The Complete Office 365 and Microsoft 365 Licensing Comparison

I've only met one other person that could write the complete Office 365 and Microsoft 365 licensing comparison. That person is Glenton Davis, Sr. Product Marketing Manager at Microsoft. (Although, I did stump him on a few CAS unified labeling features...after he schooled me about the new Microsoft 365 Security E5 plan.) To put it another way: Microsoft subscriptions are confusing.

What did I just buy?

Or if you work in sales—what did I just sell? Microsoft has no shortage of comparison charts.

When I see that Office 365 E3 sort of includes AIP, I always need to refer to my notes for clarification. Updates to the chart are listed at the bottom of the page, so you can be sure if recent announcements have been added to the Microsoft 365 licensing comparison chart.

Note: as of April 2020 the term "Microsoft 365 Business" now means "limit of 300 users." The only bundle of Office 365, EMS, and Windows 10 in the M365 Business family is the M365 Business Premium plan.

Microsoft 365 Office 365 EM+S Windows 10/11
M365 Business Enterprise
A1 *
E3 +
(E5 Sec)
E3 +
(E5 Comp)
NCE "commitment" $2.30 $8.00 $22.00 N/A $36.00 $48.00 $48.00 $57.00 $8.30 $6.00 $12.50 $12.00 $4.00 $10.00 $23.00 $38.00 $10.60 $16.40 N/A $7.00 $11.00
Retail monthly $2.76 $9.60 $26.40 N/A $43.20 $57.60 $57.60 $68.40 $9.96 $7.20 $15.00 $14.40 $4.80 $12.00 $27.60 $45.60 $12.72 $19.68 N/A $8.40 $11.00
Nonprofit $0.90 $2.00 $5.50 N/A $9.00 $13.80 $13.80 $22.80 N/A $0.00 $3.00 $3.00 N/A $2.50 $5.80 $15.20 $2.50 $6.00 N/A $2.70 $4.10
EDU Faculty N/A N/A N/A $30.00 $5.80 N/A N/A $10.80 N/A N/A N/A $2.30 N/A $0.00 $3.30 $8.00 $1.76 $3.00 N/A $2.20 $6.30
EDU Student N/A N/A N/A $30.00 $4.30 N/A N/A $8.00 N/A N/A N/A $1.80 N/A $0.00 $2.50 $6.00 $1.76 $3.00 N/A $1.60 $5.70
Government N/A N/A N/A N/A $32.00 $44.00 $42.00 N/A Retail Retail Retail $12.00 $4.00 $8.00 $20.00 $35.00 $8.80 $14.80 N/A Retail Retail
Standard Services
Max Users Any Any 300 Any Any Any Any Any 300 300 300 Any Any Any Any Any Any Any Any Any Any
Install Office on 5 Computers - - X - X X X X X - X X - - X X - - - - -
Office Online RO X X - X X X X X X X X X X X X - - - - -
OneDrive - 2 GB 1 TB - 25+ TB 25+ TB 25+ TB 25+ TB 1 TB 1 TB 1 TB 1 TB 2 GB 1 TB 5+ TB 25+ TB - - - - -
Stream RO X X - P1 P1 P1 P2 - - - - - P1 P1 P2 - - - - -
Exchange Online - EOK1 P1 - P2 P2 P2 P2 - X P1 - EOK1 P1 P2 P2 - - - - -
Exchange Online Mailbox Size - 2 GB 50 GB - 100 GB 100 GB 100 GB 100 GB - 50 GB 50 GB - 2 GB 50 GB 100 GB 100 GB - - - - -
Exchange Online Archive Size - Add-on Unlmtd - Unlmtd Unlmtd Unlmtd Unlmtd - 50 GB 50 GB - Add-on 50 GB Unlmtd Unlmtd - - - - -
SharePoint Online X** SOK1 P1 - P2 P2 P2 P2 - X P1 - SOK1 P1 P2 P2 - - - - -
SharePoint Online DLP - -   - X X X X - - - - - - X X - - - - -
SharePoint Online eDiscovery       - X X X X - - - - X X X X - - - - -
SharePoint Online Insights - -   - X X X X - - - - - - X X - - - - -
Teams X X X - X X X X - X X - X X X X - - - - -
E3 Azure Active Directory Premium P1 X X X - X X X X - - - - - - - - X X - - -
Conditional Access X X X - X X X X - - - - - - - - X X - - -
Multifactor Authentication (Azure) X X X - X X X X - - - - - - - - X X - - -
Self Service Password Reset for AD X X X - X X X X - - - - - - - - X X - - -
Azure Information Protection Plan 1 X X X - X X X X - - - - - - - OME X X - - -
Azure Rights Management X X X X X X X X - - - - - - X X X X - - -
Microsoft Intune MDM/MAM/MEM X X X EDU X X X X - - - - - - - - X X - - -
Microsoft Advanced Threat Analytics X X   - X X X X - - - - - - - - X X - - -
E5 Azure Active Directory Premium P2 - - - - - X - X - - - - - - - - - X - - -
Azure Information Protection Premium P2 - - - - - - X X - - - - - - - - - X - - -
Microsoft Defender for Identity - - - - - X - X - - - - - - - - - X - - -
Microsoft Cloud App Security - - CAD - - X - X - - - - - - - - - X - - -
Office 365 SafeDocs - - - - - X - X - - - - - - - X - X - - -
Risk-based conditional access - - - - - X - X - - - - - - - - - X - - -
P1 Anti-Phishing - - X - - X - X - - - - - - - X - - - - -
Anti-Spoofing - - X - - X - X - - - - - - - X - - - - -
Malware Detection - X X - X X X X X X X - X X X X - - - - -
Safe Attachments - - X - - X - X - - - - - - - X - - - - -
Safe Links - - X - - X - X - - - - - - - X - - - - -
P2 Attack Simulator - - - - - X - X - - - - - - - X - - - - -
Automated Investigation and Response - - - - - X - X - - - - - - - X - - - - -
Threat Intelligence - - - - - X - X - - - - - - - X - - - - -
Windows 10/11
Pro Azure AD Join X X X X X X X X - - - - - - - - - - X X X
BitLocker X X X X X X X X - - - - - - - - - - X X X
Manage with Intune X X X X X X X X - - - - - - - - - - X X X
Windows Hello for Business X X X X X X X X - - - - - - - - - - X X X
E3 Attack Surface Reduction Rules - X - - X X X X - - - - - - - - - - - X X
Universal Print - X X - X X X X - - - - - - - - - - - X X
Virtualization Rights - - - - X X X X - - - - - - - - - - - X X
WD Application Conrtol Guard - X - - X X X X - - - - - - - - - - - X X
WD Application Guard - X - - X X X X - - - - - - - - - - - X X
WD Credential Guard - X - - X X X X - - - - - - - - - - - X X
WD Device Guard - X - - X X X X - - - - - - - - - - - X X
WD Exploit Guard - X X - X X X X - - - - - - - - - - - X X
WD Remote Desktop Credential Guard - X - - X X X X - - - - - - - - - - - X X
AVD - X X - X X X X - - - - - - - - - - - - -
E5 Microsoft Defender for Endpoint - - - - - X - X - - - - - - - - - - - - X
Audio Conferencing - - - - - - - X - - - - - - - X - - - - -
Common Area Phone - - - - - - - - - - - - - - - - - - - - -
Domestic and International Calling Plan - - - - - - - - - - - - - - - - - - - - -
Domestic Calling Plan - - - - - - - - - - - - - - - - - - - - -
Meeting Room - - - - - - - - - - - - - - - - - - - - -
Meeting Room without Audio Conferencing - - - - - - - - - - - - - - - - - - - - -
Phone System - - - - - - - X - - - - - - - X - - - - -
Skype for Business Online - P1 P2 - P2 P2 P2 P2 P2 P2 P2 - P1 P2 P2 P2 - - - - -
Advanced Auditing - - - - - - X X - - - - - - - X - - - - -
Advanced Compliance - - - - - - X X - - - - - - - X - - - - -
 - Advanced Data Governance - - - - - - X X - - - - - - - X - - - - -
 - Advanced eDiscovery - - - - - - X X - - - - - - - X - - - - -
 - Customer Lockbox - - - - - - X X - - - - - - - X - - - - -
Azure App Proxy X X X X X X X X - - - - - - - - X X - - -
Bookings - - X - X X X X - - X - - - X X - - - - -
Data Subject Requests X X X - X X X X             X X - - - - -
Delve     X - X X X X X X X -   X X X - - - - -
Exchange ActiveSync - X X - X X X X - X X - X X X X - - - - -
Exchange Inbox Rules - - X - X X X X - X X - - X X X - - - - -
Exchange Online Archiving - - X - X X X X - X X - - X X X - - - - -
 - Archive Mailbox - - X - X X X X - X X - - X X X - - - - -
 - eDiscovery - X X - X X X X X X X - X X X X - - - - -
 - Litigation Hold - X X - X X X X - - -       X X - - - - -
 - Mailbox Backup - - X - X X X X - - - - - X X X - - - - -
 - Retention Policies - - X - X X X X - - - - - - X X - - - - -
Exchange Public Folders - - X - X X X X - X X - - - X X - - - - -
Flow (Power Automate) - K1 X - X X X X   X X X X X X X - - - - -
Forms - F1 E1 - E3 E3 E3 E5 E1 E1 E1   F1 E1 E3 E5 - - - - -
InfoPath - - - - X X X X - - -   - - X X - - - - -
Information Barriers - - - - - - X X - - - - - - - X - - - - -
Insider Risk Management - - - - - - X X - - - - - - - - - - - - -
Insights by MyAnalytics   X X - X X X X - - - - X X X X - - - - -
Kaizala Pro   X X - X X X X X X X - X X X X - - - - -
MileIQ - -   - - - - -     X - - - - - - - - - -
MyAnalytics (Full) - - - - - - - X - - - - - - - X - - - - -
Office 365 Cloud App Security Discovery ? X X - X X X X - - - - - - X X - - - - -
Office 365 Data Loss Prevention - - X X X X X X - - - - - - X X - - - - -
Office 365 MFA (Not Azure MFA) X X X - X X X X X X X X X X X X - - - - -
Office 365 Shared Computer Activation - - X - X X X X - - - X - - X X - - - - -
Office Message Encryption - X X - X X X X       - - - X X - - - - -
Planner X X X - X X X X - X X - - X X X - - - - -
Power BI Pro - - - - - - - X - - - - - - - X - - - - -
PowerApps - X X - X X X X - X X - X X X X - - - - -
Premium Encryption - - - - - - X X - - - - - - - X - - - - -
Privileged Access Management - - - - - - X X - - - - - - - X - - - - -
StaffHub (Shifts) X X X - X X X X - - X - X X X X - - - - -
SharePoint Syntex - $5 $5 - $5 $5 $5 $5 - $5 $5 - $5 $5 $5 $5 - - - - -
Sway ? X X - X X X X - - X   X X X X - - - - -
To-Do ? X P1 - P2 P2 P2 P3 X P1 X - X X P2 P3 - - - - -
Visio Online Plan 1 - - - - - - - - - - - - - - - - - - - - -
Visio Online Plan 2 - - - - - - - - - - - - - - - - - - - - -
Voicemail - - - - - - - X - - - - - - - X - - - - -
Whiteboard ? F1 P1 - P2 P2 P2 P3 P1 P1 P1   F1 P1 P2 P3 - - - - -
Yammer X X X - X X X X - - - - X X X X - - - - -

* Microsoft 365 A1 is a one-time purchase.
** Does not include a personal SharePoint site.

RO = Read Only.
EOK1 = Exchange Online Kiosk Plan 1.
SOK1 = SharePoint Online Kiosk Plan 1.
OME = Office Message Encryption.
CAD = Cloud App Discovery.

Include Other Vendors When Making Your Microsoft 365 Licensing Comparison

At Infused Innovations, we prefer when our customers purchase a given feature set only once. Too often, we see a company purchase Enterprise Mobility + Security (EM+S) for the sole purpose of enabling Self-Service Password Reset (SSPR) with writeback for on-premises AD. That same company also owns Okta for SSO, AirWatch for MDM, and Netskope for CASB.

When we explain to the CFO that they already own EM+S, which contains similar functionality as those three other vendors, it's usually a pretty quick discussion to get approval to start a proof of concept deployment standardizing on Microsoft 365. The budget that was allocated for the other vendors can then be used to purchase new security features like Microsoft Defender for Endpoint (previously MD ATP) and Azure Sentinel.

Circle the solutions you have deployed above. Is the price more than $57/user/mo?

Infused Innovations partners with a few other security vendors to fill some gaps, including KnowBe4, CyberArk, and SecPod, but Microsoft's 60+ security products cover most customer's needs. The added benefit to standardizing on Microsoft services is that they all integrate with the Microsoft Intelligent Security Graph, which allows the services to work with each other and reduce false positives.

Even if you think you have a good grasp of your Microsoft 365 and Office 365 Licensing, I’d encourage you to sign up for one of our free cyber security assessments to have one of our experts review what you already own and create a strategic cyber security roadmap for your organization.

Which Microsoft 365 licensing plan should I buy?

I already expressed my thoughts that you’re (likely) on the wrong Microsoft license. For an organization of any size with an online presence, you should seriously consider one of the Microsoft 365 plans. (Unless you have purchased parts of the bundle through an EA, non-profit, or educational SKU.)

Just as you can purchase a new car without adaptive cruise control to save money in exchange for having to manually turn cruise control on and off, you can purchase Office 365 by itself to reduce your initial costs at the expense of having manually review logs. But with the projected shortfall of 3.5 million cyber security professionals by 2020, you may actually be increasing your overall costs if you don't invest in automation now.

Microsoft spends over $1 Billion a year on security research and uses AI to interpret 6.5 trillion signals daily via the Intelligent Security Graph. With over 3,500 security engineers, it’s possible that Microsoft has more employees in its cyber security department than you have in your entire organization. All you have to do to take advantage of this combined risk intelligence and automation is purchase the correct Microsoft 365 license. And as of September 2019, you can now ingest your Microsoft 365 threat analytics data into Azure Sentinel for free!

Are you an educational organization? Read up here. Are you a non-profit organization? Read up here.

Microsoft 365 F1 for Frontline Workers

In April 2020, Microsoft changed the old Microsoft 365 F1 plan to Microsoft 365 F3. The new M365 F1 plan has no email or OneDrive storage. It's essentially Microsoft Teams plus EM+S E3 to provide a secure device to access Microsoft Teams on.

What appears to be an oversight, is that EMS E3 appears to be available for only $4/mo now if you add the M365 F1 plan to any Office 365 plan. We'll see if Microsoft addresses this by restricting licensing assignments.

Here's a comparison of the Microsoft 365 Frontline worker plans:


Microsoft 365 F3 Licensing Comparison to Office 365 F1

At only $10/user, firstline workers, employees that only need email, and contractors are a few types of users that would benefit from the Microsoft 365 F3 license. The business value for investing in M365 F3 licenses include:

  • Foster culture and community: By utilizing Microsoft Teams, your employees will have access to persistent chat, and provide your firstline workers access to the same corporate resources in SharePoint Online that are used by the rest of your organization.
  • Train and upskill employees: Microsoft Teams can serve as your source of institutional knowledge. Train and upskill your employees, creating opportunities for workers to develop, grow, and apply their skills.
  • Digitize business process: Give your firstline workers and contractors access to your organization’s modern digital workflows that are embedded in SharePoint, Flow, and Teams.
  • Minimize risk and cost: Make sure your organization’s data is only accessed from compliant devices and reduce your attack surface for potential breaches.

Microsoft 365 F3 provides the following productivity tools:

  • Exchange Online Kiosk
  • SharePoint Online Kiosk
  • Microsoft Teams
  • 2 GB of OneDrive Storage
  • Office Online for web versions of Word, Excel, and PowerPoint

The main reason to upgrade to the Microsoft 365 F3 plan from Office 365 F1 is to add mobile security features. These include:

  • Multifactor Authentication (MFA)
  • Conditional Access
  • Intune for MDM and data sandboxing
  • Office Message Encryption
  • eDiscovery
  • Microsoft Advanced Threat Analytics

Infused Innovations also recommends adding Office 365 Advanced Threat Protection (ATP) P1 to this plan to help protect users from phishing attacks.


Microsoft 365 Business Premium with Azure AD P2

If you have fewer than 300 employees and are currently using Office 365 E3, you need to switch to Microsoft 365 Business Premium right now. Both 365 licensing plans are priced at $20/mo and Microsoft 365 Business Premium adds Windows 10 Pro licensing, along with all the security features that you need to keep your organization secured. The price to value ratio is immense for M365 Business Premium.

Microsoft 365 BP includes most of the security features from Microsoft 365 F3 plus the Microsoft Defender for Office (previously Office 365 ATP P1) benefits. This allows you to deploy MFA to all your users without them noticing.
Update 4/21/2020: M365 Business Premium now includes Conditional Access and full AAD P1.

Infused Innovations recommends deploying Microsoft 365 Business Premium with the Azure AD P2 add-on ($9/mo) to gain the following benefits:

  • Azure AD Identity Protection
  • User Risk Profiling, including
    • Impossible Travel
    • Stolen credentials
    • Anomalous behavior
  • Automatically force password changes for breached accounts
  • Automatically require MFA challenges for high-risk users

Microsoft 365 E3 with Microsoft 365 E5 Security (Formerly Identity Threat Protection)

Microsoft 365 E3 with Microsoft 365 E5 Security is the new “hero” SKU if your organization doesn’t need VoIP or Power BI. Pricing for the Microsoft 365 E5 Security add-on is $12/mo and can only be added to the Microsoft 365 E3 plan, which is $32/mo. (Note: the M365 E5 Security/Compliance add-ons are also available if you purchase Office 365 E3 with EM+S E3.)

The M365 E5 Security add-on gives you the following advanced features to your M365 E3 plan:

  • Azure AD P2
  • Microsoft Cloud App Security
  • Microsoft Defender for Identity (formerly Azure ATP)
  • Microsoft Defender for Endpoint (formerly Microsoft Defender ATP)
  • Microsoft Defender for Office 365 (formerly Office ATP P2)

The five SKUs above provide comprehensive cybersecurity licensing to detect breaches and perform digital forensics across the entire attack chain. The P2 features of Microsoft SKUs also add automation features that respond to breaches at the speed of the cloud. Human minds can no longer keep up with modern attacks. Microsoft 365 E3 with Microsoft 365 E5 Security provides enterprise-class security features for your organization.

Microsoft 365 E3 is also the entry-level plan to allow access to Windows Virtual Desktop from a non-Windows 10 Pro device. All lower level Microsoft 365 plans require at least Windows 10 Pro to access WVD.

Microsoft 365 E5 Licensing Comparison

Microsoft 365 E5 allows you standardize on the entire Microsoft security and productivity stack for your organization for $57/mo. As previously mentioned, Microsoft 365 E5 adds VoIP integration to the Microsoft 365 E3 + Microsoft 365 E5 Security plan.

The other important SKU that you receive is Azure Information Protection P2. AIP P2 allows you to automatically apply encryption templates to documents based on regular expression templates. Microsoft will be releasing a new unified labeling experience to use across your AIP, DLP, and Cloud App Security policies. Update 5/2019: The new unified labeling experience has been released.


Unless you’re on Microsoft 365 E5, licensing and pricing plans are confusing. Fortunately, Microsoft is trying to simplify and consolidate their bundles around the features that fit common roles across multiple industries.

However, you’re probably asking yourself something like: I already own Windows 10 Pro licenses—do I need Microsoft 365 Business? Or, I have a volume license for Windows 10 Enterprise---how can I license only Microsoft Defender for Endpoint? The easiest answer is to schedule a call using the form below to speak with one of our licensing experts. Prices change every month and Microsoft releases new Office 365 plans several times a year. Keeping up to date with Microsoft licensing can feel like a full-time job by itself. Which is why it’s important to select a Microsoft Gold partner to help guide you through the maze of licensing and Microsoft 365 pricing plans.

Change Log

Reference Material


  1. Jesse Wimberly on May 7, 2019 at 3:42 pm

    Hi Dan,

    This is really great! Nice job! Very comprehensive. Could I get a copy of the Excel spreadsheet to socialize internally?

    Thanks for your help.

    • Adam Kolarik on April 27, 2020 at 3:43 am

      Hi Dan,
      excellent job, I have same question as Jesse. Is there some posibility to get such xls file for internal usage?
      Thank you for your help

      • Dan Chemistruck on May 18, 2020 at 9:20 pm

        I update this matrix every month, so I do not allow it to be downloaded since it becomes out of date frequently. Aaron Dinnage has several PDFs that are similar that you can download though:
        Keep in mind that Aaron’s spreadsheets are usually updated 1-2 times a year. He just updated them 5/18, so now is a good time to grab them.

  2. Dan Chemistruck on May 7, 2019 at 7:29 pm

    Absolutely! It’s in Excel format here:

    If you’d like to partner on EM+S deployments, I can have my COO provide the original spreadsheet with price lookups.

  3. pete on May 8, 2019 at 5:29 am

    typo in the chart e1 / f1 for 1 drive usage

  4. Alexander on May 8, 2019 at 5:56 am

    your spreadsheet says, that conditional access is not included in Microsoft 365 F1 and later, that conditional access is one of the main reason for upgrading from O365 to M365. Is conditional access included in M365 or not?

    Thank you in advance.
    Best regards,

    • Dan Chemistruck on May 8, 2019 at 12:07 pm

      Conditional Access is included in the following Microsoft 365 SKUs: F1 / E3 / E5.

      Microsoft 365 Business does not include conditional access at the moment. The spreadsheet has been updated.

  5. Glenton Davis on May 10, 2019 at 3:58 pm

    Dan – I love this! Awesome work! I love the Executive Briefing Center, meeting great customers like you, and talking about epic stuff. I’ll definitely brush up on those CASB nuances for next time 😉

    Looking forward to it. Talk soon.

  6. Jan Vana on July 10, 2019 at 12:18 pm

    Dan, from now on, you are my Avenger. Awesome work here.

  7. Jeff on July 22, 2019 at 8:12 am

    Conditional Access is the way to go if you want to phase users into MFA.

  8. Lawrence Giam on September 3, 2019 at 3:59 am

    Hi Dan,

    Great work here, do you have a legend for the fields ? What does the “-” or “blank” means?

    • Dan Chemistruck on September 3, 2019 at 12:19 pm

      A blank means that I’m fairly certain it’s not included but I don’t have a reference to a Microsoft document one way or another yet. The “-” means not included with a verified statement from Microsoft.

  9. Chris on September 18, 2019 at 9:19 am

    We’ve purchased E3 + EMS E5 and then were surprised to find out that Defender ATP wasn’t included.

    We can’t seem to find any information regarding EMS E5 including Defender ATP other than this blog. Can you confirm if the above table/content is incorrect about ATP being included in EMS E5?

    • Dan Chemistruck on September 18, 2019 at 12:07 pm

      Defender ATP is only included with Windows 10 E5, Microsoft 365 E5, or Microsoft 365 E3 + Microsoft 365 E5 Security as correctly indicated on the table. EMS E5 does not include Defender ATP and the table above does not state that it does either. (EMS E5 is a green column, currently 4th from the right side of the table.) I believe you are looking at the Microsoft 365 E3 + E5 Security column, which is different from Office 365 E3 ($20) + EMS E5 ($14.80).

      If you purchased Microsoft 365 E3 ($32) (you didn’t specify which E3 was purchased) and bought EMS E5 as an add-on, then I would swap EMS E5 with Microsoft 365 E5 Security ($12) instead to get access to Defender ATP. M365 E5 Security can only be purchased as an add-on to M365 E3 and no other SKUs. Feel free to request a licensing review at the bottom of the page if you would like assistance from our sales team.

  10. Ingve Skaret on November 20, 2019 at 4:04 am

    Azure AD Premium P1 is not included in M365 Business. They have a new version called “Small Business”, but i can’t seem to find any information about it. I first noticed this when i tried accessing Sign ins in a tenant with M365 Business licenses. I have compared M365 Business and AAD P1 in the Office-portal to verify.

    • Dan Chemistruck on November 20, 2019 at 10:00 pm

      Thanks for pointing this out. I’ll get the spreadsheet updated this week.

  11. Rico Ho on November 20, 2019 at 9:53 pm

    This is the best information on security and its financial considerations that I have ever seen in a one place. Thank you for sharing.
    Do you know of any product/service that analyzes Microsoft audit logs and combines it with information from the dark web so that you know how many of your accounts are already compromised? how many bots/websites are impersonating your credentials to spam or phish your customers? how many of your users have weak password/practice? how many of your vendors/suppliers logins are already compromised?

    • Dan Chemistruck on November 20, 2019 at 9:59 pm

      Azure AD Premium 2 (Part of EM+S E5) scans the dark web for compromised accounts. If a compromised account is detected, the user will receive a “High” security risk rating. If you have Azure AD Identity Protection enabled, you can force an immediate password reset as soon as this is detected–there is no human interaction required for this once the protection policy is enabled.

      AAD logs will tell you that an account breach was detected, but it doesn’t state where on the dark web it was discovered.

      Phishing spam via domain impersonation can be completed via DMARC monitoring. We have a guide on how to setup DMARC with free Valimail monitoring here:

      As for supply chain risk, Cloud App Security will tell you if any websites or SaaS tools you’re using have been compromised. This either requires shipping firewall logs to CAS or using Microsoft Defender ATP on Windows 10 with CAS integration enabled.

  12. Nathan on January 28, 2020 at 11:15 am

    Do you have any information on how SCCM/Intune/Microsoft Endpoint Management fits into the stack? My understanding is it is included with anything that includes the EMS E3/E5 license.

    Thank you for this resource. It’s incredibly helpful!

  13. David Latham on February 12, 2020 at 4:52 pm

    MileIQ is now available as part of the Office E* Plans

  14. Simon on February 13, 2020 at 3:58 am

    Wow! This is, quite frankly, the single best summary I’ve found regarding this topic on the Web. Thank you very much for the great aggregation, and I agree with many of the suggestions made.

    Office 365 is a solid product. Also, I am a huge fan of Azure AD. While Microsoft is clearly delivering best-of-breed solutions in many aspects, it’s disappointing that it’s such a chore to collect this data and then come to an understanding of what each of the myriad of licenses will or will not include. There’s a tool to help me estimate Azure spend for a whole slew of services, so why doesn’t Microsoft just provide a tool that will suggest the best licenses based on the features I select as necessary?

    A bit of context regarding the situation that lead me to this article:

    1. My organization is a SMB well below the limits of the 300 user mark. A few users here and there need full-on O365 E5 licenses for the VoIP, and a couple use Power BI. Otherwise, it’s just E3 level capabilities.
    2. We have Windows 10 Pro endpoints, all of which roam. Our endpoints just “happen” to authenticate against a DC the times the employee is working onsite and is connected to the network, otherwise, it’s just cached credentials (and stale Group Policies). I would be absolutely thrilled to get them all Azure AD device joined, as we have absolutely no systems requiring internal auth.
    3. I really want to harness the powerful identity and data protection capabilities offered, such as Azure AD conditional access and user risk assessment, and Office 365 DLP and ATP.

    I’m thinking the M365 Business license, +add-ons for the few users that need them, might be the best option.

    1. We’ll be able to Azure AD join devices and manage them wherever they may roam using Intune.
    2. User/endpoint authentication will be performed against Azure AD, thus unifying the individual to the identity that actually matters when it comes to security.
    3. While my goal is to eventually utilize any and every feature Microsoft offers that can help us better manage and secure our identities…my organization doesn’t move very quickly. Sure, it’s only a subset of the functionality provided by a P1 license, but the chances that we’d actually utilize the ones that are missing anytime soon are slim. The benefits we would get, such as conditional access policies, are ones that we are currently missing the most. In addition, the device management features are quite complete, and I feel that we would lay a perfect foundation for a future P1/P2 by migrating our endpoint model to utilize them.

    Maybe you can help ensure I’m deciphering this information accurately and am on the right track? Any input would be greatly appreciated!

    Thanks again for a solid slice of insight.

    • Dan Chemistruck on February 13, 2020 at 9:42 pm

      Hey Simon! Sounds like an exciting project! A few tips: get at least one license of Microsoft 365 E5 or Microsoft 365 E3 + E5 Security. The latter option is missing customer lock box, automated AIP labels and a few advanced governance features, but will unlock Microsoft Cloud App Security and risk-based conditional access.

      Absolutely start with Microsoft 365 Business as the minimum license for your all your users to get access to Intune, Conditional Access with MFA, and Office Business desktop apps.

      The Azure AD P2 license is helpful because it automates the response to breached accounts, and forces a password reset immediately. With the single M365 E5 license, you’ll get this benefit for everyone in your tenant, although you’re officially supposed to license each user for it. Microsoft does not currently restrict Azure AD Identity Protection to licensed users only.

      If you’d like to actually chat, just submit a contact us form below. If you buy your licenses from us (same cost as from Microsoft), we have free proof of concepts available to help accelerate your onboarding.

  15. Simon R. on February 19, 2020 at 6:46 am

    Hi Dan, great overview!
    I want to share another observations which is about “MyAnaltics”. Based on your chart its included in section “Add-Ons” and listed in E5 suites only. In January 2019 however it was announced that MyAnalytics will be included in every Business& Enterprise Plan of Office365/ Microsoft365. You may want to update your chart accordingly?
    Thanks and regards

  16. Jake Ortman on March 4, 2020 at 5:12 pm

    Thanks for this chart. I had seen this last year when I was researching moving a bunch of our clients from E3 to M365 Business, and had lost the link for it. Thankfully found it via an old reddit thread. This is far better than the documentation that Microsoft puts out for their stuff. Thanks for keeping this up to date!

    • Dan Chemistruck on March 4, 2020 at 5:24 pm

      Thanks for the compliment! Bing has the page as the first search result, but Google has us buried on the second page and only as the Reddit link. I haven’t figured out why Google is hating on this post yet.

  17. Scott on March 11, 2020 at 11:34 pm

    This is the holy grail of license comparisons. My question is two fold. I’m a little confused here when it comes to Office 365 E3 and Office 365 E1 licensing.

    I’ve confirmed with Microsoft that Office 365 E3 is compatible with the Microsoft 365 E5 Security Pack. I have the option to add this to the license when I purchase it for 12.00 per user per month.

    I’ve also been told….Office 365 E1 is fully compatible with the 12$ Microsoft 365 E5 Security Pack but when I purchase the license it doesn’t have an option to add this feature Directly. However, I’ve been told you can just purchase extras of the security pack under the office 365 E3 license category and apply those to the E1?

    Due to volume we purchase Most things through a distributor and don’t pay list but I’m including list price instead.

    • Dan Chemistruck on March 12, 2020 at 11:49 am

      Thanks! And, unfortunately, your source at Microsoft is wrong. Microsoft 365 E5 Security can ONLY be added to Microsoft 365 E3. I’ve been bugging the product teams to open this up to other plans for over a year, but no movement yet.

  18. Benny on March 27, 2020 at 2:30 pm

    Would you allow the current spreadsheet to collapse columns so it is easier to directly compare some of the plans and their features to one another?

    I am interested in really being able to show off and derive the value between Office E3, EM+S E5, Microsoft E3, and Microsoft E3 + EM+S E5 bundle.

    It can be difficult to inspire some small/medium businesses to double their per-user license costs without concise understanding that can be derived from the great work you’ve provided here!

  19. Priya Ravichandran on March 29, 2020 at 5:46 pm

    Good blog! I have a question for you regarding EMS: what’s the difference between Enterprise Mobility and Security E3 Full Kiosk and E3 Full?

  20. Jure Jereb on April 2, 2020 at 4:54 am


    First, let me thank you for really good licensing spreadsheet. This really simplifies a lot.

    But I have a question regarding the licensing that I cannot find a answer to anywhere: Do the M365 packages (especially the M365 Business) also include Client Access License (CAL) rights. I understand that you get the Exchange, Sharepoint and Teams “CALs” for the licensed users, but how about the CALs for other, basic, on-premise services like AD and Fileshare servers and SystemCenter products? Do customers which have hybrid infrastructure with users covered by M365 licenses, still need to buy Core CAL / Enterprise CAL for their users, in order to be able to use on-premises infrastructure in a formally licensed way?

    • Dan Chemistruck on April 19, 2020 at 12:56 pm

      Most of your on-prem CALs are not included with online licensing. EMS includes some SCCM and MIM CALs, but that’s about it.

      If you run AD or a file server in Azure, user CALs are included with the compute cost.

      • Mass on April 20, 2020 at 4:10 pm

        On this page, it says that EMS includes a “Windows Server Client Access License (CAL)”

        Is this also included in some of the M365 licenses or do i only get this with the EMS license?

        • Dan Chemistruck on April 20, 2020 at 5:04 pm

          I am familiar with that page, and it is worded poorly. It does not state that a Windows Server Client Access License (CAL) is included with EMS. EMS only includes CALs for specific workloads, such as Microsoft Active Directory Rights Management Services or SCEP. These are not Windows Server CALs, which need to be purchased separate from the service CALs.

          To answer your question, yes these service CALs are included in the Microsoft 365 SKUs that contain the EM+S E3 feature set.

  21. Rajesh on April 2, 2020 at 8:44 am

    Hi, what a great page full of detailed information. One question though, what does the 0.75 mean in the M365 Business license under AD P1. I’m torn between M365 E3 and M365 Business for my company. I don’t need Win10 cloud licenses as everyone works in the office with a desktop that will be licensed. What would you recommend E3 or Business?

    • Dan Chemistruck on April 19, 2020 at 12:54 pm

      M365 Business just received full AAD P1 this month. I would get M365 Business plus Microsoft Defender ATP Standalone and Cloud App Security for everyone. Pickup one or two seats of full Microsoft 365 E5 to get automated threat responses and Power BI for the tenant.

  22. Khaldoon on April 3, 2020 at 11:39 pm

    Will you be updating this with new Microsoft plans renaming?
    Great work.
    Thanks a lot.

  23. Kurt Allebach on April 12, 2020 at 10:42 am

    What do the P1 and P2 values indicate? I don’t see a key or reference to them in the documents you link to…I may just be missing them. Thx.

    • Dan Chemistruck on April 19, 2020 at 12:48 pm

      Microsoft SKUs have different levels. Premium 1 / Premium 2 = P1 / P2. Enterprise 3 / Enterprise 5 = E3 / E5.

  24. Carl on April 13, 2020 at 5:05 pm

    Great resource – will you be updating to include the new MS security and compliance packages?

  25. Guus van Berge on April 19, 2020 at 8:23 am

    Thank you so much for this blog. We use this comparison a lot!

    One question that comes to mind: in row 5 you say M365 E3 + E5 SEC. Do you mean EMS E5 with E5 SEC? because according to this comparison I would get ATP P2 as wel. But according to MS, EMS E3/E5 does not include ATP..hope you can clear this for me..I struggle with choosing the right licences from time to time..also because they change a lot..Ideally we would choose for M365 E3 because we dont use the VoIP options..but than again you need a lot of add ons to get the good stuff still (EMS E5, ATP P2).

    Ps. they are also changing the AAD P1 license to a full one soon!

    • Dan Chemistruck on April 19, 2020 at 12:45 pm

      Column 6 (previously 5, but F3 was just added) is Microsoft 365 E3 + Microsoft 365 E5 Security. I did not mean EMS E5 plus Microsoft 365 E5 security as that bundle would be a waste of money, since you’d be paying for the same features twice.

      M365 E5 Security is a different SKU from EMS E5 and is only $12, but can only be added-on to M365 E3. There are three ATP’s but I’ll assume you’re referring to Office 365 ATP P2, which is included with the M365E5 Security add-on.

      M365 BP has been updated to include full AAD P1.

      • Guus van Berge on April 23, 2020 at 8:54 am

        Thank you so much for clearing that up! That was the missing piece of our puzzle..

        • Guus van Berge on May 1, 2020 at 2:00 am

          One more small thing we came across that might be interesting with the current crisis..with any E of A license you have the functionality to broadcast live events in Teams..with M365BP you do not..we found this out the hard way when we downgraded a customer to M365BP. Hope this is usefull!

          • Dan Chemistruck on May 18, 2020 at 9:19 pm

            Thanks for that caveat! I wasn’t aware of that. If you keep one M365E3 or O365E3 license, will it allow you to stream Live Events by all or just the licensed user?

            Disclaimer: If a user is using a feature, the Microsoft Terms of Service require you to license that feature for that user even if it is available ‘gratis’.

          • Guus van Berge on July 6, 2020 at 6:37 am

            Sorry! did not see your reply till now.

            We upgraded only the users that needed to use live events and the feature became availible again for them. The other users which were still on M365BP still can’t use it!

  26. Dean on April 22, 2020 at 12:13 pm

    This is a fantastic license comparison chart and by far the most comprehensive and accurate that I’ve found to date – please keep up the excellent work!

    A couple of points of feedback for consideration…
    1. Windows Virtual Desktop licensing entitlement is provided with Windows 10 E3/E5, but only when the WVD is accessed from the Windows 10 E3 instance (i.e. no BYOD/HTML5 access) –
    2. Whilst the Office 365 ProPlus client is provided in the M365 Business plans, Group Policy and Cloud-based Policy control of the Office 365 ProPlus Client is not supported in the Microsoft 365 Business plans – This is quite critical for a lot of organisations, so it would be good if this could be distinguished in the table.
    3. The Screenshot at the top of this blog post is updated to reflect the new license changes, but the Excel it hyperlinks to is outdated.
    4. Desktop Analytics should be added as a Service, since its licensing is dependent upon the Online Service SKUs (Win 10 E3/E5 + Intune/ConfigMgr) –

    • Dan Chemistruck on April 22, 2020 at 12:53 pm

      Thanks for the feedback! I’ll find a way to clarify the WVD exceptions. Microsoft 365 Business is meant to be managed with Intune, not Group Policy. Although I suppose there are still folks that care about having a Microsoft supported ADMX file. And Desktop Analytics is only available if you have SCCM, so I left it out of the chart. The Excel file will be updated next month when I get a new pricing sheet since there are a lot of lookups in the file based on license name.

  27. Wesley Kirkland on April 23, 2020 at 9:02 am

    I just want to say thank you and bless you for putting this together. This is absolutely amazing!

  28. Sébastien Varupenne on April 29, 2020 at 8:16 am

    Thank you for this very clear comparison. I’ve just seen today that Microsoft has updated again information on this page:
    They have added the “User Eligibility” frame for M/O365 F-SKU users. If you have a way to display eligibility in this license comparison, it could be helpfull.

  29. Arthur Avanesyan on May 9, 2020 at 1:41 am

    Do I understand correctly, that if we buy Microsoft 365 Business Basic + ATP Plan 1 licenses, we will get the same Advanced Threat Protection as for Microsoft 365 Business Premium?

    • Dan Chemistruck on May 18, 2020 at 9:17 pm

      For Office 365 ATP P1, yes, they are the same in both of those scenarios. (There is also Azure ATP, and Microsoft Defender ATP, but those SKUs are not included in M365 BP.)

      M365 Business Basic does not include EMS E3 or Windows 10 Pro licensing.

  30. Byron Abbott on May 18, 2020 at 7:03 pm

    This is brilliant. Definitely highlights why there is so much confusion over the licencing!
    Is there any way I could get the excel file so I can share this with my organisation?

    • Dan Chemistruck on May 18, 2020 at 9:13 pm

      I update this matrix every month, so I do not allow it to be downloaded since it becomes out of date frequently. Aaron Dinnage has several PDFs that are similar that you can download though:
      Keep in mind that Aaron’s spreadsheets are usually updated 1-2 times a year. He just updated them 5/18, so now is a good time to grab them.

  31. Todd on May 19, 2020 at 6:10 pm

    Really nice spreadsheet – thank you. Do you have a version for GCC High? Struggling with the actual licenses we need.

    • Dan Chemistruck on May 20, 2020 at 12:51 am

      I was working on a GCC High version right before the massive work from home movement started. It’s not ready yet, but I’ll give you this advice, if you’re in GCC High and need to be NIST-800 compliant, you need the automated security plans:

      At least 1x Microsoft 365 G5 license for advanced compliance reporting if needed.
      EM+S E5 as an add-on for any of the Office SKUs.
      Windows 10 E5 for MD ATP and virtualization based security.
      Minimum of Office 365 G3.

      I’m not sure if Microsoft 365 G3 + G5 Security exists, but that would be the plan to get if it’s available.

  32. Lee on May 21, 2020 at 4:13 am

    Hi Dan. I must say – really great work. The best I have seen on the Internet.

    Would you be able to add (or share of you already have it) which of the products get ticked/enabled for the E5 Compliance add-on and E5 Security add-on? You have the columns for E3 + E5 Compliance and E3 + E5 Security but it would be nice to know separately what products each of the add-on’s unlock interdependently. I appreciate you are saying E3 + E5 Security is the Hero SKUs, but it would be good to see what other combinations you can create – so having E5 Security and E5 Compliance in separate columns would help massively!!

    For example, if a user has an Exchange Online or Office 365 E1 license – could they just add E5 Security add-on (but I think that lacks intune?), so would they need both EM+S E3 and E5 Security (which seems a big cost and overlapping licenses). If you have/add E5 Security and E5 Compliance in separate columns – you would be able to clearly see what you need/get.

    Looking forward to your reply! Thank you!

    • Dan Chemistruck on May 21, 2020 at 1:50 pm

      At the moment, the M365 E5 Compliance and M365 E5 Security add-ons can ONLY be added to Microsoft 365 E3. So the scenarios you described are not possible. I have a request to the product team to make these SKUs available to all Microsoft 365 plans, but there is no movement on that yet. (To my knowledge.)

  33. Matthias on May 26, 2020 at 10:49 am

    Can you point me to a documentation which outlines the differences between the different Whiteboard plans (F1/P1/P2/P3)

    • Dan Chemistruck on May 27, 2020 at 5:46 pm

      I wish I could provide a link. My best guess is that F1 is read-only, and I have no idea what the differentiation for the other plans would be. There’s no official “Service Description” page for Whiteboard. I’ll bring it up with my PDM, and post if I receive an update.

  34. Gurs on May 26, 2020 at 11:47 am

    Fantastic chart! Thank you. One potential correction: I believe that Microsoft 365 Business Premium is now free for qualified nonprofit tenants.

    • Dan Chemistruck on May 27, 2020 at 5:32 pm

      Thanks! And Non-profits receive 10 free Microsoft 365 Business Premium licenses. If the nonprofit needs more than 10 licenses, then it’s $5/u/m.

  35. Savio on June 5, 2020 at 12:40 am

    Excellent Blog. Can you please share the link to download the latest updated license matrix. Appreciate your help.

  36. EW on June 23, 2020 at 5:44 pm

    Is there anything that would keep someone from using a G1 license and an M365 Apps for Business license, instead of getting G3? I see that G3 has some security features not found in G1. Is there anything else?

    • Dan Chemistruck on June 30, 2020 at 2:36 pm

      No technical limitations on doing this. It’s purely a choice of desired feature set. Although I would test if a G1 license works with desktop Outlook before you commit to that bundle.

  37. Mike Visconti on June 26, 2020 at 8:01 am

    This was really helpful, but I also have some users on older E2 plans which I of course can’t find any information on anywhere. Any idea what is gained/lost by switching to E1 or to one of the Business plans (this is a smaller company, well under the 300 limit).

    • Dan Chemistruck on June 30, 2020 at 2:34 pm

      You do not lose any features when switching from Office 365 E2 to E1. You gain a few new features, like To-Do and Whiteboard but nothing to write home about. They’re mostly the same license.

  38. Mark on July 2, 2020 at 5:14 am

    Dan this is awesome, thanks for making this list.
    I am confused.. The excel sheet displayed on this website seems the correct one with new M365 naming etc, but when I click the link to your sharepoint excel sheet I see the older plans.
    What is up with that? Should I bookmark the website rather than the sharepoint link?

    • Dan Chemistruck on July 9, 2020 at 5:19 pm

      Sorry, the webpage is more current than the Excel document at the moment. I will try to update both resources this month.

  39. Chris Watkins on July 6, 2020 at 1:34 pm

    Hi Dan,

    Brilliant overview – I currently have 1900 M365E3 licenses to cover our 1900 users who are sourced from AD On Premises. I have a requirement to onboard 600 M365 F3 users. Am I able to source the First line workers from the on premise Active Directory (to keep the same Starter Leavers Process) without purchasing any additional ECALS. The F3 users will never need to authenticate on premise, as we use PHS not ADFS/PTA/

    • Dan Chemistruck on July 9, 2020 at 5:18 pm

      Hi Chris, if you sign up for CSP with us we can get you a definitive answer. Are asking about if you need to license CALs for your AD DS box if they’re only going to be using AAD joined devices? M365 F3 includes EM+S E3, which includes AD DS CALs, so you’re probably fine. And if those users are never going to interact/authenticate against a Domain Controller, you don’t need Windows Server CALs for the users either.

  40. David Svirskis on July 14, 2020 at 8:01 pm

    Hi Dan, I believe M365 Business Premium includes unlimited archiving through ‘Exchange Online Archiving’ – see note 3.

  41. Matthias on July 17, 2020 at 5:50 am

    M365 Business Basic – Is there a specific reason why you only note “X” for Exchange Online, but not “P1”?

    According to the Microsoft page ( M365 Business Basic includes “Exchange Online Plan 1”, just as M365 Business Standard.

  42. Paula Leahy on July 21, 2020 at 1:54 pm

    Dan this is awesome! I may have missed it, but are the storage allocations for the Standard Services are calculated separately? For example, the storage allocation for SPOL as part of Government E3 (currently 1 TB plus 10 gig per entitlement) is in addition to the storage provided via Premium 2 (P2) for OneDrive, correct?

    • Dan Chemistruck on July 22, 2020 at 7:42 pm

      Correct, the 1 TB plus 10 GB per user is for shared storage in Teams / SPO sites. This is separate from the 5-25+ TB per user in their personal OneDrive accounts.

  43. Mark on July 29, 2020 at 5:29 am

    Hi Dan,
    Thank you for this information. It is certainly very useful.
    I am curious to know if EMS E3 a Technical or Licensing prerequisite to M365 E5 Security? Can’t find that information anywhere. Thank you.

    • Dan Chemistruck on July 30, 2020 at 1:26 am

      Microsoft 365 E3 is the only license that you can add M365 E5 Security to. EMS E3 is included in the Microsoft 365 E3 license, so don’t purchase EMS E3.

  44. Jim Hill on July 29, 2020 at 12:58 pm

    Right now I see that a couple of my Microsoft 365 E5 users have an unusual license configuration.This crept in as we needed more security and compliance features for a certain project.

    1. Microsoft 365 E3 ($32 / month)
    2. Microsoft 365 E5 Security Add on ($12 / month)
    3. Enterprise Mobility and Security E5 ($14.80 per month)
    Total, $58.80 per month

    This is actually more than the $57 E5 license. Question, what features do we lose by just having the first two licenses? Is there a chart anywhere that would show this?

    • Dan Chemistruck on July 30, 2020 at 1:23 am

      Get rid of EM+S E5. The only thing you would lose is AIP P2, which you can either buy standalone or as part of the M365 E5 Compliance add-on for $10. The M365 E5 Compliance add-on also includes Insider Risk Management, which isn’t part of EM+S E5.

  45. Stuart Duncan on August 17, 2020 at 10:38 am

    Hi Dan, does the E5 licence provide sufficient rights in SharePoint to create TeamSites and Template laydowns, or do we have to revert to Enterprise licencing for SP?

    Thanks in advance.


    • Dan Chemistruck on August 17, 2020 at 8:06 pm

      The ‘E’ in E5 stands for Enterprise, so I’m not sure what you meant by the alternative. But Office 365 E5 and Microsoft 365 E5 both include rights to create Microsoft Teams sites and SharePoint sites. A number of the SMB SKUs include Teams/SharePoint rights as well.

  46. Sébastien on August 21, 2020 at 8:43 am

    Hello Dan,

    I have a question regarding the operating system license of the VM in Azure.
    Let’s say I want to deploy WVD for 5 users and I deploy 1 Win 10 multi-session VM. My 5 users have a Microsoft 365 Business Premium license.
    For the OS license of that VM, can I check “Azure Hybrid Benefit” (“I confirm I have an eligible Windows 10 license with multi-tenant hosting rights.”) ? Or should I add “Windows E3” license to my users to have virtualisation rights?

    Many thanks.

    • Dan Chemistruck on August 21, 2020 at 1:12 pm

      VMs that are used for WVD are eligible for the Hybrid Use Benefit. If this was not automatically enabled during deployment, you should be able to safely check the box now.

  47. Rihards on September 3, 2020 at 7:06 am

    Could you help me to understand what did you mean with “RO”, “EOK1”, “SOK1”, “OME”, “CAD”?
    Also, why for Forms there are “F1”, “E1” “E3” etc.?
    And is there “P3” plan for “To-Do” and “Yammer”?

    • Dan Chemistruck on September 4, 2020 at 12:20 am

      RO = Read Only.
      EOK1 = Exchange Online Kiosk Plan 1.
      SOK1 = SharePoint Online Kiosk Plan 1.
      OME = Office Message Encryption.
      CAD = Cloud App Discovery.

      In all honesty, I don’t understand the different SKUs for To-Do and Forms, but they exist. So I noted them.

  48. Martin Bailey-Wood on September 3, 2020 at 9:02 am

    I have a number of questions regarding O365 licensing. Our organisation has bought a combination of E1, E3 and F3 O365 licenses as part of their Enterprise licensing on a 30/30/40 split accordingly. Firstly I cannot find any reference to F3 licenses altho’ I do find reference to F1 and E5 licenses. Is F3 the same as one of these under a different guise? Secondly it is my understanding that those who are accessing O365 via a thin client (e.g. Citrix) would require access to a shared activation code which is available for users with E3 licenses only, ergo all Thin Client users would require an E3 license (if I have understood that correctly). However I am being told by our technical teams that in our environment that is not the case because we have VDI installations of Windows 10 on eac of our desktops therefore negating the requirement to access O365 apps. This does not sit well with me and this does not feel right: why would you bother giving Citrix users O365 accounts if they are not going to use O365 apps and surely this will mean that we would essentially be double paying: once for the O365 licenses and also for Win10 licenses? Would welcome some further insight into this.

    • Dan Chemistruck on September 4, 2020 at 12:28 am

      The old F1 licenses are now called F3. The new F1 licenses are geared towards Teams-only users.

      I’m not sure I follow your second question. You need Microsoft 365 Business Premium or Office 365 E3+ to get the shared activation license for VDI. You can use the same O365/M365 license on your desktop/laptop/phone and your VDI session–you don’t need to buy it twice. If you’re running Office 365, you’ll need a legacy Windows 10 VL for Citrix. If you’re using Microsoft 365, you get Windows 10 licensing in WVD when you run it in Azure. Hope that helps.

  49. Chip on September 22, 2020 at 1:55 am

    Dan – If I have an M365 Business Premium license, that is good for 5 Windows 10 Pro activations correct? If I want to add a 6th Win10 Pro activation can I add another M365 Business Premium license or do I have to buy individual Windows 10 Enterprise E3 licenses? I have searched high and low for the answer to this question.

    • Dan Chemistruck on October 2, 2020 at 1:49 pm

      Windows 10 subscription licenses are per user, so a single user cannot have both W10 Pro and W10 E3. If you need to license 6 devices, you’ll need at least two users for that. You can purchase up to 300 M365 BP licenses in a single tenant.

  50. Mr. X on September 28, 2020 at 9:35 am

    Thanks for this excellent table, it simplifies understanding MS licensing a lot 🙂

    My organization is a SMB (around 40 users), and currently we have all on-prem (AD, Exchange, Sharepoint and Dynamics). We have plans to move everything to 365, but I’ve some doubts after checking the table:

    – To get anti-phising/spoofing/malware detection etc… do all the users need to be licensed on (for instance) M365 BP? It looks like the best license for us anyway.

    – Our on-prem SharePoint is being used as a commercial management solution for externals. With that in mind, I guess our best option would be to have P2 for SharePoint Online. We probably need InfoPath as well. Do we need to license all users for this? Or is it enough to have just one license in our tenant?

    – Aside from the 40 internal users, we “sell” access to our customized SharePoint. At this time, all we have to do is create a user in our AD and add it to the appropriate pages. What (minimum) license would we need for this, bearing in mind that ideally we want to have 2FA for all of them, but being externals they don’t really need anything else?

    – Regarding Exchange, our version is 2013. We have several public folders, all of them contained in a single public folder mailbox, which is about 250GB right now. Before migrating I know we need to do a massive cleaning on that, but anyway… what would you recommend? I’ve seen that the (supported) limit for public folders is 100GB. Maybe splitting them?

    – Again for public folders: do these need any special license? If so, I think a good alternative would be shared mailboxes, as they don’t consume any license, is that correct?

    – It’s quite confusing how the archiving feature works/is licensed. I recall reading somewhere that it’s unlimited, in the sense that when it needs more space, it just grows. Is that right? Or is it hard-limited to 50GB for M365 BP?

    Basically, we don’t have anything that requires local auth, so I think we can move everything to AAD and 365, only pitfall is Dynamics, CFO doesn’t quite like D365 🙂

    • Mr. X on October 7, 2020 at 4:25 am

      Adding some info:

      It seems that archiving for M365 BP is unlimited. See here:

      “Microsoft 365 Business Premium includes Exchange Online Archiving subscription. Each Exchange Online Archiving subscriber initially receives 100 GB of storage in the archive mailbox. When auto-expanding archiving is turned on, additional storage is automatically added when the 100 GB storage capacity is reached. For more information, see Overview of unlimited archiving.”

      Another thing I find confusing is this:

      “Microsoft 365 Business Premium subscribers are licensed to use full Intune capabilities for iOS, Android, MacOS, and other cross-platform device management. Features not available in the admin center in Microsoft 365 Business Premium, like third-party app management and configuration of WiFi profiles, VPN certificates, etc., can be managed in the full Intune console.”

      What license do you need to get the “full Intune console”? Is it deliberated that they are omitting Windows on that description?

  51. Daniel on September 29, 2020 at 4:23 am

    We plan to use M365 E3 with M365 E5 Security addon but we also have around 100 users with M365 F3, How can we have the same security and compliance for those users? We plan to use DLP, Sign in risk policys, ATP plan 2. We know that M365 E5 Security can´t be combined with M365 F3….

    • Martijn on November 3, 2020 at 9:42 am

      Hello Daniel,

      I have the same question, about M365 F3 users and the M365 E5 security add-on. Do you already know the answer?

      • Dan Chemistruck on November 12, 2020 at 2:59 am

        It is my understanding that the M365 E5 Security/Compliance add-ons are only available for M365 E3 or O365 E3 with EM+S E3. I do not believe you can purchase the add-ons for M365 F3 users.

  52. Cirickson Ong on October 2, 2020 at 2:31 am

    Great comparison. Just want to verify the difference of being tagged as “X” as against “P1”. This is for example – Outlook and Sharepoint. Thanks

  53. Study Guide: MS-900 Microsoft 365 Fundamentals on October 7, 2020 at 8:22 am

    […] compare costs of cloud-based services with on-premises services […]

  54. Aati on October 21, 2020 at 3:38 am

    Hi Dan, Does this table apply for Australia Region Please? It would be very helpful if you could let us know what are the changes in this table for Australian region. Thank you so much.

    • Dan Chemistruck on October 21, 2020 at 5:49 pm

      The features are the same for Global Commercial Office 365 tenants. (Meaning that features may be different for GCC High, 21Viacom, and German clouds.) Pricing for AUD is not the same as USD pricing and would be the only difference in this chart.

  55. […] * FRÅN DANIELGR: För er som jobbar med O365-licenser (frivilligt eller ofrivilligt) så verkar den här vara shysst.… […]

  56. Patrick Whitlock on January 5, 2021 at 1:44 pm

    This was tremendously helpful. I think I can cut costs by a good 6 grand a year without cutting corners, so thank you for putting the time into this.
    BTW, Microsoft is misspelled in the M365 F1 for frontline workers section (spelled micorosft)
    (I prefer to go by alt-write rather than grammar nazi)

    • Dan Chemistruck on January 5, 2021 at 5:13 pm

      Haha, thanks for alt-write check! I can’t believe we’re not the #1 search result for Micorosft though. 🙁

  57. Patrick Whitlock on January 5, 2021 at 1:44 pm

    This was tremendously helpful. I think I can cut costs by a good 6 grand a year without cutting corners, so thank you for putting the time into this.
    BTW, Microsoft is misspelled in the M365 F1 for frontline workers section (spelled micorosft)
    (I prefer to go by alt-write rather than grammar nazi)

    • Dan Chemistruck on January 5, 2021 at 5:13 pm

      Haha, thanks for alt-write check! I can’t believe we’re not the #1 search result for Micorosft though. 🙁

  58. Hamid on January 24, 2021 at 4:16 pm

    Which Plan includes On-Prem Gateway (Used for PowerApp, PowerAutomate, & PowerBI)?

    • Dan Chemistruck on January 25, 2021 at 2:22 pm

      Any of the plans that include Power BI also include the on-premises data gateway.

  59. Hamid on January 24, 2021 at 4:16 pm

    Which Plan includes On-Prem Gateway (Used for PowerApp, PowerAutomate, & PowerBI)?

    • Dan Chemistruck on January 25, 2021 at 2:22 pm

      Any of the plans that include Power BI also include the on-premises data gateway.

  60. Josh on February 22, 2021 at 12:00 pm

    Hi Dan, this is a great resource. Thanks for creating it. There is an update needed now though. Microsoft 365 Business Premium now includes Exchange Online Archiving SKU. This provides an unlimited Archive mailbox instead of the 50 gigs that was previously included. Could you update the document to include unlimited on Microsoft 365 Business Premium Archive Mailbox size instead of 50 gigs?

    • Dan Chemistruck on June 16, 2021 at 7:46 pm

      M365 Business Premium now shows unlimited archiving.

    • Dan Chemistruck on June 16, 2021 at 7:46 pm

      M365 Business Premium now shows unlimited archiving.

  61. […] Details and public pricing (in dollars) of the various Microsoft 365 licensing plans, by Dan Chemistruck (Infused Innovation). […]

  62. Guus on March 16, 2021 at 3:49 am

    Hi Dan,

    Hope everything is well.
    As I still use your site very often I was wondering when you might add Universal took me a while to understand that it comes included with the most imprortant sku’s. I thougth we had to pay a few dollars extra for every user..

    • Dan Chemistruck on June 16, 2021 at 7:47 pm

      Universal Print for Windows 10 has been added to the licensing comparison.

  63. Lowell on March 17, 2021 at 12:49 pm

    Great comparison chart, thank you for keeping this up to date! I notice that Stream is not listed as part of M365 Business Premium, yet people with that license can use Stream (i.e. when recording Teams meetings). It seems to be included.

    • Dan Chemistruck on June 16, 2021 at 7:55 pm

      Stream has been added to all Microsoft Business SKUs.

  64. Christopher Monroe on May 3, 2021 at 10:36 am

    Great chart. I see in the that you have Azure AD join and Manage with Intune (In the Windows 10 section) checked under Business Premium but shouldn’t they be checked in the EM S E5 also? EM S E5 comes with AD Premium P2 which has those features (and more)


    • Dan Chemistruck on June 16, 2021 at 7:11 pm

      EMS E5 allows you to join a device to Azure AD, but it does not include the Windows 10 Pro license. Whereas Microsoft 365 Business Premium includes Windows 10 Pro.

  65. Kevin on May 6, 2021 at 3:23 pm

    This is by far the best pricing matrix I’ve seen for Microsoft 365 services. Thank you for putting this together and maintaining it with a changelog!

  66. Chris on May 9, 2021 at 5:44 pm

    Thank you for this great overview, it is very helpful.
    We have 30 users with a mix of Business Basic and Business Standard. We would like to deploy Intune and conditional access.
    Instead of upgrading everybody to Business Premium, we could just purchase Microsoft 365 F1 at a quarter of the cost?

    • Dan Chemistruck on June 16, 2021 at 7:07 pm

      Yes, I believe you can combine those two SKUs.

  67. Matthias on May 17, 2021 at 12:53 am

    The Exchange Archiving Mailbox size in M365 Business Premium is 100 GB (initially) and unlimited – not 50 GB as noted in the table. Source:

  68. Joseph Burton-Harris on August 19, 2021 at 4:31 pm

    This is an awesome table thank you! However it is two years out of date now.. Has there been any updates since 2019?

    • Dan Chemistruck on September 1, 2021 at 7:03 pm

      It is not out of date. Please see the change log at the bottom of the post.

  69. […] Prior to today’s announcement, Microsoft Defender for Endpoint was primarily available for companies that signed up for a Microsoft 365 E5 license or a E3 license with a E5 security extension tier, both of which are some of the most expensive tiers in Microsoft’s enterprise licensing scheme. […]

  70. Aati on December 7, 2021 at 11:23 pm

    Hi Dan, Does this table apply for Middle East Parts (Dubai) Please? It would be very helpful if you could let us know what are the changes in this table for Middle East . And is it possible to get the Pricing detail too please?
    Thank you so much.

  71. [m365weekly] #79 - M365 Weekly Newsletter on July 4, 2022 at 2:07 pm

    […] The Complete Office 365 And Microsoft 365 Licensing Comparison. This is a real gem. No kidding. Check it out. […]

Leave a Comment