Microsoft 365 E5 eDiscovery and Audit [New Commerce Experience]
Microsoft 365 E5 eDiscovery and Audit
An E5 compliance component add-on covering legal discovery and auditing. One fact decides the quantity on the order, and it is the opposite of what most quotes assume. Microsoft states that to analyse a user's data when premium eDiscovery features are enabled, that user must hold Office 365 or Microsoft 365 E5, or a Purview Suite or eDiscovery and Audit add-on licence on an Office 365 E1, Office 365 E3 or Microsoft 365 E3 base. It then states that administrators, compliance officers and legal personnel assigned to cases as members, who use premium features to collect, view and analyse data, do not need an E5 licence. The quantity follows the people whose data is examined, not the people examining it.
What it is
One of the Microsoft 365 E5 compliance component add-ons, beside Information Protection and Governance and Insider Risk Management, with the full set sold as the Microsoft Purview Suite.
Who it is for
Tenants facing litigation, a regulatory request or an internal investigation that do not need the rest of an E5 upgrade. Microsoft names Office 365 E1, Office 365 E3 and Microsoft 365 E3 as bases onto which this add-on can be assigned, so an E1 organisation does not have to move to E3 first.
Who actually needs a licence
This is the sizing rule and it is worth quoting closely.
To analyse a user's data when premium eDiscovery features are enabled, that user must be assigned Office 365 or Microsoft 365 E5, or the Purview Suite or this add-on on a qualifying base. Microsoft then states that administrators, compliance officers and legal personnel assigned to cases as members, who use premium features to collect, view and analyse data, do not need an E5 licence.
So the number follows the custodian and data owner set. A quote sized on the legal team is sized on the wrong population, in the direction that under counts.
Standard and premium are tiers, not two products
Microsoft retired the classic eDiscovery experiences, including classic Content Search, classic eDiscovery Standard and classic eDiscovery Premium, on 31 August 2025. What exists now is one eDiscovery solution in the Microsoft Purview portal in which premium features are enabled, and a case records which tier applies. Treat "standard" and "premium" as licence tiers of one product rather than as separate tools, and verify any specific premium capability in the current portal before writing it into a scope document.
The audit half is narrower than the name suggests
Audit standard is already there. Microsoft lists it under Microsoft 365 E3, A3, A1, G3, F3 and F1, under Office 365 E3 and E1 and their equivalents, and under Microsoft 365 Business Basic, Standard and Premium.
This add-on buys Audit premium, documented as up to one year of retention of audit logs for user and admin activity, custom audit log retention policies, and access to crucial events for investigations.
Ten year retention is not in it. Microsoft states that ten year retention of audit logs applies only to users with the appropriate add-on licence, which is a separate purchase.
A hold carries its own licence requirement
Microsoft states that placing a shared mailbox on hold through Purview eDiscovery is subject to the same requirement as a hold placed directly in Exchange Online: Exchange Online Plan 2, or Exchange Online Plan 1 with the Exchange Online Archiving add-on. The eDiscovery licence does not replace it.
The neighbouring choice
The Microsoft Purview Suite spans much more than this area, including data lifecycle and records management, data loss prevention, communication compliance and Compliance Manager. Where more than one compliance area is in scope, price the suite first.
Who has to be licensed, the legal team or the custodians?
The custodians. Microsoft states that to analyse a user's data when premium eDiscovery features are enabled, that user must hold an E5 licence or this add-on on a qualifying base, and that administrators, compliance officers and legal personnel assigned to a case do not need an E5 licence.
Can we add it to Office 365 E1?
Yes. Microsoft names Office 365 E1, Office 365 E3 and Microsoft 365 E3 as bases onto which a Purview Suite or eDiscovery and Audit add-on licence can be assigned.
Does an E3 tenant have no auditing at all?
It has Audit standard, which Microsoft lists under Microsoft 365 E3, Office 365 E3 and E1, and Microsoft 365 Business Basic, Standard and Premium. This add-on buys Audit premium on top of it.
How long are audit logs kept?
Audit premium provides up to one year of retention for users with the appropriate licence. Microsoft states that ten year retention applies only to users holding a further add-on licence, which is not this one.
Does it let us put a shared mailbox on hold?
Not by itself. Microsoft states that placing a shared mailbox on hold through eDiscovery carries the same licensing requirement as a hold placed directly in Exchange Online, being Exchange Online Plan 2, or Exchange Online Plan 1 with the Exchange Online Archiving add-on.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 1-Year, Monthly
- Unit price
- €4.90 /mo
- SKU
- MST-NCE-107-C100
Term or edition paths Microsoft allows this subscription to move to.
Attachable SKUs from the same category. Check each add-on's prerequisites for base-licence eligibility.
- 1You prepay through ITSailor (Malta). VAT handled, reverse-charge for valid EU VAT IDs.
- 2We provision through Pax8 wholesale into your Microsoft tenant, with no third-party MSP markup.
- 3You keep the tenant. Sovereign by default: every engagement closes with an Exit Kit.
Pax8 wholesale, margin in the price
Microsoft Defender Vulnerability Management Add-on (Education Student Pricing) [New Commerce Experience]
Microsoft Defender Vulnerability Management add-on is available to Defender for Endpoint Plan 2 customers to access continuous asset visibility, in-depth vulnerability assessments, and risk-based prioritization to help teams address critical vulnerabilities and misconfigurations.
Microsoft Entra ID P1 (Education Student Pricing) [New Commerce Experience]
Microsoft Entra ID P1 provides single sign-on to thousands of cloud (SaaS) apps and access to web apps you run on-premises. Built for ease of use, Microsoft Entra ID P1 features multi-factor authentication (MFA); access control based on device health, user location, and identity; and holistic security reports, audits,
Microsoft Entra ID P2 (Education Student Pricing) [New Commerce Experience]
Microsoft Entra ID P2 includes all the capabilities of P1 plus advanced identity protection features such as Identity Protection, which helps detect potential vulnerabilities affecting your organization’s identities, and Privileged Identity Management, which helps manage, control, and monitor access within your organiz
Microsoft Defender Vulnerability Management (Education Student Pricing) [New Commerce Experience]
Microsoft Defender Vulnerability Management standalone is a comprehensive vulnerability management solution to access continuous asset visibility, in-depth vulnerability assessments, and risk-based prioritization to help teams address critical vulnerabilities and misconfigurations.