to spam or phish your customers? how many of your users have weak password/practice? how many of your vendors/suppliers logins are already compromised?

    1. Dan Chemistruck

      Azure AD Premium 2 (Part of EM+S E5) scans the dark web for compromised accounts. If a compromised account is detected, the user will receive a “High” security risk rating. If you have Azure AD Identity Protection enabled, you can force an immediate password reset as soon as this is detected–there is no human interaction required for this once the protection policy is enabled.

      AAD logs will tell you that an account breach was detected, but it doesn’t state where on the dark web it was discovered.

      Phishing spam via domain impersonation can be completed via DMARC monitoring. We have a guide on how to setup DMARC with free Valimail monitoring here:

      As for supply chain risk, Cloud App Security will tell you if any websites or SaaS tools you’re using have been compromised. This either requires shipping firewall logs to CAS or using Microsoft Defender ATP on Windows 10 with CAS integration enabled.

  6. Nathan

    Do you have any information on how SCCM/Intune/Microsoft Endpoint Management fits into the stack? My understanding is it is included with anything that includes the EMS E3/E5 license.

    Thank you for this resource. It’s incredibly helpful!

  7. Simon

    Wow! This is, quite frankly, the single best summary I’ve found regarding this topic on the Web. Thank you very much for the great aggregation, and I agree with many of the suggestions made.

    Office 365 is a solid product. Also, I am a huge fan of Azure AD. While Microsoft is clearly delivering best-of-breed solutions in many aspects, it’s disappointing that it’s such a chore to collect this data and then come to an understanding of what each of the myriad of licenses will or will not include. There’s a tool to help me estimate Azure spend for a whole slew of services, so why doesn’t Microsoft just provide a tool that will suggest the best licenses based on the features I select as necessary?

    A bit of context regarding the situation that lead me to this article:

    1. My organization is a SMB well below the limits of the 300 user mark. A few users here and there need full-on O365 E5 licenses for the VoIP, and a couple use Power BI. Otherwise, it’s just E3 level capabilities.
    2. We have Windows 10 Pro endpoints, all of which roam. Our endpoints just “happen” to authenticate against a DC the times the employee is working onsite and is connected to the network, otherwise, it’s just cached credentials (and stale Group Policies). I would be absolutely thrilled to get them all Azure AD device joined, as we have absolutely no systems requiring internal auth.
    3. I really want to harness the powerful identity and data protection capabilities offered, such as Azure AD conditional access and user risk assessment, and Office 365 DLP and ATP.

    I’m thinking the M365 Business license, +add-ons for the few users that need them, might be the best option.

    1. We’ll be able to Azure AD join devices and manage them wherever they may roam using Intune.
    2. User/endpoint authentication will be performed against Azure AD, thus unifying the individual to the identity that actually matters when it comes to security.
    3. While my goal is to eventually utilize any and every feature Microsoft offers that can help us better manage and secure our identities…my organization doesn’t move very quickly. Sure, it’s only a subset of the functionality provided by a P1 license, but the chances that we’d actually utilize the ones that are missing anytime soon are slim. The benefits we would get, such as conditional access policies, are ones that we are currently missing the most. In addition, the device management features are quite complete, and I feel that we would lay a perfect foundation for a future P1/P2 by migrating our endpoint model to utilize them.

    Maybe you can help ensure I’m deciphering this information accurately and am on the right track? Any input would be greatly appreciated!

    Thanks again for a solid slice of insight.

    1. Dan Chemistruck

      Hey Simon! Sounds like an exciting project! A few tips: get at least one license of Microsoft 365 E5 or Microsoft 365 E3 + E5 Security. The latter option is missing customer lock box, automated AIP labels and a few advanced governance features, but will unlock Microsoft Cloud App Security and risk-based conditional access.

      Absolutely start with Microsoft 365 Business as the minimum license for your all your users to get access to Intune, Conditional Access with MFA, and Office Business desktop apps.

      The Azure AD P2 license is helpful because it automates the response to breached accounts, and forces a password reset immediately. With the single M365 E5 license, you’ll get this benefit for everyone in your tenant, although you’re officially supposed to license each user for it. Microsoft does not currently restrict Azure AD Identity Protection to licensed users only.

      If you’d like to actually chat, just submit a contact us form below. If you buy your licenses from us (same cost as from Microsoft), we have free proof of concepts available to help accelerate your onboarding.

  8. Simon R.

    Hi Dan, great overview!
    I want to share another observations which is about “MyAnaltics”. Based on your chart its included in section “Add-Ons” and listed in E5 suites only. In January 2019 however it was announced that MyAnalytics will be included in every Business& Enterprise Plan of Office365/ Microsoft365. You may want to update your chart accordingly?
    Thanks and regards

  9. Jake Ortman

    Thanks for this chart. I had seen this last year when I was researching moving a bunch of our clients from E3 to M365 Business, and had lost the link for it. Thankfully found it via an old reddit thread. This is far better than the documentation that Microsoft puts out for their stuff. Thanks for keeping this up to date!

    1. Dan Chemistruck

      Thanks for the compliment! Bing has the page as the first search result, but Google has us buried on the second page and only as the Reddit link. I haven’t figured out why Google is hating on this post yet.

  10. Scott

    This is the holy grail of license comparisons. My question is two fold. I’m a little confused here when it comes to Office 365 E3 and Office 365 E1 licensing.

    I’ve confirmed with Microsoft that Office 365 E3 is compatible with the Microsoft 365 E5 Security Pack. I have the option to add this to the license when I purchase it for 12.00 per user per month.

    I’ve also been told….Office 365 E1 is fully compatible with the 12$ Microsoft 365 E5 Security Pack but when I purchase the license it doesn’t have an option to add this feature Directly. However, I’ve been told you can just purchase extras of the security pack under the office 365 E3 license category and apply those to the E1?

    Due to volume we purchase Most things through a distributor and don’t pay list but I’m including list price instead.

    1. Dan Chemistruck

      Thanks! And, unfortunately, your source at Microsoft is wrong. Microsoft 365 E5 Security can ONLY be added to Microsoft 365 E3. I’ve been bugging the product teams to open this up to other plans for over a year, but no movement yet.

  11. Benny

    Would you allow the current spreadsheet to collapse columns so it is easier to directly compare some of the plans and their features to one another?

    I am interested in really being able to show off and derive the value between Office E3, EM+S E5, Microsoft E3, and Microsoft E3 + EM+S E5 bundle.

    It can be difficult to inspire some small/medium businesses to double their per-user license costs without concise understanding that can be derived from the great work you’ve provided here!

  12. Priya Ravichandran

    Good blog! I have a question for you regarding EMS: what’s the difference between Enterprise Mobility and Security E3 Full Kiosk and E3 Full?

  13. Jure Jereb


    First, let me thank you for really good licensing spreadsheet. This really simplifies a lot.

    But I have a question regarding the licensing that I cannot find a answer to anywhere: Do the M365 packages (especially the M365 Business) also include Client Access License (CAL) rights. I understand that you get the Exchange, Sharepoint and Teams “CALs” for the licensed users, but how about the CALs for other, basic, on-premise services like AD and Fileshare servers and SystemCenter products? Do customers which have hybrid infrastructure with users covered by M365 licenses, still need to buy Core CAL / Enterprise CAL for their users, in order to be able to use on-premises infrastructure in a formally licensed way?

    1. Dan Chemistruck

      Most of your on-prem CALs are not included with online licensing. EMS includes some SCCM and MIM CALs, but that’s about it.

      If you run AD or a file server in Azure, user CALs are included with the compute cost.

        1. Dan Chemistruck

          I am familiar with that page, and it is worded poorly. It does not state that a Windows Server Client Access License (CAL) is included with EMS. EMS only includes CALs for specific workloads, such as Microsoft Active Directory Rights Management Services or SCEP. These are not Windows Server CALs, which need to be purchased separate from the service CALs.

          To answer your question, yes these service CALs are included in the Microsoft 365 SKUs that contain the EM+S E3 feature set.

  14. Rajesh

    Hi, what a great page full of detailed information. One question though, what does the 0.75 mean in the M365 Business license under AD P1. I’m torn between M365 E3 and M365 Business for my company. I don’t need Win10 cloud licenses as everyone works in the office with a desktop that will be licensed. What would you recommend E3 or Business?

    1. Dan Chemistruck

      M365 Business just received full AAD P1 this month. I would get M365 Business plus Microsoft Defender ATP Standalone and Cloud App Security for everyone. Pickup one or two seats of full Microsoft 365 E5 to get automated threat responses and Power BI for the tenant.

  15. Guus van Berge

    Thank you so much for this blog. We use this comparison a lot!

    One question that comes to mind: in row 5 you say M365 E3 + E5 SEC. Do you mean EMS E5 with E5 SEC? because according to this comparison I would get ATP P2 as wel. But according to MS, EMS E3/E5 does not include ATP..hope you can clear this for me..I struggle with choosing the right licences from time to time..also because they change a lot..Ideally we would choose for M365 E3 because we dont use the VoIP options..but than again you need a lot of add ons to get the good stuff still (EMS E5, ATP P2).

    Ps. they are also changing the AAD P1 license to a full one soon!

    1. Dan Chemistruck

      Column 6 (previously 5, but F3 was just added) is Microsoft 365 E3 + Microsoft 365 E5 Security. I did not mean EMS E5 plus Microsoft 365 E5 security as that bundle would be a waste of money, since you’d be paying for the same features twice.

      M365 E5 Security is a different SKU from EMS E5 and is only $12, but can only be added-on to M365 E3. There are three ATP’s but I’ll assume you’re referring to Office 365 ATP P2, which is included with the M365E5 Security add-on.

      M365 BP has been updated to include full AAD P1.

          1. Dan Chemistruck

            Thanks for that caveat! I wasn’t aware of that. If you keep one M365E3 or O365E3 license, will it allow you to stream Live Events by all or just the licensed user?

            Disclaimer: If a user is using a feature, the Microsoft Terms of Service require you to license that feature for that user even if it is available ‘gratis’.

          2. Guus van Berge

            Sorry! did not see your reply till now.

            We upgraded only the users that needed to use live events and the feature became availible again for them. The other users which were still on M365BP still can’t use it!

  16. Dean

    This is a fantastic license comparison chart and by far the most comprehensive and accurate that I’ve found to date – please keep up the excellent work!

    A couple of points of feedback for consideration…
    1. Windows Virtual Desktop licensing entitlement is provided with Windows 10 E3/E5, but only when the WVD is accessed from the Windows 10 E3 instance (i.e. no BYOD/HTML5 access) –
    2. Whilst the Office 365 ProPlus client is provided in the M365 Business plans, Group Policy and Cloud-based Policy control of the Office 365 ProPlus Client is not supported in the Microsoft 365 Business plans – This is quite critical for a lot of organisations, so it would be good if this could be distinguished in the table.
    3. The Screenshot at the top of this blog post is updated to reflect the new license changes, but the Excel it hyperlinks to is outdated.
    4. Desktop Analytics should be added as a Service, since its licensing is dependent upon the Online Service SKUs (Win 10 E3/E5 + Intune/ConfigMgr) –

    1. Dan Chemistruck

      Thanks for the feedback! I’ll find a way to clarify the WVD exceptions. Microsoft 365 Business is meant to be managed with Intune, not Group Policy. Although I suppose there are still folks that care about having a Microsoft supported ADMX file. And Desktop Analytics is only available if you have SCCM, so I left it out of the chart. The Excel file will be updated next month when I get a new pricing sheet since there are a lot of lookups in the file based on license name.

  17. Arthur Avanesyan

    Do I understand correctly, that if we buy Microsoft 365 Business Basic + ATP Plan 1 licenses, we will get the same Advanced Threat Protection as for Microsoft 365 Business Premium?

    1. Dan Chemistruck

      For Office 365 ATP P1, yes, they are the same in both of those scenarios. (There is also Azure ATP, and Microsoft Defender ATP, but those SKUs are not included in M365 BP.)

      M365 Business Basic does not include EMS E3 or Windows 10 Pro licensing.

  18. Byron Abbott

    This is brilliant. Definitely highlights why there is so much confusion over the licencing!
    Is there any way I could get the excel file so I can share this with my organisation?

    1. Dan Chemistruck

      I was working on a GCC High version right before the massive work from home movement started. It’s not ready yet, but I’ll give you this advice, if you’re in GCC High and need to be NIST-800 compliant, you need the automated security plans:

      At least 1x Microsoft 365 G5 license for advanced compliance reporting if needed.
      EM+S E5 as an add-on for any of the Office SKUs.
      Windows 10 E5 for MD ATP and virtualization based security.
      Minimum of Office 365 G3.

      I’m not sure if Microsoft 365 G3 + G5 Security exists, but that would be the plan to get if it’s available.

  19. Lee

    Hi Dan. I must say – really great work. The best I have seen on the Internet.

    Would you be able to add (or share of you already have it) which of the products get ticked/enabled for the E5 Compliance add-on and E5 Security add-on? You have the columns for E3 + E5 Compliance and E3 + E5 Security but it would be nice to know separately what products each of the add-on’s unlock interdependently. I appreciate you are saying E3 + E5 Security is the Hero SKUs, but it would be good to see what other combinations you can create – so having E5 Security and E5 Compliance in separate columns would help massively!!

    For example, if a user has an Exchange Online or Office 365 E1 license – could they just add E5 Security add-on (but I think that lacks intune?), so would they need both EM+S E3 and E5 Security (which seems a big cost and overlapping licenses). If you have/add E5 Security and E5 Compliance in separate columns – you would be able to clearly see what you need/get.

    Looking forward to your reply! Thank you!

    1. Dan Chemistruck

      At the moment, the M365 E5 Compliance and M365 E5 Security add-ons can ONLY be added to Microsoft 365 E3. So the scenarios you described are not possible. I have a request to the product team to make these SKUs available to all Microsoft 365 plans, but there is no movement on that yet. (To my knowledge.)

  20. Matthias

    Can you point me to a documentation which outlines the differences between the different Whiteboard plans (F1/P1/P2/P3)

    1. Dan Chemistruck

      I wish I could provide a link. My best guess is that F1 is read-only, and I have no idea what the differentiation for the other plans would be. There’s no official “Service Description” page for Whiteboard. I’ll bring it up with my PDM, and post if I receive an update.

  21. Gurs

    Fantastic chart! Thank you. One potential correction: I believe that Microsoft 365 Business Premium is now free for qualified nonprofit tenants.

  22. EW

    Is there anything that would keep someone from using a G1 license and an M365 Apps for Business license, instead of getting G3? I see that G3 has some security features not found in G1. Is there anything else?

    1. Dan Chemistruck

      No technical limitations on doing this. It’s purely a choice of desired feature set. Although I would test if a G1 license works with desktop Outlook before you commit to that bundle.

  23. Mike Visconti

    This was really helpful, but I also have some users on older E2 plans which I of course can’t find any information on anywhere. Any idea what is gained/lost by switching to E1 or to one of the Business plans (this is a smaller company, well under the 300 limit).

    1. Dan Chemistruck

      You do not lose any features when switching from Office 365 E2 to E1. You gain a few new features, like To-Do and Whiteboard but nothing to write home about. They’re mostly the same license.

  24. Mark

    Dan this is awesome, thanks for making this list.
    I am confused.. The excel sheet displayed on this website seems the correct one with new M365 naming etc, but when I click the link to your sharepoint excel sheet I see the older plans.
    What is up with that? Should I bookmark the website rather than the sharepoint link?

  25. Chris Watkins

    Hi Dan,

    Brilliant overview – I currently have 1900 M365E3 licenses to cover our 1900 users who are sourced from AD On Premises. I have a requirement to onboard 600 M365 F3 users. Am I able to source the First line workers from the on premise Active Directory (to keep the same Starter Leavers Process) without purchasing any additional ECALS. The F3 users will never need to authenticate on premise, as we use PHS not ADFS/PTA/

    1. Dan Chemistruck

      Hi Chris, if you sign up for CSP with us we can get you a definitive answer. Are asking about if you need to license CALs for your AD DS box if they’re only going to be using AAD joined devices? M365 F3 includes EM+S E3, which includes AD DS CALs, so you’re probably fine. And if those users are never going to interact/authenticate against a Domain Controller, you don’t need Windows Server CALs for the users either.

  26. Paula Leahy

    Dan this is awesome! I may have missed it, but are the storage allocations for the Standard Services are calculated separately? For example, the storage allocation for SPOL as part of Government E3 (currently 1 TB plus 10 gig per entitlement) is in addition to the storage provided via Premium 2 (P2) for OneDrive, correct?

  27. Mark

    Hi Dan,
    Thank you for this information. It is certainly very useful.
    I am curious to know if EMS E3 a Technical or Licensing prerequisite to M365 E5 Security? Can’t find that information anywhere. Thank you.

  28. Jim Hill

    Right now I see that a couple of my Microsoft 365 E5 users have an unusual license configuration.This crept in as we needed more security and compliance features for a certain project.

    1. Microsoft 365 E3 ($32 / month)
    2. Microsoft 365 E5 Security Add on ($12 / month)
    3. Enterprise Mobility and Security E5 ($14.80 per month)
    Total, $58.80 per month

    This is actually more than the $57 E5 license. Question, what features do we lose by just having the first two licenses? Is there a chart anywhere that would show this?

    1. Dan Chemistruck

      Get rid of EM+S E5. The only thing you would lose is AIP P2, which you can either buy standalone or as part of the M365 E5 Compliance add-on for $10. The M365 E5 Compliance add-on also includes Insider Risk Management, which isn’t part of EM+S E5.

  29. Stuart Duncan

    Hi Dan, does the E5 licence provide sufficient rights in SharePoint to create TeamSites and Template laydowns, or do we have to revert to Enterprise licencing for SP?

    Thanks in advance.


    1. Dan Chemistruck

      The ‘E’ in E5 stands for Enterprise, so I’m not sure what you meant by the alternative. But Office 365 E5 and Microsoft 365 E5 both include rights to create Microsoft Teams sites and SharePoint sites. A number of the SMB SKUs include Teams/SharePoint rights as well.

  30. Sébastien

    Hello Dan,

    I have a question regarding the operating system license of the VM in Azure.
    Let’s say I want to deploy WVD for 5 users and I deploy 1 Win 10 multi-session VM. My 5 users have a Microsoft 365 Business Premium license.
    For the OS license of that VM, can I check “Azure Hybrid Benefit” (“I confirm I have an eligible Windows 10 license with multi-tenant hosting rights.”) ? Or should I add “Windows E3” license to my users to have virtualisation rights?

    Many thanks.

  31. Rihards

    Could you help me to understand what did you mean with “RO”, “EOK1”, “SOK1”, “OME”, “CAD”?
    Also, why for Forms there are “F1”, “E1” “E3” etc.?
    And is there “P3” plan for “To-Do” and “Yammer”?

    1. Dan Chemistruck

      RO = Read Only.
      EOK1 = Exchange Online Kiosk Plan 1.
      SOK1 = SharePoint Online Kiosk Plan 1.
      OME = Office Message Encryption.
      CAD = Cloud App Discovery.

      In all honesty, I don’t understand the different SKUs for To-Do and Forms, but they exist. So I noted them.

  32. Martin Bailey-Wood

    I have a number of questions regarding O365 licensing. Our organisation has bought a combination of E1, E3 and F3 O365 licenses as part of their Enterprise licensing on a 30/30/40 split accordingly. Firstly I cannot find any reference to F3 licenses altho’ I do find reference to F1 and E5 licenses. Is F3 the same as one of these under a different guise? Secondly it is my understanding that those who are accessing O365 via a thin client (e.g. Citrix) would require access to a shared activation code which is available for users with E3 licenses only, ergo all Thin Client users would require an E3 license (if I have understood that correctly). However I am being told by our technical teams that in our environment that is not the case because we have VDI installations of Windows 10 on eac of our desktops therefore negating the requirement to access O365 apps. This does not sit well with me and this does not feel right: why would you bother giving Citrix users O365 accounts if they are not going to use O365 apps and surely this will mean that we would essentially be double paying: once for the O365 licenses and also for Win10 licenses? Would welcome some further insight into this.

    1. Dan Chemistruck

      The old F1 licenses are now called F3. The new F1 licenses are geared towards Teams-only users.

      I’m not sure I follow your second question. You need Microsoft 365 Business Premium or Office 365 E3+ to get the shared activation license for VDI. You can use the same O365/M365 license on your desktop/laptop/phone and your VDI session–you don’t need to buy it twice. If you’re running Office 365, you’ll need a legacy Windows 10 VL for Citrix. If you’re using Microsoft 365, you get Windows 10 licensing in WVD when you run it in Azure. Hope that helps.

Leave a Reply

Your email address will not be published. Required fields are marked *