Microsoft 365 E3 vs E5 vs EMS: Which Security Features Each Includes

The short version: Microsoft 365 E3 gives you identity (Entra ID P1), Defender for Office 365 Plan 1 (included from 1 July 2026), basic endpoint protection (Defender for Endpoint Plan 1), Intune, data loss prevention and message encryption. E5 adds Entra ID P2, Defender for Office 365 Plan 2, Defender for Endpoint Plan 2, Defender for Identity, Defender for Cloud Apps, Audit (Premium), insider risk and automatic labeling. Enterprise Mobility + Security (EMS) is a separate identity and device bundle, E3 matching Entra ID P1 and E5 matching Entra ID P2. Owning a feature is not the same as having configured it.

This guide is for IT managers and business owners who pay for Microsoft 365 and want to know what security they already have, and whether E5 is worth discussing. You will get a feature list per plan, a short list of included features that someone has to switch on, and a way to read your own licences. Facts were checked against Microsoft Learn on 28 October 2026. Prices are not covered here: use Microsoft's pricing pages.

Naming and recent changes

• Microsoft 365 E5 Security is now called Microsoft Defender Suite. Microsoft's Entra licensing page lists it as "Microsoft Defender Suite (formerly Microsoft 365 E5 Security)".
• Microsoft Purview Suite is the compliance counterpart that appears in the service descriptions next to the Defender Suite.
• Defender for Office 365 Plan 1 in E3: Microsoft's Defender for Office 365 service description says Plan 1 is included with Office 365 E3 and Microsoft 365 E3 effective 1 July 2026. It does not include Plan 2. Older pages and articles, including some Microsoft licensing tables, may still show E3 without it.
• Enterprise Mobility + Security (EMS) E3 and E5 are still listed as current offers in Microsoft's Entra, Defender and Purview licensing pages. See the EMS section below.
• Microsoft 365 E7 appears in Microsoft's Entra and Intune licensing pages as a newer suite above E5. This guide does not cover it.
• Microsoft 365 E3 can be topped up with add-ons such as the Defender Suite and the Purview Suite, so "E3 plus add-on" is a real alternative to E5.

Microsoft 365 E3: what you get

• Identity: Microsoft Entra ID P1. This covers Conditional Access, MFA reports, fraud alert, trusted IPs, self-service password reset with writeback and custom roles.
• Email protection: the built-in protections for all cloud mailboxes (anti-spam, anti-malware, anti-phishing for spoofing), plus Defender for Office 365 Plan 1 from 1 July 2026: Safe Links, Safe Attachments, anti-phishing with impersonation protection, and real-time detections. Plan 2 is not included.
• Endpoint: Microsoft Defender for Endpoint Plan 1 (next-generation anti-malware, attack surface reduction rules, device control, firewall, network protection).
• Device management: Microsoft Intune, as part of the bundle.
• Data protection: Purview Message Encryption, data loss prevention for Exchange, SharePoint and OneDrive, manual sensitivity labeling, scanner-based discovery.
• Audit and search: Audit (Standard) and eDiscovery (Standard).

Microsoft 365 E5: what it adds on top of E3

• Identity: Microsoft Entra ID P2. Adds risk-based Conditional Access, Entra ID Protection (risk policies, risky users and sign-ins) and Privileged Identity Management.
• Email protection: Defender for Office 365 Plan 2, which adds to Plan 1 the Threat Explorer, Threat trackers, campaign views, automated investigation and response and attack simulation training.
• Endpoint: Defender for Endpoint Plan 2 (endpoint detection and response, automated investigation, vulnerability management core capabilities, threat analytics).
• Identity threat detection: Defender for Identity.
• Cloud apps: Defender for Cloud Apps, including app governance.
• Data protection: Endpoint DLP, client and service-side automatic sensitivity labeling, Customer Lockbox.
• Compliance: Audit (Premium) with up to one-year retention of audit logs, Insider Risk Management, Communication Compliance and eDiscovery (Premium).

Enterprise Mobility + Security (EMS): what it is

Microsoft's "Product names and service plan identifiers for licensing" reference (linked from Microsoft Learn) lists the components of each EMS product:

• EMS E3: Microsoft Entra ID P1, Microsoft Intune, Azure Information Protection Premium P1, Azure Rights Management, Azure multifactor authentication and Cloud App Security discovery.
• EMS E5: everything in E3, plus Microsoft Entra ID P2, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps and Azure Information Protection Premium P2.

EMS is a subset of what Microsoft 365 E3 and E5 already contain on the identity and device side. If you hold Microsoft 365 E3 or E5, you do not need EMS as well. EMS makes sense when a company buys the pieces separately, for example Office 365 plus EMS. Microsoft also lists "Microsoft 365 E3 with the Enterprise Mobility + Security E5 add-on" as a valid combination.

Office 365 E3 and E5 are different from Microsoft 365 E3 and E5

Office 365 plans cover the Office apps and online services, not the Windows and device layer. In Microsoft's service descriptions:

• Defender for Office 365 Plan 1 is included in Office 365 E3 and Microsoft 365 E3 from 1 July 2026. Plan 2 is included in Office 365 E5 and Microsoft 365 E5, not in E3.
• Defender for Endpoint Plan 1 is listed under Microsoft 365 E3, not Office 365 E3.
• Entra ID P1 is listed under Microsoft 365 E3, and Entra ID P2 under Microsoft 365 E5.

Included but often not switched on

Included means licensed, not configured. Check these first, in this order:

1. Conditional Access policies (E3 and above). Entra ID P1 gives you the feature; nothing happens until policies exist. See conditional access baseline policies.
2. Risk-based Conditional Access and ID Protection (E5). Risk policies require Entra ID P2.
3. Privileged Identity Management (E5). Users with eligible or time-bound role assignments need P2 licences.
4. Defender for Office 365 policies (Plan 1 in E3 from 1 July 2026 and in Business Premium, Plan 2 in E5). The service is on at tenant level, but you decide who is covered by assigning policies. Start with the Standard preset policy.
5. Defender for Endpoint (E3 has Plan 1, E5 has Plan 2). Open the Defender portal and confirm your devices appear.
6. Message encryption and DLP (E3 and above). Create the mail flow rule or policy, otherwise nothing is encrypted automatically.
7. Sensitivity labels (manual labeling in E3, automatic labeling in E5). Labels need to be published before users see them.
8. Audit (Premium) (E5). Retention applies to users with the right licence.
9. Intune enrolment (E3 and above). A device is only managed once it is enrolled.

How to see what you own

In Microsoft Graph PowerShell, list the licences in your tenant, how many you hold and how many are used:

Connect-MgGraph -Scopes Organization.Read.All
Get-MgSubscribedSku | Format-Table SkuPartNumber, ConsumedUnits,
    @{Name='Purchased'; Expression={$_.PrepaidUnits.Enabled}}

To list the service plans inside each licence, which shows features such as Defender or Entra plans:

$allSKUs = Get-MgSubscribedSku -Property SkuPartNumber, ServicePlans
$allSKUs | ForEach-Object {
    Write-Host "Licence:" $_.SkuPartNumber
    $_.ServicePlans | ForEach-Object {$_}
}

Common mistakes

1. Buying E5 without a plan to configure it. If nobody will set up Defender for Identity, Insider Risk or risk policies, the extra licence adds cost but little protection.
2. Assuming Office 365 E3 equals Microsoft 365 E3. Defender for Endpoint Plan 1 and Entra ID P1 features sit in Microsoft 365 E3, not Office 365 E3.
3. Paying for EMS on top of Microsoft 365 E3 or E5. Check for overlap before renewal.
4. Licensing only some users. Defender for Office 365 needs licences for every user who accesses a protected mailbox, and for shared mailboxes. Entra ID P2 features such as PIM need licences for the users concerned.
5. Treating Secure Score as proof you are covered. Secure Score measures configuration; it is not a guarantee. See how to improve Microsoft Secure Score.

How to check it worked

1. List your licences with the commands above and note which security plans are present.
2. For each feature in the "included but often not switched on" list, find the portal page where it is configured and write down who owns it.
3. Compare what you found against the E3 and E5 lists. Anything you pay for and have not configured goes on a remediation list.
4. Re-check after each renewal or licence change.

FAQ

What does a Microsoft 365 E3 licence include?

For security: Entra ID P1, Defender for Office 365 Plan 1 (from 1 July 2026), Defender for Endpoint Plan 1, Intune, Purview Message Encryption, DLP for Exchange, SharePoint and OneDrive, manual sensitivity labeling, Audit (Standard) and eDiscovery (Standard).

Does Office 365 E3 have Defender?

Since 1 July 2026, Microsoft's service description says Office 365 E3 and Microsoft 365 E3 include Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing, real-time detections). Plan 2 is E5 only. Defender for Endpoint Plan 1 is part of Microsoft 365 E3, not Office 365 E3.

What's included in Enterprise Mobility + Security E3?

Entra ID P1, Intune, Azure Information Protection Premium P1, Azure Rights Management, Azure multifactor authentication and Cloud App Security discovery. EMS E5 adds Entra ID P2, Defender for Identity, Defender for Cloud Apps and Azure Information Protection Premium P2.

How does Microsoft 365 E3 compare with Business Premium for security?

Both include Entra ID P1, Defender for Office 365 Plan 1 (E3 from 1 July 2026), Purview Message Encryption and DLP for Exchange, SharePoint and OneDrive. Business Premium also includes Defender for Business; Microsoft 365 E3 includes Defender for Endpoint Plan 1.

Is Microsoft 365 E5 worth it for a small company?

It depends on whether you will use the extra tools. E5 adds identity risk detection, Defender for Office 365 Plan 2, Defender for Endpoint Plan 2 and compliance tools. A cheaper step is E3 plus the Defender Suite or Purview Suite add-on, which Microsoft allows.

Related reading: Defender for Office 365 Plan 1 vs Plan 2 and Microsoft Intune pricing and plans.

If you want help working out what you own and what is switched on, our Microsoft 365 security audit covers it.

If you would rather know the price of a full review before you start, what a Microsoft 365 security audit costs sets out the fixed prices by headcount.