Microsoft 365 E5: what it adds over E3

What it is

Microsoft 365 E5 is the full enterprise plan. It contains everything in E3 and replaces each foundational security component with its complete version, then adds the compliance products E3 does not have at all.

Who it is for

Organisations that need to detect and investigate, not only prevent: those with a security team or a managed provider acting on the telemetry, and those under regulatory obligations that require insider risk controls, long audit retention or defensible eDiscovery.

Key capabilities

• Everything in Microsoft 365 E3
• Microsoft Entra ID P2: Privileged Identity Management, Identity Protection, risk-based Conditional Access, access reviews, entitlement management
• Microsoft Defender for Endpoint Plan 2: endpoint detection and response, automated investigation and remediation, threat and vulnerability management, advanced hunting across six months of data
• Microsoft Defender for Office 365 Plan 2
• Microsoft Intune Plan 1 and Plan 2
• Advanced Microsoft Purview: Insider Risk Management, Communication Compliance, Advanced Audit with up to ten year retention, eDiscovery that can search and delete, automatic retention labels
• Microsoft Defender XDR across identity, endpoint, email and cloud apps

How to judge the step up from E3

The honest test is whether anyone will act on what E5 produces. Endpoint detection and response, Identity Protection and Insider Risk Management all generate signals that need a person or a service to triage them. An organisation with nobody in that role buys capability it will not use. An organisation under DORA or NIS2 obligations, or one that must produce evidence to a regulator or a customer, usually finds the compliance half alone justifies the difference.

Requirements

No user minimum or maximum. Microsoft 365 Copilot is an add-on to E5, not part of it; it is bundled only in Microsoft 365 E7.