The Complete Office 365 and Microsoft 365 Licensing Comparison

I’ve only met one other person that could write the complete Office 365 and Microsoft 365 licensing comparison. That person is Glenton Davis, Sr. Product Marketing Manager at Microsoft. (Although, I did stump him on a few CAS unified labeling features…after he schooled me about the new Microsoft 365 Security E5 plan.) To put it another way: Microsoft subscriptions are confusing.

What did I just buy?

Or if you work in sales—what did I just sell? Microsoft has no shortage of comparison charts. Here are a few links that I used for reference to write this article:

When I see that Office 365 E3 sort of includes AIP, I always need to refer to my notes for clarification. As of December 2019, here is the full Office 365 and Microsoft 365 Licensing Comparison including pricing. (Full XLSX here)

Microsoft 365 Office 365 EM+S Windows 10
Business Enterprise
A1 *
E3 + (E5 Sec)
E3 + (E5 Comp)
Retail $10.00 $20.00 N/A $32.00 $44.00 $42.00 $57.50 $8.30 $5.00 $12.50 $12.00 $4.00 $8.00 $20.00 $35.00 $8.80 $14.80 N/A $7.00 $11.00
Nonprofit $2.50 $5.00 N/A $8.00 $14.00 $12.20 $23.00 N/A $0.00 $3.00 $3.00 N/A $0.00 $5.00 $15.20 $2.50 $6.00 N/A $1.80 $3.10
EDU Faculty N/A N/A $30.00 $5.75 $9.75 $9.00 $10.75 N/A N/A N/A $2.30 N/A $0.00 $3.30 $8.00 $1.90 $3.30 N/A $2.20 $6.30
EDU Student N/A N/A $30.00 $4.25 $7.75 $7.00 $8.00 N/A N/A N/A $1.80 N/A $0.00 $2.50 $6.00 $1.90 $3.30 N/A $1.60 $5.70
Government N/A N/A N/A $32.00 $44.00 $42.00 N/A Retail Retail Retail $12.00 $4.00 $8.00 $20.00 $35.00 $8.80 $14.80 N/A Retail Retail
Standard Services
Max Users Any 300 Any Any Any Any Any 300 300 300 Any Any Any Any Any Any Any Any Any Any
Install Office on 5 Computers X X X X X X X X X X
Office Online X X X X X X X X X X X X X X
OneDrive 2 GB 1 TB 25+ TB 25+ TB 25+ TB 25+ TB 1 TB 1 TB 1 TB 1 TB 2 GB 1 TB 5+ TB 25+ TB
Stream P1 P1 P1 P2 P1 P1 P2
Exchange Online EOK1 P1 P2 P2 P2 P2 X P1 EOK1 P1 P2 P2
Exchange Online Mailbox Size 2 GB 50 GB 100 GB 100 GB 100 GB 100 GB 50 GB 50 GB 2 GB 50 GB 100 GB 100 GB
Exchange Online Archive Size Add-on 50 GB Unlmtd Unlmtd Unlmtd Unlmtd 50 GB 50 GB Add-on 50 GB Unlmtd Unlmtd
SharePoint Online SOK1 P1 P2 P2 P2 P2 X P1 SOK1 P1 P2 P2
SharePoint Online DLP   X X X X X X
SharePoint Online eDiscovery     X X X X X X X X
SharePoint Online Insights   X X X X X X
Teams X X X X X X X X X X X X
E3 Azure Active Directory Premium P1 X 0.75 X X X X X X
Conditional Access X X X X X X X X
Multifactor Authentication (Azure) X X X X X X X X
Self Service Password Reset for AD X X X X X X X X
Azure Information Protection Plan 1 X X X X X X OME X X
Azure Rights Management X X X X X X X X X X X
Microsoft Intune X X EDU X X X X X X
Microsoft Advanced Threat Analytics X   X X X X X X
E5 Azure Active Directory Premium P2 X X X
Azure Information Protection Premium P2 X X X
Azure Advanced Threat Protection for Users X X X
Microsoft Cloud App Security X X X
Office 365 SafeDocs X X X X
Office 365 ATP
P1 Anti-Phishing X X X X
Anti-Spoofing X X X X
Malware Detection X X X X X X X X X X X X X
Safe Attachments X X X X
Safe Links X X X X
P2 Attack Simulator X X X
Automated Investigation and Response X X X
Threat Intelligence X X X
Windows 10
Pro Azure AD Join X X X X X X X X X X
BitLocker X X X X X X X X X X
Manage with Intune X X X X X X X X X X
Windows Hello for Business X X X X X X X X X X
E3 Attack Surface Reduction Rules X X X X X X X
Virtualization Rights X X X X X X
WD Application Conrtol Guard X X X X X X X
WD Application Guard X X X X X X X
WD Credential Guard X X X X X X X
WD Device Guard X X X X X X X
WD Exploit Guard X X X X X X X X
WD Remote Desktop Credential Guard X X X X X X X
  Windows Virtual Desktop (WVD) X X X X X X
E5 Microsoft Defender ATP X X X
Audio Conferencing X X
Common Area Phone
Domestic and International Calling Plan
Domestic Calling Plan
Meeting Room
Meeting Room without Audio Conferencing
Phone System X X
Skype for Business Online P1 P2 P2 P2 P2 P2 P2 P2 P2 P1 P2 P2 P2
Advanced Auditing X X X
Advanced Compliance X X X
 – Advanced Data Governance X X X
 – Advanced eDiscovery X X X
 – Customer Lockbox X X X
Azure App Proxy           X   X
Bookings X X X X X X X X
Data Subject Requests   X X X X X             X X
Delve   X X X X X X X X   X X X
Exchange ActiveSync X X X X X X X X X X X X
Exchange Inbox Rules X X X X X X X X X X
Exchange Online Archiving X X X X X X X X X X
 – Archive Mailbox X X X X X X X X X X
 – eDiscovery X X X X X X X X X X X X X
 – Litigation Hold X X X X X X       X X
 – Mailbox Backup X X X X X X X X
 – Retention Policies X X X X X X X
Exchange Public Folders X X X X X X X X X
Flow K1 X X X X X   X X X X X X X
Forms F1 E1 E3 E3 E3 E5 E1 E1 E1   F1 E1 E3 E5
InfoPath X X X X   X X
Information Barriers X X X
Insights by MyAnalytics X X X X X X X X X X
Kaizala Pro X X X X X X X X X X X X X
MileIQ       X
MyAnalytics (Full) X X
Office 365 Cloud App Security Discovery X X X X X X X
Office 365 Data Loss Prevention X X X X X X X X
Office 365 MFA (Not Azure MFA) X X X X X X X X X X X X X X
Office 365 Shared Computer Activation X X X X X X X X
Office Message Encryption   X X X X X       X X
Planner   X X X X X X X X X X
Power BI Pro X X
PowerApps X X X X X X X X X X X X
Premium Encryption X X X
Privileged Access Management X X X
StaffHub X X X X X X X X X X X
Sway X X X X X X X   X X X X
To-Do X P1 P2 P2 P2 P3 X P1 X X X P2 P3
Visio Online Plan 1
Visio Online Plan 2
Voicemail X X
Whiteboard F1 P1 P2 P2 P2 P3 P1 P1 P1   F1 P1 P2 P3
Yammer X X X X X X X X X X

* Microsoft 365 A1 is a one-time purchase.

Include Other Vendors When Making Your Microsoft 365 Licensing Comparison

At Infused Innovations, we prefer when our customers purchase a given feature set only once. Too often, we see a company purchase Enterprise Mobility + Security (EM+S) for the sole purpose of enabling Self-Service Password Reset (SSPR) with writeback for on-premises AD. That same company also owns Okta for SSO, AirWatch for MDM, and Netskope for CASB.

When we explain to the CFO that they already own EM+S, which contains similar functionality as those three other vendors, it’s usually a pretty quick discussion to get approval to start a proof of concept deployment standardizing on Microsoft 365. The budget that was allocated for the other vendors can then be used to purchase new security features like Microsoft Defender ATP and Azure Sentinel.

Circle the solutions you have deployed above. Is the price more than $57/user/mo?

Infused Innovations partners with a few other security vendors to fill some gaps, including KnowBe4, CyberArk, and SecPod, but Microsoft’s 60+ security products cover most customer’s needs. The added benefit to standardizing on Microsoft services is that they all integrate with the Microsoft Intelligent Security Graph, which allows the services to worth with each other and reduce false positives.

Even if you think you have a good grasp of your Microsoft 365 and Office 365 Licensing, I’d encourage you to sign up for one of our free cyber security assessments to have one of our experts review what you already own and create a strategic cyber security roadmap for your organization.

Which Microsoft 365 licensing plan should I buy?

I already expressed my thoughts that you’re (likely) on the wrong Microsoft license. For an organization of any size with an online presence, you should seriously consider one of the Microsoft 365 plans. (Unless you have purchased parts of the bundle through an EA, non-profit, or educational SKU.)

Just as you can purchase a new car without adaptive cruise control to save money in exchange for having to manually turn cruise control on and off, you can purchase Office 365 by itself to reduce your initial costs at the expense of having manually review logs. But with the projected shortfall of 3.5 million cyber security professionals by 2020, you may actually be increasing your overall costs if you don’t invest in automation now.

Microsoft spends over $1 Billion a year on security research and uses AI to interpret 6.5 trillion signals daily via the Intelligent Security Graph. With over 3,500 security engineers, it’s possible that Microsoft has more employees in its cyber security department than you have in your entire organization. All you have to do to take advantage of this combined risk intelligence and automation is purchase the correct Microsoft 365 license. And as of September 2019, you can now ingest your Microsoft 365 threat analytics data into Azure Sentinel for free!

Are you an educational organization? Read up here. Are you a non-profit organization? Read up here.

Microsoft 365 F1 Licensing Comparison to Office 365 F1

At only $10/user, firstline workers, employees that only need email, and contractors are a few types of users that would benefit from the Microsoft 365 F1 license. The business value for investing in M365 F1 licenses include:

  • Foster culture and community: By utilizing Microsoft Teams, your employees will have access to persistent chat, and provide your firstline workers access to the same corporate resources in SharePoint Online that are used by the rest of your organization.
  • Train and upskill employees: Microsoft Teams can serve as your source of institutional knowledge. Train and upskill your employees, creating opportunities for workers to develop, grow, and apply their skills.
  • Digitize business process: Give your firstline workers and contractors access to your organization’s modern digital workflows that are embedded in SharePoint, Flow, and Teams.
  • Minimize risk and cost: Make sure your organization’s data is only accessed from compliant devices and reduce your attack surface for potential breaches.
Microsoft 365 F1 provides the following productivity tools:
  • Exchange Online Kiosk
  • SharePoint Online Kiosk
  • Microsoft Teams
  • 2 GB of OneDrive Storage
  • Office Online for web versions of Word, Excel, and PowerPoint

The main reason to upgrade to the Microsoft 365 F1 plan from Office 365 F1 is to add mobile security features. These include:

  • Multifactor Authentication (MFA)
  • Conditional Access
  • Intune for MDM and data sandboxing
  • Office Message Encryption
  • eDiscovery
  • Microsoft Advanced Threat Analytics

Infused Innovations also recommends adding Office 365 Advanced Threat Protection (ATP) P1 to this plan to help protect users from phishing attacks.

What is Microsoft 365 Business?

Microsoft 365 Business with Azure AD P2

If you have fewer than 300 employees and are currently using Office 365 E3, you need to switch to Microsoft 365 Business right now. Both 365 licensing plans are priced at $20/mo and Microsoft 365 Business adds Windows 10 Pro licensing, along with all the security features that you need to keep your organization secured. The price to value ratio is immense for M365 Business.

Microsoft 365 Business includes most of the security features from Microsoft 365 F1 plus the Office 365 ATP P1 benefits. This allows you to deploy MFA to all your users without them noticing.
Update 6/12/2019: M365 Business now includes Conditional Access.

Infused Innovations recommends deploying Microsoft 365 Business with the Azure AD P2 add-on ($9/mo) to gain the following benefits:

  • Azure AD Identity Protection
  • User Risk Profiling, including
    • Impossible Travel
    • Stolen credentials
    • Anomalous behavior
  • Automatically force password changes for breached accounts
  • Automatically require MFA challenges for high-risk users

Microsoft 365 E3 with Microsoft 365 E5 Security (Formerly Identity Threat Protection)

Microsoft 365 E3 with Microsoft 365 E5 Security is the new “hero” SKU if your organization doesn’t need VoIP or Power BI. Pricing for the Microsoft 365 E5 Security add-on is $12/mo and can only be added to the Microsoft 365 E3 plan, which is $32/mo. The M365 E5 Security add-on gives you the following advanced features to your M365 E3 plan:

  • Azure ATP
  • Azure AD P2
  • Office ATP P2
  • Microsoft Cloud App Security
  • Microsoft Defender ATP

The five SKUs above provide comprehensive cybersecurity licensing to detect breaches and perform digital forensics across the entire attack chain. The P2 features of Microsoft SKUs also add automation features that respond to breaches at the speed of the cloud. Human minds can no longer keep up with modern attacks. Microsoft 365 E3 with Microsoft 365 E5 Security provides enterprise-class security features for your organization.

Microsoft 365 E3 is also the entry-level plan to allow access to Windows Virtual Desktop from a non-Windows 10 Pro device. All lower level Microsoft 365 plans require at least Windows 10 Pro to access WVD.

Microsoft 365 E5 Licensing Comparison

Microsoft 365 E5 allows you standardize on the entire Microsoft security and productivity stack for your organization for $57/mo. As previously mentioned, Microsoft 365 E5 adds VoIP integration to the Microsoft 365 E3 + Microsoft 365 E5 Security plan.

The other important SKU that you receive is Azure Information Protection P2. AIP P2 allows you to automatically apply encryption templates to documents based on regular expression templates. Microsoft will be releasing a new unified labeling experience to use across your AIP, DLP, and Cloud App Security policies. Update 5/2019: The new unified labeling experience has been released.


Unless you’re on Microsoft 365 E5, licensing and pricing plans are confusing. Fortunately, Microsoft is trying to simplify and consolidate their bundles around the features that fit common roles across multiple industries.

However, you’re probably asking yourself something like: I already own Windows 10 Pro licenses—do I need Microsoft 365 Business? Or, I have a volume license for Windows 10 Enterprise-how can I license only Microsoft Defender ATP? The easiest answer is to schedule a call using the form below to speak with one of our licensing experts. Prices change every month and Microsoft releases new Office 365 plans several times a year. Keeping up to date with Microsoft licensing can feel like a full-time job by itself. Which is why it’s important to select a Microsoft Gold partner to help guide you through the maze of licensing and Microsoft 365 pricing plans.

31 thoughts on “The Complete Office 365 and Microsoft 365 Licensing Comparison

  1. Alexander

    your spreadsheet says, that conditional access is not included in Microsoft 365 F1 and later, that conditional access is one of the main reason for upgrading from O365 to M365. Is conditional access included in M365 or not?

    Thank you in advance.
    Best regards,

    1. Dan Chemistruck

      Conditional Access is included in the following Microsoft 365 SKUs: F1 / E3 / E5.

      Microsoft 365 Business does not include conditional access at the moment. The spreadsheet has been updated.

  2. Glenton Davis

    Dan – I love this! Awesome work! I love the Executive Briefing Center, meeting great customers like you, and talking about epic stuff. I’ll definitely brush up on those CASB nuances for next time 😉

    Looking forward to it. Talk soon.

    1. Dan Chemistruck

      A blank means that I’m fairly certain it’s not included but I don’t have a reference to a Microsoft document one way or another yet. The “-” means not included with a verified statement from Microsoft.

  3. Chris

    We’ve purchased E3 + EMS E5 and then were surprised to find out that Defender ATP wasn’t included.

    We can’t seem to find any information regarding EMS E5 including Defender ATP other than this blog. Can you confirm if the above table/content is incorrect about ATP being included in EMS E5?

    1. Dan Chemistruck

      Defender ATP is only included with Windows 10 E5, Microsoft 365 E5, or Microsoft 365 E3 + Microsoft 365 E5 Security as correctly indicated on the table. EMS E5 does not include Defender ATP and the table above does not state that it does either. (EMS E5 is a green column, currently 4th from the right side of the table.) I believe you are looking at the Microsoft 365 E3 + E5 Security column, which is different from Office 365 E3 ($20) + EMS E5 ($14.80).

      If you purchased Microsoft 365 E3 ($32) (you didn’t specify which E3 was purchased) and bought EMS E5 as an add-on, then I would swap EMS E5 with Microsoft 365 E5 Security ($12) instead to get access to Defender ATP. M365 E5 Security can only be purchased as an add-on to M365 E3 and no other SKUs. Feel free to request a licensing review at the bottom of the page if you would like assistance from our sales team.

      1. Chris

        Hi Dan,

        Thanks for getting back to me so quickly and your response is very helpful. I can see where we went wrong now as we were confusing E5 Security with EMS E5. We’ll look at swapping those add-ons. Thats great.

  4. Ingve Skaret

    Azure AD Premium P1 is not included in M365 Business. They have a new version called “Small Business”, but i can’t seem to find any information about it. I first noticed this when i tried accessing Sign ins in a tenant with M365 Business licenses. I have compared M365 Business and AAD P1 in the Office-portal to verify.

  5. Rico Ho

    This is the best information on security and its financial considerations that I have ever seen in a one place. Thank you for sharing.
    Do you know of any product/service that analyzes Microsoft audit logs and combines it with information from the dark web so that you know how many of your accounts are already compromised? how many bots/websites are impersonating your credentials to spam or phish your customers? how many of your users have weak password/practice? how many of your vendors/suppliers logins are already compromised?

    1. Dan Chemistruck

      Azure AD Premium 2 (Part of EM+S E5) scans the dark web for compromised accounts. If a compromised account is detected, the user will receive a “High” security risk rating. If you have Azure AD Identity Protection enabled, you can force an immediate password reset as soon as this is detected–there is no human interaction required for this once the protection policy is enabled.

      AAD logs will tell you that an account breach was detected, but it doesn’t state where on the dark web it was discovered.

      Phishing spam via domain impersonation can be completed via DMARC monitoring. We have a guide on how to setup DMARC with free Valimail monitoring here:

      As for supply chain risk, Cloud App Security will tell you if any websites or SaaS tools you’re using have been compromised. This either requires shipping firewall logs to CAS or using Microsoft Defender ATP on Windows 10 with CAS integration enabled.

  6. Nathan

    Do you have any information on how SCCM/Intune/Microsoft Endpoint Management fits into the stack? My understanding is it is included with anything that includes the EMS E3/E5 license.

    Thank you for this resource. It’s incredibly helpful!

  7. Simon

    Wow! This is, quite frankly, the single best summary I’ve found regarding this topic on the Web. Thank you very much for the great aggregation, and I agree with many of the suggestions made.

    Office 365 is a solid product. Also, I am a huge fan of Azure AD. While Microsoft is clearly delivering best-of-breed solutions in many aspects, it’s disappointing that it’s such a chore to collect this data and then come to an understanding of what each of the myriad of licenses will or will not include. There’s a tool to help me estimate Azure spend for a whole slew of services, so why doesn’t Microsoft just provide a tool that will suggest the best licenses based on the features I select as necessary?

    A bit of context regarding the situation that lead me to this article:

    1. My organization is a SMB well below the limits of the 300 user mark. A few users here and there need full-on O365 E5 licenses for the VoIP, and a couple use Power BI. Otherwise, it’s just E3 level capabilities.
    2. We have Windows 10 Pro endpoints, all of which roam. Our endpoints just “happen” to authenticate against a DC the times the employee is working onsite and is connected to the network, otherwise, it’s just cached credentials (and stale Group Policies). I would be absolutely thrilled to get them all Azure AD device joined, as we have absolutely no systems requiring internal auth.
    3. I really want to harness the powerful identity and data protection capabilities offered, such as Azure AD conditional access and user risk assessment, and Office 365 DLP and ATP.

    I’m thinking the M365 Business license, +add-ons for the few users that need them, might be the best option.

    1. We’ll be able to Azure AD join devices and manage them wherever they may roam using Intune.
    2. User/endpoint authentication will be performed against Azure AD, thus unifying the individual to the identity that actually matters when it comes to security.
    3. While my goal is to eventually utilize any and every feature Microsoft offers that can help us better manage and secure our identities…my organization doesn’t move very quickly. Sure, it’s only a subset of the functionality provided by a P1 license, but the chances that we’d actually utilize the ones that are missing anytime soon are slim. The benefits we would get, such as conditional access policies, are ones that we are currently missing the most. In addition, the device management features are quite complete, and I feel that we would lay a perfect foundation for a future P1/P2 by migrating our endpoint model to utilize them.

    Maybe you can help ensure I’m deciphering this information accurately and am on the right track? Any input would be greatly appreciated!

    Thanks again for a solid slice of insight.

    1. Dan Chemistruck

      Hey Simon! Sounds like an exciting project! A few tips: get at least one license of Microsoft 365 E5 or Microsoft 365 E3 + E5 Security. The latter option is missing customer lock box, automated AIP labels and a few advanced governance features, but will unlock Microsoft Cloud App Security and risk-based conditional access.

      Absolutely start with Microsoft 365 Business as the minimum license for your all your users to get access to Intune, Conditional Access with MFA, and Office Business desktop apps.

      The Azure AD P2 license is helpful because it automates the response to breached accounts, and forces a password reset immediately. With the single M365 E5 license, you’ll get this benefit for everyone in your tenant, although you’re officially supposed to license each user for it. Microsoft does not currently restrict Azure AD Identity Protection to licensed users only.

      If you’d like to actually chat, just submit a contact us form below. If you buy your licenses from us (same cost as from Microsoft), we have free proof of concepts available to help accelerate your onboarding.

  8. Simon R.

    Hi Dan, great overview!
    I want to share another observations which is about “MyAnaltics”. Based on your chart its included in section “Add-Ons” and listed in E5 suites only. In January 2019 however it was announced that MyAnalytics will be included in every Business& Enterprise Plan of Office365/ Microsoft365. You may want to update your chart accordingly?
    Thanks and regards

  9. Jake Ortman

    Thanks for this chart. I had seen this last year when I was researching moving a bunch of our clients from E3 to M365 Business, and had lost the link for it. Thankfully found it via an old reddit thread. This is far better than the documentation that Microsoft puts out for their stuff. Thanks for keeping this up to date!

    1. Dan Chemistruck

      Thanks for the compliment! Bing has the page as the first search result, but Google has us buried on the second page and only as the Reddit link. I haven’t figured out why Google is hating on this post yet.

  10. Scott

    This is the holy grail of license comparisons. My question is two fold. I’m a little confused here when it comes to Office 365 E3 and Office 365 E1 licensing.

    I’ve confirmed with Microsoft that Office 365 E3 is compatible with the Microsoft 365 E5 Security Pack. I have the option to add this to the license when I purchase it for 12.00 per user per month.

    I’ve also been told….Office 365 E1 is fully compatible with the 12$ Microsoft 365 E5 Security Pack but when I purchase the license it doesn’t have an option to add this feature Directly. However, I’ve been told you can just purchase extras of the security pack under the office 365 E3 license category and apply those to the E1?

    Due to volume we purchase Most things through a distributor and don’t pay list but I’m including list price instead.

    1. Dan Chemistruck

      Thanks! And, unfortunately, your source at Microsoft is wrong. Microsoft 365 E5 Security can ONLY be added to Microsoft 365 E3. I’ve been bugging the product teams to open this up to other plans for over a year, but no movement yet.

  11. Benny

    Would you allow the current spreadsheet to collapse columns so it is easier to directly compare some of the plans and their features to one another?

    I am interested in really being able to show off and derive the value between Office E3, EM+S E5, Microsoft E3, and Microsoft E3 + EM+S E5 bundle.

    It can be difficult to inspire some small/medium businesses to double their per-user license costs without concise understanding that can be derived from the great work you’ve provided here!

  12. Priya Ravichandran

    Good blog! I have a question for you regarding EMS: what’s the difference between Enterprise Mobility and Security E3 Full Kiosk and E3 Full?

Leave a Reply

Your email address will not be published. Required fields are marked *