Microsoft 365 Business Premium vs E3 vs E5: feature comparison for admins

Microsoft 365 Business Premium is the right plan for organizations with up to 300 users that need Conditional Access, Intune and Defender for Business without enterprise pricing. Microsoft 365 E3 is the enterprise baseline and, since the July 2026 update, also includes Defender for Office 365 Plan 1 and Intune Plan 2. Microsoft 365 E5 adds Entra ID P2, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps, premium eDiscovery, Teams Phone and Security Copilot capacity.

Who this is for and what you will have

This comparison is for Microsoft 365 administrators and IT leads who have to justify a plan choice at renewal after Microsoft's July 2026 pricing and packaging changes. It sticks to features an administrator configures and to Microsoft's published US list prices. At the end you will have:

• A side-by-side table of identity, security, device, mail, compliance and Teams features.
• A summary of what changed in July 2026 for each plan.
• A decision guide based on seat count and required controls.
• A way to confirm in your own tenant which service plans you are entitled to.

Prices below are Microsoft's US list prices per user per month. Microsoft states that existing customers remain on current pricing until their renewal, so the new prices apply from the first renewal after July 1, 2026. Prices in other countries and currencies, and under Enterprise Agreement or partner contracts, differ.

What changed in July 2026

Microsoft announced the update in December 2025. Prices took effect on July 1, 2026 and packaging started rolling out in June 2026, with several features scheduled to finish by August 1, 2026. Tenants receive at least 30 days' notice in Message center before packaging changes reach them.

"Copilot Chat enhancements" means inbox and calendar awareness and access to the Word, Excel and PowerPoint agents. Microsoft 365 E7 pricing did not change, but Microsoft states that the packaging added to E5 also applies to E7.

For Security Copilot, E5 customers receive 400 Security Compute Units per month for every 1,000 paid user licences, up to a maximum of 10,000 per month. A tenant with 4,000 licences gets 1,600 per month.

Feature comparison

"Add-on" here means Microsoft sells the capability separately. For Business Premium, Microsoft offers the Microsoft Defender Suite for Business Premium, which adds Entra ID P2, Defender for Identity, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2 and Defender for Cloud Apps. For E3, the equivalent is the Microsoft Defender Suite (formerly Microsoft 365 E5 Security), which Microsoft lists at $12 with no change in July 2026.

Identity

All three plans include Entra ID P1, which is what you need for Conditional Access, Microsoft Entra Connect Health, self-service password reset with writeback and custom roles. E5 includes Entra ID P2. Risk-based Conditional Access requires Microsoft Entra ID Protection, which is a P2 feature. P2 also unlocks Privileged Identity Management for just-in-time admin roles, and the access review and entitlement management capabilities that were previously generally available in P2.

If you need P2 controls for only a handful of administrators, Microsoft's PIM licensing rules count the users with eligible or time-bound assignments, approvers and reviewers, so you don't necessarily need P2 for the whole organization.

Email and collaboration security

Every cloud mailbox gets the built-in protection: anti-malware, anti-spam, spoofing protection, quarantine and zero-hour auto purge. Defender for Office 365 Plan 1, now in Business Premium and E3, adds impersonation protection, Safe Attachments (including for SharePoint, OneDrive and Teams), Safe Links and Real-time detections. Plan 2 in E5 adds Threat Explorer, Threat Trackers, campaigns, automated investigation and response, attack simulation training, priority account protection and advanced hunting in Defender XDR.

A quick check in the Microsoft Defender portal: if Email & collaboration shows Real-time detections, the tenant has Plan 1; if it shows Explorer, it has Plan 2.

Microsoft's licensing terms require a Defender for Office 365 licence for every user who accesses a protected mailbox, for shared mailboxes that benefit from it, and for all users of SharePoint, OneDrive or Teams when Safe Attachments for those services is on. That matters when you mix E3 or Business Premium users with plans that don't include Plan 1.

Endpoint security

Business Premium includes Defender for Business, which Microsoft describes as equivalent to Defender for Endpoint Plan 1 with some Plan 2 features, designed for organizations up to 300 employees. E3 includes Defender for Endpoint Plan 1: next-generation anti-malware, attack surface reduction rules, device control, endpoint firewall, network protection and application control. E5 includes Plan 2, adding endpoint detection and response, automated investigation and remediation, threat and vulnerability management, threat analytics and deep analysis sandboxing. Microsoft also notes that E5 includes Windows 10 or Windows 11 Enterprise E5.

Servers are licensed separately in every case. For Business Premium, the Defender for Business Servers add-on is capped at 60 licences per customer; beyond that, use Defender for Servers.

Device management

Business Premium and E3 both include Intune Plan 1, the base unified endpoint management service. The July 2026 update adds Intune Plan 2, Intune Remote Help and Intune Advanced Analytics to E3. E5 adds the Intune Suite capabilities Endpoint Privilege Management, Cloud PKI and Enterprise Application Management. Microsoft's FAQ says the Intune additions apply to eligible EMS E3, Microsoft 365 E3 and E5 tenants without customer action, and that standalone Intune Suite and add-ons remain available for customers without those plans.

If your E3 tenant already pays for Remote Help or Intune Plan 2 as add-ons, review them at renewal: the base plan now includes them.

Mail storage and compliance

Microsoft's Exchange Online limits now show a 100 GB user mailbox for Business Basic, Standard and Premium as well as for Microsoft 365 E3 and E5. Business Premium, E3 and E5 all include an archive that starts at 100 GB and grows to 1.5 TB with auto-expanding archiving.

For eDiscovery, premium features such as review sets, analytics, OCR, conversation threading and app-only Graph API access require an Office 365 E5 or Microsoft 365 E5 subscription or a related E5 add-on, so neither Business Premium nor E3 includes them on its own.

Teams and telephony

Each plan is sold with or without Teams. E5 includes the Microsoft 365 Phone System application and Audio Conferencing, so users only need PSTN connectivity, such as a Calling Plan, Operator Connect or Direct Routing. Business Premium and E3 users need a Teams Phone Standard licence, or the Teams Phone with Calling Plan bundle, for the same capability. The companion article on Microsoft 365 suites with and without Teams covers the Teams options in detail.

Choosing a plan

Three rules shape the decision:

• The 300-seat cap is shared. It covers Business Basic, Standard and Premium combined. A tenant with 250 Business Premium seats can add only 50 more Business seats of any kind.
• Mixing is allowed. Business Premium can be combined with Azure, Dynamics 365, Enterprise Mobility + Security and Office 365 plans and add-ons, and you don't have to give everyone the same suite. Microsoft notes that Business Premium's security and management benefits only apply to users with devices managed under a Business Premium subscription.
• Compare bundles, not line items. At list price, E3 plus the Defender Suite is $51 against $60 for E5, but E5 also includes premium eDiscovery, Teams Phone, Audio Conferencing and Security Copilot capacity. Price the add-ons you would otherwise buy.

When you assign the chosen plans, group-based licensing keeps the assignments consistent and makes a later move between plans a group membership change.

Prerequisites for checking your tenant

• Microsoft Graph PowerShell and an account that can read subscriptions (Organization.Read.All).
• Access to Message center in the Microsoft 365 admin center, where Microsoft posts the 30-day notices for packaging changes.

Verify what your tenant actually has

Packaging changes arrive as new service plans inside your existing SKUs. List each subscription with its consumption and the plans inside it:

Connect-MgGraph -Scopes 'Organization.Read.All'
 
Get-MgSubscribedSku -All | ForEach-Object {
    [pscustomobject]@{
        Sku      = $_.SkuPartNumber
        Enabled  = $_.PrepaidUnits.Enabled
        Consumed = $_.ConsumedUnits
        Plans    = ($_.ServicePlans.ServicePlanName | Sort-Object) -join ', '
    }
} | Format-List

To see new plans that Microsoft has added but not yet activated, filter on the provisioning status. Microsoft documents PendingProvisioning as "Microsoft has added a new service to the product SKU and it isn't activated in the tenant", and PendingActivation as provisioned but requiring explicit admin activation:

Get-MgSubscribedSku -All | ForEach-Object {
    $sku = $_.SkuPartNumber
    $_.ServicePlans |
        Where-Object ProvisioningStatus -in 'PendingProvisioning','PendingActivation' |
        Select-Object @{n='Sku';e={$sku}}, ServicePlanName, ProvisioningStatus
}

In the Defender portal, confirm the Defender for Office 365 level with the Real-time detections versus Explorer check described above.

Troubleshooting common licensing surprises

E3 tenant doesn't show Defender for Office 365 features yet. The rollout is staged and announced through Message center. Check whether the plan is present in the SKU and its provisioning status before you open a support case.

Business Premium tenant still shows the Defender for Business experience after buying Plan 2 for some users. Microsoft states that Defender for Business doesn't support mixed licensing. A tenant with Defender for Business and Defender for Endpoint Plan 2 defaults to the Defender for Business experience. To switch, license all users for Plan 2 (standalone or through the Defender Suite) and ask Microsoft Support to switch the organization.

Users get no Teams client after a plan change. You bought a no-Teams suite. Assign a Teams Enterprise licence or switch to the with-Teams version at renewal.

Business seats refused above 300. This is the Business family cap. Move the extra users, or all users, to enterprise plans.

Summary checklist

• Seat count checked against the 300-seat Business family cap.
• Required controls mapped: P1 or P2, Defender for Office Plan 1 or 2, Defender for Endpoint Plan 1 or 2, Defender for Identity, eDiscovery premium, Teams Phone.
• Add-ons now included in E3 or E5 (Intune Plan 2, Remote Help, Defender for Office Plan 1) removed from the renewal.
• With-Teams versus no-Teams decision made per plan.
• Service plans verified in the tenant with Get-MgSubscribedSku after Message center notices arrive.

References

• Microsoft 365 Pricing and Packaging Updates
• Microsoft 365 Packaging and Pricing Updates Public FAQ
• Microsoft 365 Business Premium frequently asked questions
• Microsoft 365 Business Premium security FAQ
• Microsoft 365 for business security overview
• Microsoft Entra licensing
• Microsoft Defender service description
• Why do I need Microsoft Defender for Office 365?
• Microsoft Intune licensing plans and options
• Exchange Online limits
• Learn about eDiscovery
• Teams Phone licensing
• Microsoft Teams add-on licenses
• servicePlanInfo resource type