Everyone Is on E5 — and Nobody Has the Time to Question It

The Microsoft license catalog covers more than a hundred SKUs plus add-ons. Modeling the right SKU per user — across hundreds of seats, often spread over several CSP providers — is operationally impossible by hand. So most mid-market tenants default to a blanket assignment, typically E5, and quietly overpay. The suspicion that not everyone needs E5 is widespread. The evidence is missing.

This is not laziness. Optimization hinges on two questions: which features does each user actually need, and which SKU combination is cheapest for that profile? Manually reconciling both takes weeks across CSP portals, M365 usage reports, and feature matrices. On top of that, an outdated belief still holds: full security only comes with E5. It stopped being true a while ago. The Microsoft Defender Suite (formerly Microsoft 365 E5 Security) and the Microsoft Purview Suite (formerly Microsoft 365 E5 Compliance) sit as add-ons on top of E3 — and, capped at 300 seats, on top of Business Premium — with comparable coverage for the controls you actually use.

And the arithmetic moved. On 1 July 2026 Microsoft shifted capabilities into the suites themselves — E3 now carries Defender for Office 365 Plan 1, Intune Plan 2, Remote Help, and Advanced Analytics; E5 adds Endpoint Privilege Management, Microsoft Cloud PKI, and Enterprise App Management — and raised suite prices across every purchasing channel. Every "E3 plus add-on beats E5" calculation made before that date now double-counts capabilities you already own inside the suite. The model has to be re-run. Not inherited.

Traditional consulting for a license review? Six weeks, five figures. The model leaves with the consultant. The next price change or user wave, and you are back at "E5 for everyone."