Check what you already own before you buy
Pick the plan you hold, or name the add-on you are about to buy. Each of 28 add-ons gets a verdict and the Microsoft page it comes from.
Before you start
Of 28 add-ons checked, 7 you already hold, 2 are partly redundant, 1 is not recommended here, 4 cannot be used, 2 not settled by the documentation, and 12 would add something.
Example: Microsoft 365 E3, Teams not sure, domain controllers not sure. Change the answers to see yours.
AssertedRules checked against Microsoft documentation on 18 October 2026.
A copied link holds your answers in its address, so share it as you would share the plan names.
A duplicate you already hold: on a new commerce subscription, Microsoft allows a licence count to be decreased only within seven days of the licences being added, otherwise at the next renewal window. Check the terms of your own agreement. Manage customer subscriptions, Partner Center
Exchange Online Archiving
Already includedMicrosoft 365 E3 already includes archiving and does not need this add-on.
Exchange Online Protection standalone (built-in security add-on for on-premises mailboxes)
Already includedExchange Online Protection is already included in every Microsoft 365 organisation with Exchange Online mailboxes. The standalone subscription is for on-premises mail.
Microsoft Defender for Endpoint Plan 1
Already includedMicrosoft 365 E3 includes Defender for Endpoint Plan 1.
Microsoft Defender for Office 365 Plan 1
Already includedFrom the July 2026 packaging update (rolled out June to August 2026), Microsoft 365 E3 includes Defender for Office 365 Plan 1.
Microsoft Entra ID P1
Already includedMicrosoft 365 E3 includes Microsoft Entra ID P1.
Microsoft Intune Plan 1
Already includedMicrosoft 365 E3 includes Microsoft Intune Plan 1.
Microsoft Intune Plan 2
Already includedFrom the July 2026 packaging update (rolled out June to August 2026), Microsoft 365 E3 includes Intune Plan 2, Remote Help and Advanced Analytics.
Partly redundant (2)
Microsoft Defender for Cloud Apps
Partly redundantMicrosoft 365 E3 already includes Cloud App Discovery, the discovery subset of Defender for Cloud Apps. Microsoft's comparison lists anomaly detection, cross-SaaS data loss prevention, OAuth app permission control, policy enforcement and a SIEM connector as the full product only, so the question is whether you need those.
Microsoft Intune Suite
Partly redundantFrom the July 2026 packaging update (rolled out June to August 2026), Microsoft 365 E3 already includes Intune Plan 2, Remote Help and Advanced Analytics. What the Suite still adds here is Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise Application Management, which Microsoft names as what E5 and E7 carry on top of E3.
Not recommended (1)
Microsoft Defender for Business
Not recommendedMicrosoft's Defender for Business FAQ says it does not support a mix of endpoint security subscriptions, and points a tenant that outgrows it to a plan that includes Defender for Endpoint for all users. Microsoft 365 E3 already holds Defender for Endpoint Plan 1, so step up with Defender for Endpoint Plan 2 or the Microsoft Defender Suite instead.
Cannot be used (4)
Microsoft Copilot Business
Cannot be usedCopilot Business is an add-on for Microsoft 365 for business plans, and Microsoft 365 E3 is not one. Microsoft lists Microsoft 365 E3 as a qualifying plan for the Microsoft Copilot add-on instead.
Microsoft Defender Vulnerability Management add-on
Cannot be usedThe add-on needs Defender for Endpoint Plan 2, or a plan that includes it, and Microsoft 365 E3 does not carry it. Customers without Plan 2 use the standalone Defender Vulnerability Management subscription instead.
Not settled by the documentation (2)
Microsoft Defender for Identity
Not settled by the documentationThe answer depends on whether you run on-premises domain controllers. Sensors install on domain controllers, and on AD FS, AD CS and Microsoft Entra Connect servers. Settle that before ordering.
Microsoft Teams EEA (standalone)
Not settled by the documentationWhether your edition bundles Teams settles this, and the plan name alone does not say. On Billing, Licenses in the Microsoft 365 admin center, a product name ending in (no Teams) means Teams is not bundled.
What changed in July 2026
- Microsoft 365 E3 gained Defender for Office 365 Plan 1, Intune Plan 2, Remote Help and Advanced Analytics. E5 gained Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise Application Management on top. Office 365 E3 gained Defender for Office 365 Plan 1. Microsoft licensing news, 16 February 2026
- Microsoft 365 E7 carries the same Intune additions as E5: everything in E3, plus Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise Application Management. Intune planning guide
- Business Basic, Business Standard and Office 365 E1 gained URL time-of-click protection. Microsoft 365 E5 also gained Microsoft Security Copilot, which this tool does not check. Microsoft licensing news, 16 February 2026
- The rollout began in June 2026 and was due to finish by 1 August 2026, with 30 days of notice in the Message Center, so a tenant can sit on either side of the change. Microsoft licensing news, 16 February 2026
Also reflected in the rules
- Since 1 November 2025 the Microsoft 365 and Office 365 enterprise suites with Teams are sold again, next to the (no Teams) suites. Partner Center, November 2025
- Microsoft 365 E7 became available on 1 May 2026. It bundles E5, Copilot and Agent 365 and includes the Entra Suite. Partner Center, May 2026
- Copilot Business is the Microsoft Copilot add-on for Business plans: the same capabilities, up to 300 seats per tenant. Microsoft Copilot Business FAQ
Your answers are worked out in this browser and are not sent anywhere. A copied link carries them in its address.
I resell Microsoft licences through Pax8 as a CSP indirect reseller, so I can earn margin on licences. This check does not depend on that: every verdict comes from Microsoft documentation, linked beside it. On licences bought through me the margin comes from the wholesale discount, as stated on the Cloud Licensing page.
The rule base starts from three questions about each add-on: what do the plans above it already include, what does it need to work at all, and where does its ceiling sit. Those three facts decide whether a purchase is a duplicate.
Every verdict links to the Microsoft page its rule was read from. The "What this product actually covers" links go to ITSailor marketplace pages.
Where Microsoft has not published enough to decide, the result says so.
AssertedThe verdicts are asserted: I read Microsoft's documentation and say so. I have not run your licences in your tenant.
- How is this different from a Microsoft 365 plan comparison table?
- A comparison table starts from a plan you might buy and lists what it contains. This tool starts from the plan you already hold and checks the add-on in front of you against it. Pick the plan, or name the add-on, and read the verdict with the Microsoft page it comes from.
- Where do the rules come from?
- Every rule cites a first-party Microsoft page, linked next to each result. Where ITSailor has written a marketplace product page that documents the same boundary in prose, the result links to it too.
- What do the verdicts mean?
- Already included: the plan holds it, so buying it is a duplicate. Partly redundant: part of the add-on is already in the plan and the rest is new. Not recommended: it can work, but it is the wrong product for this estate, for example because Microsoft does not support mixing the licences. Cannot be used: a prerequisite is missing. Would add something: it is not in the plan.
- What does "not settled by the documentation" mean?
- That Microsoft has not published something clear enough for the pair you asked about. Rather than guess in either direction, the tool says so and tells you to confirm against your own licence assignment before ordering.
- Why does it never show a price or a saving?
- It has never seen your tenant. A saving figure would be a claim about an estate this code cannot observe, so the tool reports inclusion, prerequisites and applicability only, and leaves the arithmetic to you.
- Does anything leave my browser?
- Your answers are worked out in this browser and are not sent anywhere. A copied link carries them in its address. It asks for no email address and stores nothing. Opening a copied link sends its address to this site like any page request, so share it the way you would share the plan names.
- How current are the rules?
- The date of the last check is shown under the result. Microsoft changed the E3 and E5 packaging in July 2026, and the page lists what changed. Licensing moves often, so confirm a verdict on your own licence page before you order.