E5 eDiscovery and Audit: who needs the licence
Microsoft 365 E5 eDiscovery and Audit
per user per month, excluding VAT
Ask a questionNo markup on top of Pax8's suggested retail. My margin is the Pax8 wholesale discount.
Check whether your current plan already includes this: Licence Overlap Check, free, and nothing leaves your browser.
An E5 compliance component add-on covering legal discovery and auditing. One fact decides the quantity on the order, and it is the opposite of what most quotes assume. Microsoft states that to analyse a user's data when premium eDiscovery features are enabled, that user must hold Office 365 or Microsoft 365 E5, or a Purview Suite or eDiscovery and Audit add-on licence on an Office 365 E1, Office 365 E3 or Microsoft 365 E3 base. It then states that administrators, compliance officers and legal personnel assigned to cases as members, who use premium features to collect, view and analyse data, do not need an E5 licence. The quantity follows the people whose data is examined, not the people examining it.
What it is
One of the Microsoft 365 E5 compliance component add-ons, beside Information Protection and Governance and Insider Risk Management, with the full set sold as the Microsoft Purview Suite.
Who it is for
Tenants facing litigation, a regulatory request or an internal investigation that do not need the rest of an E5 upgrade. Microsoft names Office 365 E1, Office 365 E3 and Microsoft 365 E3 as bases onto which this add-on can be assigned, so an E1 organisation does not have to move to E3 first.
Who actually needs a licence
This is the sizing rule and it is worth quoting closely.
To analyse a user's data when premium eDiscovery features are enabled, that user must be assigned Office 365 or Microsoft 365 E5, or the Purview Suite or this add-on on a qualifying base. Microsoft then states that administrators, compliance officers and legal personnel assigned to cases as members, who use premium features to collect, view and analyse data, do not need an E5 licence.
So the number follows the custodian and data owner set. A quote sized on the legal team is sized on the wrong population, in the direction that under counts.
Standard and premium are tiers, not two products
Microsoft retired the classic eDiscovery experiences, including classic Content Search, classic eDiscovery Standard and classic eDiscovery Premium, on 31 August 2025. What exists now is one eDiscovery solution in the Microsoft Purview portal in which premium features are enabled, and a case records which tier applies. Treat "standard" and "premium" as licence tiers of one product rather than as separate tools, and verify any specific premium capability in the current portal before writing it into a scope document.
The audit half is narrower than the name suggests
Audit standard is already there. Microsoft lists it under Microsoft 365 E3, A3, A1, G3, F3 and F1, under Office 365 E3 and E1 and their equivalents, and under Microsoft 365 Business Basic, Standard and Premium.
This add-on buys Audit premium, documented as up to one year of retention of audit logs for user and admin activity, custom audit log retention policies, and access to crucial events for investigations.
Ten year retention is not in it. Microsoft states that ten year retention of audit logs applies only to users with the appropriate add-on licence, which is a separate purchase.
A hold carries its own licence requirement
Microsoft states that placing a shared mailbox on hold through Purview eDiscovery is subject to the same requirement as a hold placed directly in Exchange Online: Exchange Online Plan 2, or Exchange Online Plan 1 with the Exchange Online Archiving add-on. The eDiscovery licence does not replace it.
The neighbouring choice
The Microsoft Purview Suite spans much more than this area, including data lifecycle and records management, data loss prevention, communication compliance and Compliance Manager. Where more than one compliance area is in scope, price the suite first.
Who has to be licensed, the legal team or the custodians?
The custodians. Microsoft states that to analyse a user's data when premium eDiscovery features are enabled, that user must hold an E5 licence or this add-on on a qualifying base, and that administrators, compliance officers and legal personnel assigned to a case do not need an E5 licence.
Can we add it to Office 365 E1?
Yes. Microsoft names Office 365 E1, Office 365 E3 and Microsoft 365 E3 as bases onto which a Purview Suite or eDiscovery and Audit add-on licence can be assigned.
Does an E3 tenant have no auditing at all?
It has Audit standard, which Microsoft lists under Microsoft 365 E3, Office 365 E3 and E1, and Microsoft 365 Business Basic, Standard and Premium. This add-on buys Audit premium on top of it.
How long are audit logs kept?
Audit premium provides up to one year of retention for users with the appropriate licence. Microsoft states that ten year retention applies only to users holding a further add-on licence, which is not this one.
Does it let us put a shared mailbox on hold?
Not by itself. Microsoft states that placing a shared mailbox on hold through eDiscovery carries the same licensing requirement as a hold placed directly in Exchange Online, being Exchange Online Plan 2, or Exchange Online Plan 1 with the Exchange Online Archiving add-on.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 1-Year, Monthly
- SKU
- MST-NCE-107-C100
- 1You request the licence, or add it to the cart.
- 2I confirm price, term and seats, and check your VAT number in VIES. Businesses in the EU only.
- 3You pay before we provision, under the CSP Marketplace Terms. The invoice comes from Michal Jatczak, a sole trader registered in Malta, trading as ITSailor. Reverse charge for an EU VAT number that validates in VIES.
- 4Your authorised signatory accepts the Microsoft Customer Agreement before activation.
- 5I place the order with Pax8 within one business day of payment.