Microsoft 365 E5: Premium Enterprise Plan Guide

What Is Microsoft 365 E5?

E5 is Microsoft's premium enterprise plan, sitting at the top of the Microsoft 365 stack. At £47.80/user/month, it's a significant investment. The additional cost over E3 (£30.20/user/month) is essentially paying for a substantial security, compliance and analytics toolset that would cost considerably more if purchased separately as add-on licences.

For organisations where IT security is a strategic priority — financial institutions, legal firms, healthcare organisations, or any business that has experienced or is concerned about sophisticated attacks — the E5 security bundle is genuinely worth evaluating on a cost-per-feature basis.

What E5 Adds Over E3

Advanced Threat Protection

• Microsoft Defender for Endpoint Plan 2 — advanced endpoint detection and response (EDR), automated investigation and remediation, threat hunting
• Microsoft Defender for Office 365 Plan 2 — threat trackers, threat explorer, automated investigation for email threats, attack simulation training
• Microsoft Defender for Identity — monitors on-premises Active Directory for identity-based attacks, lateral movement detection
• Microsoft Defender for Cloud Apps — cloud access security broker (CASB) for visibility into SaaS app usage and data leakage

Identity and Access

• Azure Active Directory Premium P2 — includes everything in P1 plus Privileged Identity Management (PIM), Identity Protection with risk-based conditional access, and access reviews
• PIM allows just-in-time elevation of admin privileges — a critical control for reducing the window of exposure if an admin account is compromised

Compliance and Information Governance

• Microsoft Purview advanced compliance — insider risk management, communication compliance with machine learning classifiers, advanced eDiscovery (custodian management, review sets)
• Microsoft Purview Information Protection P2 — automatic sensitivity labelling, trainable classifiers
• Customer Lockbox — require customer approval before Microsoft support can access your data
• Advanced audit with 10-year log retention (standard audit provides 90 days)

Voice and Conferencing

• Microsoft Teams Audio Conferencing — participants can dial into Teams meetings using a standard phone number, and organisers can call out to add dial-in participants. This is a meaningful feature for businesses with external clients or stakeholders who prefer phone dial-in
• Teams Phone System — the licence required for Teams PSTN calling (a calling plan still needs to be purchased separately)

Analytics and Reporting

• Power BI Pro — full Power BI service for business intelligence dashboards and reports
• Microsoft Viva Insights — workforce analytics on working patterns and collaboration

E5 vs E3: Is the Uplift Justified?

The £17.60/user/month difference between E3 and E5 needs to be evaluated against what you'd spend on the equivalent capabilities separately:

• Defender for Endpoint P2 as a standalone add-on: approximately £7-8/user/month
• Azure AD Premium P2 as a standalone: approximately £7/user/month
• Power BI Pro standalone: approximately £8/user/month
• Teams Audio Conferencing: approximately £3/user/month

If your organisation needs two or more of these capabilities, the E5 bundled price generally represents better value than buying add-ons. For organisations that need only one of these features, purchasing that specific add-on on top of E3 is more cost-effective.

E5 Security Add-On vs Full E5

Microsoft also offers a Microsoft 365 E5 Security add-on for organisations on E3 that want the security features without paying for Power BI, Audio Conferencing, and other components. The E5 Security add-on includes Defender for Endpoint P2, Defender for Identity, Defender for Cloud Apps, and Azure AD P2 at a lower per-user cost than full E5.

This is worth considering for organisations that are on E3 and primarily want to upgrade their security posture without needing the full E5 feature set.

Who E5 Is Typically For

E5 is most commonly adopted by:

• Financial services firms — where regulatory requirements (FCA, PRA) demand advanced audit, data governance and threat protection
• Legal practices — requiring extensive eDiscovery, communication compliance and privilege management
• Healthcare organisations — where patient data protection and insider risk management are essential
• Large enterprises — where the consolidated security toolset simplifies vendor management and reduces total cost
• Businesses post-breach — organisations that have experienced a security incident and are investing in detection and response capabilities

AMVIA works with businesses evaluating E5 to assess whether the full plan or targeted add-ons are the more appropriate path. The right answer depends on your existing tooling, regulatory obligations, and security maturity.