Microsoft 365 now has three enterprise tiers worth comparing: E3 for core productivity plus baseline security and compliance, E5 for the advanced security, compliance and voice stack on top of E3, and the new E7 'Frontier Suite', which bundles everything in E5 with Microsoft 365 Copilot, Agent 365 and the Entra Suite. Choosing well comes down to one question: how many of the higher-tier capabilities you will actually deploy, versus pay for and leave switched off. This guide walks through what sits in each tier, what it costs in 2026, and a decision framework you can apply to your own estate.
The short answer
If you only need Office apps, email, Teams and a solid security baseline, E3 is enough. If you want to consolidate point security products — endpoint detection, cloud app security, advanced eDiscovery, risk-based identity protection and Teams Phone — into one SKU, E5 almost always wins on both capability and total cost. If your organisation is committing to Microsoft 365 Copilot and governed AI agents as a standard part of how people work, E7 packages that future at a discount to buying the pieces separately. Most organisations today land on E3 or E5; E7 is for those treating AI agents as first-class workers.
Pricing at a glance
List prices below are USD, per user per month, on an annual commitment. Microsoft raised most commercial prices on 1 July 2026, so both the current and post-increase figures are shown. Actual prices vary by agreement, region and channel — treat these as planning numbers, not quotes.
| Plan | Price (before 1 Jul 2026) | Price (from 1 Jul 2026) | Headline positioning |
|---|---|---|---|
| Microsoft 365 E3 | $36 | $39 | Core productivity + baseline security/compliance |
| Microsoft 365 E5 | $57 | $60 | Advanced security, compliance and voice |
| Microsoft 365 E7 | — | $99 (with Teams) / $90.45 (without Teams) | E5 + Copilot + Agent 365 + Entra Suite |
E7 was announced on 9 March 2026 and reached general availability on 1 May 2026 — Microsoft's first new enterprise tier since E5 launched in 2015. It is purely additive: nothing in E5 is removed.
What each tier is actually for
It helps to think of the three tiers as answers to three different questions.
- E3 — "Can my people work securely?" The desktop Office apps, Exchange, SharePoint, OneDrive and Teams, with Intune for device management, Entra ID P1 for conditional access, and a baseline of data protection and retention.
- E5 — "Can I run security and compliance from one platform?" Everything in E3 plus the advanced Defender suite, risk-based identity protection, advanced compliance/eDiscovery, analytics and Teams Phone — replacing a stack of third-party tools.
- E7 — "Can humans and AI agents work side by side, governed?" Everything in E5 plus Copilot in the flow of work, a control plane to govern AI agents, and advanced identity. The bet is that agents become part of the workforce and need the same security and identity guardrails as people.
E3: the productivity and security baseline
E3 is the workhorse SKU for most enterprises. It includes the full desktop Office suite, Exchange Online (100 GB mailboxes), SharePoint, OneDrive, Teams, and Microsoft Intune and Configuration Manager for endpoint management. On the security side you get Entra ID P1 (conditional access, self-service password reset, dynamic groups), Microsoft Purview baseline data loss prevention and retention, eDiscovery Standard, and Windows Enterprise. From 1 July 2026, E3 also includes Defender for Office 365 Plan 1, adding safe-links and safe-attachments protection that previously needed an add-on. What E3 does not include is the advanced threat detection, automated investigation, insider-risk and risk-based identity tooling that defines E5.
E5 over E3: what the extra spend buys
The jump from E3 to E5 is roughly $21 per user per month. The value is in consolidation — most of what E5 adds are products organisations otherwise buy separately. The headline additions:
| Capability area | What E5 adds over E3 |
|---|---|
| Endpoint security | Defender for Endpoint Plan 2 — EDR, threat and vulnerability management, automated investigation and response |
| Email/collaboration security | Defender for Office 365 Plan 2 — threat trackers, attack simulation, automated remediation |
| Cloud app security | Defender for Cloud Apps (CASB) — shadow-IT discovery, session controls |
| Identity protection | Defender for Identity and Entra ID P2 — risk-based conditional access, Privileged Identity Management, access reviews |
| Compliance | eDiscovery Premium, Insider Risk Management, Communication Compliance, advanced auditing |
| Voice | Teams Phone System and Audio Conferencing — replaces traditional PBX |
| Analytics | Power BI Pro at no extra cost |
The rule of thumb practitioners use: if you would otherwise buy two or more of these as E3 add-ons, E5 is cheaper. Bought individually, the E5-exclusive capabilities run well past $30 per user per month, so the $21 uplift is usually the better deal the moment endpoint EDR and Entra ID P2 are both on your roadmap.
E7 over E5: the AI and agent layer
E7 keeps the entire E5 foundation and adds three things on top. It is aimed at organisations standardising on AI as part of daily work rather than piloting it.
| Addition | What it does |
|---|---|
| Microsoft 365 Copilot | AI in the flow of work across Word, Excel, PowerPoint, Outlook and Teams — moved from a standalone add-on to a default inclusion. The current wave adds Copilot Cowork (long-running, multi-step tasks across apps) and Work IQ (organisational context), and supports both Anthropic Claude and OpenAI models. |
| Agent 365 | A centralised governance control plane for AI agents, integrating with Defender, Entra and Purview so existing security and identity policies apply to every agent in the environment. |
| Entra Suite | Advanced zero-trust identity and access management (including Internet Access, Private Access and advanced identity governance) beyond standard E5. |
On the economics: bought separately, the E7 components add up to roughly $117 per user per month, so the $99 bundle is about a 15% (~$18) saving — provided you would have bought all the parts. Copilot alone has been a $30-per-user add-on, which is why E7 makes sense mainly for organisations already committed to Copilot at scale. If you are not there yet, note that Agent 365 is also sold standalone at about $15 per user per month, so you can add agent governance to E5 without a full E7 jump.
A decision framework
Map your situation to the tier rather than starting from the price tag.
| Choose this | When this is true |
|---|---|
| E3 | You need productivity + a security baseline; you already run third-party EDR/SIEM you are happy with; budget is tight; advanced compliance is not a regulatory requirement. |
| E5 | You want to consolidate security/compliance tools into Microsoft; you need EDR, CASB, Entra ID P2 risk policies, advanced eDiscovery or insider risk; you are replacing a PBX with Teams Phone. |
| E7 | You are rolling out Copilot org-wide, expect to deploy and govern AI agents, and want the Entra Suite's advanced identity — and you will actually use all three additions. |
| Mix-and-match | License a knowledge-worker core on E5/E7 and frontline or task workers on F3/E3. Per-user assignment means you don't have to standardise the whole org on one SKU. |
The mistake to avoid: paying for shelfware
The most expensive licensing error is buying E5 or E7 and never turning the differentiating features on. An E5 tenant where Defender for Endpoint is unconfigured, Entra ID P2 risk policies are off, and Teams Phone is unused is just an expensive E3. Before you upgrade, confirm there is an owner and a rollout plan for each capability that justifies the jump. The same applies doubly to E7: Copilot and Agent 365 deliver value only with the data governance, adoption and change management to back them. License to a deployment plan, not to a feature list.
Check where your tenant actually stands
Before you decide, get an honest read on what you are using today. Our free, browser-based x365 Microsoft 365 & Entra audit tool surfaces conditional access coverage, MFA posture, legacy-auth exposure and identity configuration without sending tenant data off your device — useful for spotting whether you are already paying for E5 capabilities you haven't switched on. Pair it with our Entra ID Conditional Access gaps guide to close the policy holes that licensing alone won't fix, and the Zero Trust Architecture Cheat Sheet to map controls to outcomes.
Frequently asked questions
What is the difference between Microsoft 365 E3 and E5?
E3 provides core productivity (Office apps, Exchange, SharePoint, OneDrive, Teams), endpoint management with Intune, Entra ID P1 and a baseline of security and compliance. E5 adds the advanced layer on top: Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Cloud Apps, Defender for Identity, Entra ID P2 risk-based policies, eDiscovery Premium and Insider Risk Management, plus Teams Phone and Power BI Pro. If you would otherwise buy two or more of those separately, E5 is usually cheaper overall.
What is Microsoft 365 E7?
E7, branded the 'Frontier Suite', is Microsoft's newest enterprise tier, announced 9 March 2026 and generally available from 1 May 2026. It bundles everything in E5 with Microsoft 365 Copilot, Agent 365 (a governance control plane for AI agents) and the Entra Suite, at $99 per user per month with Teams (or $90.45 without). It is additive — nothing in E5 is removed.
How much do E3, E5 and E7 cost?
On annual commitment, list prices are approximately: E3 at $36 per user per month ($39 from 1 July 2026), E5 at $57 ($60 from 1 July 2026), and E7 at $99 with Teams or $90.45 without. Prices are USD and vary by agreement, region and channel.
Is E7 worth it over E5?
E7 makes sense if you are deploying Microsoft 365 Copilot org-wide and plan to run and govern AI agents. Bought separately the components total around $117 per user per month, so the $99 bundle saves roughly 15% — but only if you actually use Copilot, Agent 365 and the Entra Suite. If you are not committed to Copilot at scale, staying on E5 (optionally adding Agent 365 standalone at about $15 per user per month) is more cost-effective.
Do I have to put every user on the same plan?
No. Microsoft 365 licences are assigned per user, so you can mix tiers — for example knowledge workers on E5 or E7 and frontline or task workers on F3 or E3. Licensing to actual role needs is usually cheaper than standardising the whole organisation on a single SKU.