Microsoft 365 E5: Premium Enterprise Plan Guide

What Is Microsoft 365 E5?

E5 sits at the top of the Microsoft 365 enterprise stack. At around £45–48/user/month it is a serious line item, but most of the uplift over E3 (around £28–31/user/month, 2026 list pricing) is a consolidated security, compliance and analytics toolset that would cost considerably more bought piecemeal. If you already run Microsoft 365 security as a managed service, E5 changes what you can switch on.

For organisations where security is a board-level priority — regulated finance, legal practices, healthcare, or any business recovering from an incident — the E5 bundle is worth evaluating on a strict cost-per-feature basis rather than a headline price. Microsoft publishes the full plan comparison on its Microsoft 365 plans page, and the per-user rate there is the figure to budget against.

What Does E5 Add Over E3?

E5 keeps every E3 capability and layers on four categories most SMEs otherwise stitch together from separate vendors: advanced threat protection, premium identity, advanced compliance, and voice plus analytics. The practical effect is fewer security gaps and one accountable provider instead of five contracts to reconcile.

Advanced threat protection

• Microsoft Defender for Endpoint Plan 2 — endpoint detection and response (EDR), automated investigation and remediation, and threat hunting. This is the engine behind a managed Microsoft Defender for Business deployment.
• Microsoft Defender for Office 365 Plan 2 — threat trackers, Threat Explorer, automated investigation for email threats, and attack simulation training.
• Microsoft Defender for Identity — monitors on-premises Active Directory for identity-based attacks and lateral movement.
• Microsoft Defender for Cloud Apps — a cloud access security broker (CASB) giving visibility into SaaS usage and data leakage.

Identity and access

• Microsoft Entra ID P2 (formerly Azure AD Premium P2) — everything in P1 plus Privileged Identity Management (PIM), Identity Protection with risk-based conditional access, and access reviews.
• PIM grants admin rights just-in-time, so an administrator only holds elevated permissions when actively using them. The technical detail is documented in Microsoft's Entra PIM guidance. Tightening privileged access is also one of the controls the NCSC recommends for limiting the blast radius of a compromised account. Manage it well alongside Microsoft Entra ID.

Compliance and information governance

• Microsoft Purview advanced compliance — insider risk management, communication compliance with machine-learning classifiers, and advanced eDiscovery.
• Microsoft Purview Information Protection P2 — automatic sensitivity labelling and trainable classifiers.
• Customer Lockbox — requires your approval before Microsoft support can access your data.
• Advanced audit with 10-year log retention — standard audit keeps logs for 90 days, so this matters for any business with long regulatory retention duties. A regular Microsoft 365 security audit turns those logs into action.

Voice and analytics

• Teams Audio Conferencing — participants dial into meetings on a standard phone number, useful for external clients who prefer phone access.
• Teams Phone System — the licence needed for Microsoft Teams calling. A PSTN calling plan is still bought separately.
• Power BI Pro and Microsoft Viva Insights — business intelligence dashboards and workforce collaboration analytics.

Is the E5 Uplift Over E3 Justified?

The roughly £17–18/user/month difference between E3 and E5 should be weighed against what the same capabilities cost as standalone add-ons. If you need two or more of them, the bundle usually wins. If you need just one, buying that single add-on on top of E3 is cheaper.

Indicative standalone add-on prices (market rates as of 2026; confirm current rates with Microsoft before budgeting):

Add two of those together and you are already close to the E5 premium over E3 — which is exactly why Microsoft prices the bundle the way it does.

Should You Choose the E5 Security Add-On Instead?

Microsoft offers a Microsoft 365 E5 Security add-on for organisations on E3 that want the security stack without paying for Power BI, Audio Conferencing and the rest. It includes Defender for Endpoint P2, Defender for Identity, Defender for Cloud Apps and Entra ID P2 at a lower per-user cost than full E5.

This is the pragmatic route when your priority is hardening your security posture rather than enabling analytics and voice. Many businesses we work with start here, then move to full E5 once they have a use case for the compliance and BI components. Pairing the add-on with Microsoft 365 backup closes the gap E5 itself does not cover — native retention is not a backup.

Who Is Microsoft 365 E5 Typically For?

E5 is most often adopted where regulation or risk justifies the spend. It is rarely the right default for a 15-person team with no compliance pressure, and it is frequently the right answer for a regulated 200-person firm.

• Financial services — where FCA and PRA expectations push advanced audit, data governance and threat protection.
• Legal practices — needing extensive eDiscovery, communication compliance and privilege management.
• Healthcare — where patient data protection and insider-risk management are non-negotiable.
• Larger enterprises — where one consolidated security toolset simplifies vendor management.
• Post-breach businesses — investing seriously in detection and response after an incident.

One provider, security-first, with Microsoft-certified engineers is the difference between owning E5 licences and actually using them. AMVIA helps businesses decide between full E5, the E5 Security add-on, or targeted upgrades on E3 — the right answer depends on your existing tooling, regulatory obligations and security maturity. Microsoft's own security overview is a useful primer before that conversation.