Microsoft 365 enterprise plans: how to match E3, E5 and F3 to the work people do.

Choose Microsoft 365 plans by persona before the renewal. Put each worker type on E5, E3 or F3 according to what they use, because an all E5 default and an all E3 default both overpay in different ways.

What do Microsoft 365 E3, E5 and F3 actually differ on?

E3 and E5 share the same productivity core: Office desktop apps, Exchange, SharePoint, OneDrive and Teams. What separates them is security depth, compliance tooling, analytics and telephony. So the E3 versus E5 choice belongs with your security architects as much as with procurement.

F3 sits apart as a frontline plan with web and mobile apps and a capped mailbox, priced for workers who never sit at a desk. Current list prices sit on the Microsoft 365 enterprise pricing page, and they changed on July 1, 2026.

The gap between E3 and E5 is $21 per user per month, or $252 per user per year at list. F3 costs roughly a quarter of E3. Those two numbers drive most of what follows.

Which capabilities separate the plans?

• Security. E5 adds the full Microsoft Defender suite, richer identity protection through Entra ID P2, and cloud app security through Defender for Cloud Apps.
• Compliance. E5 carries eDiscovery (Premium), Insider Risk Management and the higher information protection tiers that regulated industries actually use.
• Analytics and voice. Power BI Pro and Teams Phone sit in E5. On E3 they are paid add ons, at $14 and $10 per user per month respectively.
• Usage rights. The fine print lives in the Microsoft licensing terms, including the F3 scope limits.

What changed in the July 2026 packaging update?

Microsoft paired the price rise with new content, rolling out through summer 2026. E3 gains Defender for Office 365 Plan 1, Intune Plan 2, Intune Remote Help and Intune Advanced Analytics. E5 gains Security Copilot, Intune Endpoint Privilege Management, Microsoft Cloud PKI and Intune Enterprise Application Management.

If you bought Defender for Office 365 Plan 1 or Intune add ons for E3 users, those lines may now duplicate the suite; our guide to duplicate Microsoft 365 add on costs covers the cleanup. Time any cancellation to when the new features actually reach your tenant, not to the price change date.

Which three questions sort the directory?

Ask which workers handle regulated data, which need advanced threat protection, and which never open a desktop app. Those three questions sort most of the directory into personas before you look at a single price.

What have we seen in recent Microsoft 365 license reviews?

Morten Andersen ran roughly 20 to 30 Microsoft 365 license reviews between 2024 and 2025. In nearly every one, fixing the plan mix saved more than pushing for a deeper discount. Three patterns came up again and again.

None of these show up in a discount benchmark. They appear only when you compare license assignments with what each user did in the tenant over a quarter.

When does Microsoft 365 E5 pay for itself?

E5 pays for itself when the security and compliance stack it includes retires third party spend of comparable value. Without that offset, the uplift is premium with no return. The test is mechanical: list the tools E5 would replace, price their renewals, and compare the total with the uplift for the users concerned.

Why price the E3 plus add on path for every persona?

E3 plus a single add on, such as E5 Security or Power BI Pro, frequently beats full E5 for a persona that needs exactly one premium capability. Few buyers price this path persona by persona, and the answer differs by organization.

Microsoft now sells E5 Security as the Microsoft Defender Suite and E5 Compliance as the Microsoft Purview Suite, each at $12 per user per month on top of E3.

The crossover is at two premium needs. Once a persona needs both security and compliance, E5 is cheaper and also brings Power BI Pro and Teams Phone. Run the same table at your quoted prices, because add ons and suites are not always discounted at the same rate in an EA quote.

How do you run the third party retirement test?

If the displaced tools keep running, the E5 case has no savings to count. Tie the E5 uplift to named tool retirements with renewal dates, or buy the add on instead.

1. List every security and compliance product you pay for today: endpoint detection, email security, cloud access security broker, eDiscovery, data loss prevention, archiving.
2. Mark each one E5 could replace, with its renewal date and annual cost.
3. Multiply the uplift by the users who would move. Say 1,000 users go from E3 to E5: $21 times 1,000 times 12 is $252,000 a year at list.
4. Compare. If the tools E5 replaces renew at a combined $180,000 a year, the uplift costs $72,000 more than it saves, before any migration effort.
5. Get the security team to sign off on the retirement dates before the EA is signed.

How much does a mixed E3, E5 and F3 plan save?

A persona mapped mix of E5, E3, add ons and F3 typically lands 20 to 30 percent below the all E5 default, because every license matches a consumption profile instead of a worst case. The mix also strengthens the EA negotiation, since Microsoft discounts deepest when E5 count grows from a defended baseline.

The mix costs $2,684,400 a year against $3,600,000 for all E5. That is $915,600 a year, about 25 percent, before any negotiated discount.

An all E3 default overpays in other places. The same 400 frontline staff on E3 cost $11,600 a month more than on F3, or $139,200 a year. And if the 1,500 regulated users each need both the Defender and Purview Suites, they cost $63 a month on E3 instead of $60 on E5, another $54,000 a year.

Why we reject blanket E5 for simplicity

The standard advice, often sponsored by the seller, is that all E5 simplifies management and the security value justifies the blanket uplift. We disagree. In our reviews, users with no E5 exclusive activity made up a large share of every all E5 directory, and the displaced security tools were still running.

Map personas and price the add on path per segment instead. Keep E5 for the groups whose usage data shows they need it.

Simplicity is worth something. Managing three plans instead of one adds group based licensing rules in Entra ID and a quarterly review. In the 5,000 user example above, though, that simplicity costs $915,600 a year at list, far more than the administration it saves.

Microsoft sells E5 as a security decision. Make it one: if the third party tools it displaces are not retired, you did not buy security, you bought duplication.

Which workers qualify for Microsoft 365 F3?

F3 fits workers who are on the go, mostly on mobile or shared devices, and who work directly with customers or the public. Microsoft contrasts them with information workers, who typically work at a desk. The plan limits define the persona more precisely than any job title.

• No desktop apps. F3 users get Word, Excel and PowerPoint on the web with full editing, and the mobile apps on devices with integrated screens smaller than 10.9 inches.
• A 2 GB mailbox. Accessed through Outlook on the web, with no archive mailbox and no delegate access.
• 2 GB of OneDrive. Against 1 TB or more on E3 and E5.

F1 at $3 is cheaper again, but it gives read only access to Office documents and no mailbox rights. It suits staff who only consume schedules and announcements. Our F1 versus F3 guide and F3 versus E3 comparison work through the edge cases.

How do you check who fits each plan in your own tenant?

The data is already in your admin portals. Pull a full quarter so seasonal and shift work shows up.

• Microsoft 365 admin center, Billing, Licenses. Purchased against assigned counts for every SKU and add on.
• Reports, Usage, Microsoft 365 Apps usage. Which users ran desktop apps and which only used web or mobile. The second group is your F3 shortlist.
• Reports, Usage, Mailbox usage. Storage used per mailbox. Users near or above 2 GB need a plan for archiving before any move to F3.
• Microsoft Purview portal. Who is in scope of eDiscovery (Premium) cases, Insider Risk Management policies and automatic labeling. That list is your regulated persona.
• Microsoft Defender portal. Devices onboarded to Defender for Endpoint and apps connected to Defender for Cloud Apps.
• Teams admin center. Users with phone numbers assigned, which shows who actually uses Teams Phone.

How should the plan mix shape the EA negotiation?

Settle the plan mix before the EA negotiation starts, then negotiate price on that mix. Microsoft discounts deepest when E5 count grows, so with a tested persona map you can trade planned E5 growth for price instead of handing it over as a default.

What will the Microsoft account team say?

• "E5 gives you Defender, Purview, Power BI and Teams Phone for $21 more." Reply that the $21 has value only for users who consume those tools, and show the per persona usage data.
• "The E5 promotion only applies if you move the whole company." Ask for the promotional price on the E5 count you have defined, plus written step up pricing at the same discount for later additions.
• "F3 users cannot do information work, so you risk compliance." Agree the definition matters. Share your persona criteria and ask Microsoft to confirm F3 eligibility in writing before signature.
• "Security Copilot in E5 widens the value gap." Ask what your security operations team would use it for in year one. If there is no answer, it does not change the per user comparison.

Which contract terms should you ask for?

• Step up pricing. E3 to E5 step ups priced at the same discount as your original E5 lines for the full term, so growth later does not cost list.
• Add on price holds. Fixed prices for Defender Suite, Purview Suite, Power BI Pro and Teams Phone for the term, since your mix depends on them.
• Anniversary rebalancing. The right to move users between E5, E3 and F3 at each anniversary within an agreed total value, so role drift does not lock in the wrong plans.
• Promotion duration. Any promotional price written in for the full three year term.
• F3 eligibility confirmation. The persona definition you used, acknowledged by Microsoft, to avoid a dispute at the next review.

For the wider Microsoft picture, start with the Microsoft knowledge hub or our Microsoft advisory practice. For an always on review lane across all your vendors, see Vendor Shield.

What to do next

1. Pull the data. Export license assignment and capability usage from the admin center for the trailing quarter.
2. Build the persona map. Regulated handlers, knowledge workers, security sensitive roles and frontline.
3. Price the add on path. E3 plus add ons against full E5 per persona, at your discount levels.
4. Find F3 candidates. Identify frontline populations contractually eligible for F3 and model the change.
5. Tie E5 to retirements. Link any E5 expansion to named third party tool retirements with renewal dates.
6. Take the mix into the EA. Bring the tested plan mix into the EA negotiation calendar.
7. Repeat every year. Re run the persona map annually, because roles drift and the mix decays.

Frequently asked questions