Microsoft 365 E5 Information Protection and Governance [New Commerce Experience]
Microsoft 365 E5 Information Protection and Governance
An E5 compliance component add-on, alongside Insider Risk Management and eDiscovery and Audit, covering the information protection and data governance area of Microsoft Purview. Check what the tenant already holds before ordering it. Microsoft lists manual sensitivity labelling under Microsoft 365 E5, E3, F1, F3 and Business Premium, Office 365 E5 and E3, Enterprise Mobility plus Security E3 and E5, OneDrive for Business Plan 2, and Azure Information Protection Plan 1 and Plan 2. It lists retention policies and retention label creation under Microsoft 365 E3 and Office 365 E3. An E3 tenant already labels and already retains. What this add-on buys is the automatic half of both, and that is a narrower purchase than the product name suggests.
What it is
One of the Microsoft 365 E5 compliance component add-ons, sitting beside Insider Risk Management and eDiscovery and Audit. The full set is sold together as the Microsoft Purview Suite, formerly Microsoft 365 E5 Compliance. Microsoft's Purview service description lists this add-on beside Microsoft 365 E5 and the Purview Suite as a licence granting the same rights in this area.
Who it is for
Tenants that need E5 level data protection and retention and do not need the identity, endpoint and threat protection a full E5 upgrade carries. This page is written against an E3 base, which is the case Microsoft's own licensing tables illustrate. Confirm the qualifying base entitlement for this specific add-on in Product Terms before ordering. Licensing details here were checked on 2026-08-05; these tables move.
What the tenant probably already has
Two capabilities are commonly assumed to arrive with this add-on and usually do not.
Manual sensitivity labelling is listed under Microsoft 365 E5, A5, G5, E3, A3, G3, F1, F3 and Business Premium, under Office 365 E5, A5, E3 and A3, under Enterprise Mobility plus Security E3 and E5, under OneDrive for Business Plan 2, and under Azure Information Protection Plan 1 and Plan 2.
Retention policies and retention label creation are listed under Microsoft 365 E5, E3 and Business Premium and under Office 365 E5 and E3.
If the requirement is "let people apply a label by hand" or "keep everything in this site for seven years", the tenant can very probably do it today.
What the add-on adds
- Client side and service side automatic sensitivity labelling, and dynamic watermarking
- Endpoint data loss prevention
- Data loss prevention for Microsoft Teams
- Data loss prevention that restricts Microsoft 365 Copilot from processing files and emails
- Data Lifecycle Management and Records Management, including file plan and adaptive policy scopes
- Advanced Message Encryption and Double Key Encryption
Two capabilities that carry a further cost
Browser and network data loss prevention are metered. Microsoft lists data loss prevention for cloud apps in the Edge for Business browser and for cloud apps reached over the network among its pay as you go capabilities, billed per request against an Azure subscription the tenant must be associated with. The licence is the entitlement; the usage is a separate bill. Microsoft still labels Network Data Security as preview. A quote built on the licence alone omits these charges.
Customer Key is a tenant wide purchase, not a per user one. Microsoft lists this add-on among the licences granting Customer Key, and separately states that because data encryption policies apply at tenant level, the tenant must hold at least as many Customer Key licences as it has users assigned Exchange or Teams licences, whichever is greater. So the entitlement exists but cannot be bought for a subset of people, which is the opposite of how the rest of this add-on is scoped.
The Copilot retention correction
It is easy to assume this add-on is required to retain Microsoft 365 Copilot interactions. It is not. Microsoft lists three qualifying combinations for that, and the first contains no Purview add-on at all: Microsoft 365 E3 or E5 with Microsoft 365 Copilot. The other two are E3 with the Purview Suite and Copilot, and E3 with this add-on and Copilot.
Where this add-on genuinely matters for Copilot is narrower: Microsoft lists it as a qualifying licence for using adaptive policy scopes to target Copilot interaction retention at specific users, and for retaining the exact version of a document shared in a Copilot interaction.
The neighbouring choice
The Microsoft Purview Suite spans considerably more than this area: data lifecycle and records management, data loss prevention across Exchange, SharePoint, OneDrive, Teams, endpoint, browser and network, communication compliance, Customer Key, Customer Lockbox, data connectors and Compliance Manager. If more than one compliance area is in scope, price the suite before buying components.
Does an E3 tenant need this to apply sensitivity labels?
No. Microsoft lists manual sensitivity labelling under Microsoft 365 E3 and Business Premium, Office 365 E3, Enterprise Mobility plus Security E3, OneDrive for Business Plan 2 and Azure Information Protection Plan 1. What this add-on adds is automatic labelling, applied by the client and by the service, plus dynamic watermarking.
Does it include retention policies?
Retention policies and retention label creation are already listed under Microsoft 365 E3 and Office 365 E3. The add-on grants the parts E3 does not carry, including adaptive policy scopes, labels applied automatically by trainable classifiers, and records management.
Is browser and network data loss prevention included in the licence?
Not as a flat entitlement. Microsoft lists data loss prevention for cloud apps in the Edge for Business browser and for cloud apps over the network among its pay as you go capabilities, billed per request against a linked Azure subscription. Microsoft also still labels Network Data Security as preview.
Do we need this to retain Microsoft 365 Copilot interactions?
No. Microsoft lists Microsoft 365 E3 or E5 with Microsoft 365 Copilot as a qualifying combination on its own. This add-on is listed for the narrower case of targeting Copilot retention with adaptive policy scopes and retaining the exact version of a document shared in a Copilot interaction.
How does it compare with the Microsoft Purview Suite?
The suite is much wider: data lifecycle and records management, data loss prevention across Exchange, SharePoint, OneDrive, Teams, endpoint, browser and network, communication compliance, Customer Key, Customer Lockbox, data connectors and Compliance Manager. Where two or more areas are in scope, price the suite first.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- Monthly, 1-Year
- Unit price
- €5.70 /mo
- SKU
- MST-NCE-108-C100
Term or edition paths Microsoft allows this subscription to move to.
Attachable SKUs from the same category. Check each add-on's prerequisites for base-licence eligibility.
- 1You prepay through ITSailor (Malta). VAT handled, reverse-charge for valid EU VAT IDs.
- 2We provision through Pax8 wholesale into your Microsoft tenant, with no third-party MSP markup.
- 3You keep the tenant. Sovereign by default: every engagement closes with an Exit Kit.
Pax8 wholesale, margin in the price
Microsoft Defender Vulnerability Management Add-on (Education Student Pricing) [New Commerce Experience]
Microsoft Defender Vulnerability Management add-on is available to Defender for Endpoint Plan 2 customers to access continuous asset visibility, in-depth vulnerability assessments, and risk-based prioritization to help teams address critical vulnerabilities and misconfigurations.
Microsoft Entra ID P1 (Education Student Pricing) [New Commerce Experience]
Microsoft Entra ID P1 provides single sign-on to thousands of cloud (SaaS) apps and access to web apps you run on-premises. Built for ease of use, Microsoft Entra ID P1 features multi-factor authentication (MFA); access control based on device health, user location, and identity; and holistic security reports, audits,
Microsoft Entra ID P2 (Education Student Pricing) [New Commerce Experience]
Microsoft Entra ID P2 includes all the capabilities of P1 plus advanced identity protection features such as Identity Protection, which helps detect potential vulnerabilities affecting your organization’s identities, and Privileged Identity Management, which helps manage, control, and monitor access within your organiz
Microsoft Defender Vulnerability Management (Education Student Pricing) [New Commerce Experience]
Microsoft Defender Vulnerability Management standalone is a comprehensive vulnerability management solution to access continuous asset visibility, in-depth vulnerability assessments, and risk-based prioritization to help teams address critical vulnerabilities and misconfigurations.