Microsoft 365 has 30+ enterprise add-ons. Most organisations buy too many of them for too many people. This guide gives you the four things Microsoft's own documentation will not: list price, real EA price, who genuinely needs it, and whether you should buy standalone or upgrade to E5. Covers Copilot, Defender P2, Entra ID P2, Teams Phone, Power Platform, Viva, Intune Suite, and every other material add-on with independent advisory verdicts.
This advisory is part of the Microsoft Licensing Knowledge Hub. For per-user cost benchmarks, see M365 Licensing Cost 2026. For EA negotiation guidance, see EA Negotiation Strategies. For the full FAQ, see Microsoft Licensing FAQ: 50 Questions.
Each add-on entry below includes four data points you will not find together in Microsoft's own documentation: the list price, the achievable EA price (what mid-to-large enterprises actually pay), the prerequisite base licence required, and an independent verdict with specific guidance on who needs it, who does not, and the E3+add-on vs E5 crossover calculation where applicable.
The most expensive Microsoft licence is the one you buy for someone who does not need it. Add-on sprawl is more damaging than headline pricing, because add-ons multiply across thousands of seats before anyone runs the total. This guide is designed to stop that from happening.
Microsoft's fastest-growing and most aggressively marketed add-on category. Copilot alone can increase your M365 bill by 50 to 80% if deployed broadly.
EA price range: $23 to $28/user/month. Prerequisite: M365 E3, E5, Business Standard, or Business Premium. Not included in E5.
AI assistant embedded in Word, Excel, PowerPoint, Outlook, Teams, and OneNote. Drafts content, summarises meetings, analyses spreadsheets, generates presentations from documents, and answers natural-language queries across your Microsoft Graph data.
Who needs it: Executives, legal, marketing, analysts, and project managers who spend 3+ hours daily creating written content, analysing data, or managing email. These roles see 30 to 45 minutes per week productivity gains in early adoption data.
Who does not: Frontline workers, field staff, light email users, and roles that primarily consume content rather than create it. Deploying Copilot to these roles generates minimal measurable ROI.
Pilot 8 to 12% of users for 90 days, measure by role, deploy to roles exceeding break-even ($312/year value at $40/hour = approximately 8 hours saved per year). Negotiate independently from base EA with annual exit rights. At $30 list for 100% of users, Copilot costs more than the E3 base for many organisations. Deploy selectively. See M365 Cost 2026: Copilot analysis.
EA price range: $170 to $190/tenant/month. Prerequisite: M365 E3 or E5. Includes 25,000 messages. Overage at $0.01 per additional message.
Build custom AI agents and chatbots that connect to organisational data, automate workflows, and interact through Teams or web. Replaces the legacy Power Virtual Agents standalone product. Niche but high-value for organisations investing in internal AI automation. Monitor message consumption carefully as overage costs accumulate at enterprise scale.
The largest add-on category by spend and the one where the E3-to-E5 crossover calculation matters most. Many of these are included in E5. If you need 3 or more, E5 is usually cheaper than E3 + standalone add-ons.
| Add-On | List Price | EA Range | In E5? | Verdict |
|---|---|---|---|---|
| Defender for Endpoint P2 | $5.20/user/mo | $4.00 to $4.80 | Yes | Strongly recommended for all E3 customers. Most universally valuable security add-on. EDR, automated investigation, threat hunting. |
| Defender for Office 365 P2 | $5.00/user/mo | $3.80 to $4.50 | Yes | Advanced anti-phishing, impersonation protection, attack simulation training. High value in sectors with email-borne threat exposure. |
| Defender for Identity | $5.50/user/mo | $4.20 to $5.00 | Yes | Essential for hybrid AD environments. Cloud-only Azure AD environments derive less value. Detects lateral movement, credential theft. |
| Defender for Cloud Apps | $3.50/user/mo | $2.80 to $3.20 | Yes | CASB for shadow IT discovery and SaaS governance. Monitors 31,000+ cloud apps. Underappreciated. Compare before buying Netskope/Zscaler. |
| Purview Information Protection (Advanced) | $7.00/user/mo | $5.50 to $6.50 | Yes | Advanced DLP, trainable classifiers, auto-labelling. Necessary for organisations handling regulated data at scale. |
| Purview Compliance Manager Premium | $12.00/user/mo | $9.50 to $11.00 | Partial | Deploy only to compliance/legal/audit teams (2 to 5% of users). At $12/user for 50 staff instead of 5,000 total, the difference is $594K/year. |
If you need Defender P2 ($5.20) + Entra ID P2 ($9.00) + Power BI Pro ($10.00), the combined standalone cost is $24.20/user/month. The E3-to-E5 upgrade premium is approximately $21/user/month and includes all three plus Phone System, advanced compliance, and Defender for Office P2. At 3+ add-ons, E5 is almost always cheaper. Model the crossover before buying individual add-ons.
Identity is the new perimeter. The difference between P1 (in E3) and P2 (in E5) is the difference between prevention and detection.
EA price range: $7.00 to $8.00/user/month. Prerequisite: M365 E3 (includes Entra ID P1). Included in E5.
Identity Protection (risk-based conditional access), Privileged Identity Management (PIM for just-in-time admin access), access reviews, and entitlement management. PIM alone justifies the cost by reducing standing admin privileges. Identity Protection adds risk signals that prevent credential-based attacks.
One of the highest-ROI add-ons for E3 customers. Deploy P2 at minimum to all IT admins, security teams, and any user with elevated privileges. For broader deployment, Entra ID P2 ($9) + Defender P2 ($5.20) = $14.20/user/month. At that point, E5 at $21 incremental over E3 is clearly better value because you also get Phone System, Power BI Pro, and advanced compliance.
EA price range: $5.50 to $6.50. Not included in E5. Lifecycle workflows, ML-driven access reviews, separation-of-duties checks, and advanced entitlement management for external identities. Valuable for large enterprises with complex identity lifecycle requirements (10,000+ identities, frequent M&A). For most mid-market organisations, Entra ID P2's built-in access reviews and PIM provide sufficient governance without this add-on.
Teams Phone is Microsoft's fastest-growing collaboration add-on. The licensing model has three layers: phone system, calling connectivity, and calling plan, each priced separately.
| Add-On | List Price | EA Range | In E5? | Verdict |
|---|---|---|---|---|
| Teams Phone Standard | $8.00/user/mo | $6.00 to $7.50 | Yes | Required for any PSTN calling through Teams. Cloud PBX: call queues, auto-attendants, voicemail. Does not include PSTN connectivity. |
| Domestic Calling Plan | $12.00/user/mo | $10.00 to $11.00 | No | 3,000 domestic minutes. Direct Routing via third-party SBC costs $3 to $6/user/mo for equivalent service. Calling Plans are 40 to 60% more expensive. |
| International Calling Plan | $24.00/user/mo | $20.00 to $22.00 | No | 3,000 domestic + 600 international minutes. Same Direct Routing alternative applies. Evaluate before defaulting. |
| Teams Premium | $10.00/user/mo | $8.00 to $9.00 | No | AI meeting recap, branded templates, advanced webinars. Overlaps significantly with Copilot in Teams. Deploy to event organisers, not broadly. |
For organisations with 500+ calling users, Direct Routing or Operator Connect saves $100K to $500K annually versus Microsoft Calling Plans. The phone system itself ($8/user) is the cheaper component. The PSTN connectivity choice is where the real cost decision lives. See M365 Cost 2026: telephony analysis.
Power Platform is Microsoft's "free at the start, expensive at scale" strategy. Seeded capabilities in M365 are deliberately limited to drive premium add-on purchases. For the full breakdown, see our Power Platform Licensing Guide 2026.
EA price range: $8.00 to $9.00. Included in E5. Full authoring and sharing. The free Power BI in E3 allows viewing only. Deploy Pro only to content creators, typically 10 to 20% of users. Embed reports in Teams or SharePoint for consumption without Pro licences. Power BI Premium Per User (PPU) at $20/user/month adds advanced AI and paginated reports but is not included in E5.
EA price range: $16 to $18. Per-App Plan available at $5.00/user/app/month ($4 to $4.50 EA). The seeded Power Apps in M365 is a deliberate gateway: standard connectors only, no Dataverse, no premium connectors. Model per-app vs per-user cost before broad deployment. For users accessing 1 to 3 specific apps, per-app at $5 is dramatically cheaper than per-user at $20.
EA price range: $12 to $13.50. Per User with RPA at $40/user/month includes attended desktop automation bots. Same licensing gateway as Power Apps. The seeded M365 entitlement covers basic flows (SharePoint triggers, approval workflows) but premium connectors require paid licences. Licence only active flow builders, not consumers. The $40/user RPA plan is expensive. Evaluate UiPath and alternatives before committing.
EA price range: $8.00 to $9.00. Not included in E5. Bundle of advanced Intune capabilities: Remote Help ($3.50), Endpoint Privilege Management ($3.00), Advanced Analytics ($3.00), Microsoft Tunnel for MAM, and firmware updates. Only purchase the suite if you need 3+ individual capabilities. Most organisations benefit from Endpoint Privilege Management alone ($3/user/month) to remove local admin rights with controlled elevation.
Automated Windows update management through Intune with ring-based deployment and automatic rollback. Many organisations still pay for WSUS infrastructure or third-party patching tools while this is already included at no cost.
EA price range: $9.50 to $11.00. Individual modules: Viva Learning ($4), Viva Insights ($4), Viva Engage ($4), Viva Goals ($6). Basic Viva Insights and Connections included in E3/E5. Most organisations use 1 to 2 modules, not the full suite. At $12 for the suite versus $4 for a single module, the suite is only cost-effective if you deploy and actively use 3+ modules. Buy individual modules for specific teams.
The most important commercial decision in M365 add-on licensing is not which add-ons to buy. It is when the accumulation of add-ons on E3 exceeds the cost of upgrading to E5. Microsoft designs the add-on pricing deliberately to create this crossover, pushing organisations toward E5 once they reach 2 to 3 security add-ons.
| Scenario | E3 Base | Add-On Total | E3 + Add-Ons | E5 Cost | Winner |
|---|---|---|---|---|---|
| E3 + Defender P2 only | $36.00 | $5.20 | $41.20 | $57.00 | E3 + Add-On |
| E3 + Defender P2 + Azure AD P2 | $36.00 | $14.20 | $50.20 | $57.00 | E3 + Add-Ons |
| E3 + Defender P2 + Azure AD P2 + Power BI Pro | $36.00 | $24.20 | $60.20 | $57.00 | E5 |
| E3 + Defender P2 + Azure AD P2 + Phone System | $36.00 | $22.20 | $58.20 | $57.00 | E5 |
| E3 + 3 security add-ons + Power BI | $36.00 | $29.20 | $65.20 | $57.00 | E5 (by $8.20) |
If a user needs 3 or more E5-included add-ons, E5 is cheaper than E3 + standalone at list price. At negotiated EA rates, the crossover occurs at 2 to 3 add-ons. The optimal strategy for most enterprises: E5 for 15 to 30% of users (security, IT, legal, compliance, analysts) who need 3+ premium features, E3 for 50 to 60% (information workers), and F3/F1 for 20 to 30% (frontline workers). This mixed-SKU approach saves 15 to 25% versus blanket E5 deployment.
| Add-On | List/User/Mo | EA Range | In E5? |
|---|---|---|---|
| AI & Copilot | |||
| Microsoft 365 Copilot | $30.00 | $23 to $28 | No |
| Copilot Studio (tenant) | $200/tenant | $170 to $190 | No |
| Security & Compliance | |||
| Defender for Endpoint P2 | $5.20 | $4.00 to $4.80 | Yes |
| Defender for Office 365 P2 | $5.00 | $3.80 to $4.50 | Yes |
| Defender for Identity | $5.50 | $4.20 to $5.00 | Yes |
| Defender for Cloud Apps | $3.50 | $2.80 to $3.20 | Yes |
| Purview Information Protection | $7.00 | $5.50 to $6.50 | Yes |
| Purview Compliance Manager Premium | $12.00 | $9.50 to $11.00 | Partial |
| Identity & Access | |||
| Entra ID P2 (Azure AD P2) | $9.00 | $7.00 to $8.00 | Yes |
| Entra ID Governance | $7.00 | $5.50 to $6.50 | No |
| Telephony & Teams | |||
| Teams Phone Standard | $8.00 | $6.00 to $7.50 | Yes |
| Domestic Calling Plan | $12.00 | $10.00 to $11.00 | No |
| International Calling Plan | $24.00 | $20.00 to $22.00 | No |
| Teams Premium | $10.00 | $8.00 to $9.00 | No |
| Analytics & Power Platform | |||
| Power BI Pro | $10.00 | $8.00 to $9.00 | Yes |
| Power BI Premium Per User | $20.00 | $16 to $18 | No |
| Power Apps per User | $20.00 | $16 to $18 | No |
| Power Apps per App | $5.00/app | $4.00 to $4.50 | No |
| Power Automate per User | $15.00 | $12 to $13.50 | No |
| Power Automate + RPA | $40.00 | $33 to $37 | No |
| Device Management & Employee Experience | |||
| Intune Suite | $10.00 | $8.00 to $9.00 | No |
| Intune Endpoint Privilege Mgmt | $3.00 | $2.40 to $2.80 | No |
| Intune Remote Help | $3.50 | $2.80 to $3.20 | No |
| Viva Suite | $12.00 | $9.50 to $11.00 | No |
| Viva Learning / Insights / Engage | $4.00 each | $3.20 to $3.60 | Basic in E3/E5 |
| Viva Goals | $6.00 | $4.80 to $5.50 | No |
Add-ons are where Microsoft has the widest pricing variability and where most organisations leave the most money on the table. Base M365 E3/E5 pricing is well-benchmarked. Add-on pricing has more discretionary room because add-ons are newer, less benchmarked, and Microsoft is motivated to drive adoption.
Microsoft's preferred approach is to bundle add-ons into the blended EA price, making it impossible to track what you pay for each component. Insist on itemised per-add-on pricing so you can evaluate, adjust, and exit each add-on independently at each EA anniversary.
Base M365 subscriptions are committed for the EA term. Add-ons should not be, particularly new products like Copilot, Teams Premium, and Viva modules where enterprise ROI is still being established. The right to reduce or eliminate add-on seats at each anniversary without penalty protects you from paying for products that underperform expectations.
When negotiating standalone add-on pricing, explicitly model the E5 alternative for Microsoft's sales team. If E3 + 3 add-ons exceeds E5, tell them you can either buy these add-ons at the quoted price, or upgrade those users to E5. This creates downward pressure on add-on pricing because Microsoft earns more margin on add-ons than on E5 upgrades.
For any add-on being deployed for the first time, negotiate a 90-day pilot at reduced pricing (50 to 75% of full rate) with defined success criteria. If the pilot meets criteria, commit at the negotiated volume rate. If not, exit without penalty. This structure is achievable for Copilot, Teams Premium, Viva modules, and Intune Suite. For detailed EA negotiation strategies, see our dedicated guide.
Redress Compliance provides independent Microsoft licensing advisory: fixed-fee, no vendor affiliations. Our specialists help enterprises optimise M365 add-on spend, negotiate EA terms, model the E3/E5 crossover, right-size Copilot deployments, and eliminate add-on waste that typically represents 30 to 50% of avoidable spend.
The three highest-impact security add-ons for E3 customers are: Defender for Endpoint P2 ($5.20/user/month) for EDR, Entra ID P2 ($9/user/month) for PIM and identity protection, and Defender for Office 365 P2 ($5/user/month) for advanced anti-phishing. All three are included in M365 E5. If you need all three, upgrading to E5 is cheaper than buying them standalone.
Upgrade to E5 when a user needs 3 or more E5-included features (Defender P2, Azure AD P2, Power BI Pro, Phone System, advanced compliance). At 3 add-ons, the combined standalone cost ($19 to $25/user/month) approaches or exceeds the E3-to-E5 premium ($21/user/month list). The optimal strategy: E5 for the 15 to 30% who need premium capabilities, E3 for the remainder.
Copilot adds $30/user/month at list ($23 to $28 EA), increasing per-user cost by 64 to 83% on E3 or 40 to 53% on E5. Copilot is not included in E5. Negotiate it independently with volume discounts, pilot terms, and annual exit rights.
For small deployments (<500 calling users), Calling Plans offer simplicity that may justify the premium. For larger deployments, Direct Routing through a third-party SBC provider delivers equivalent PSTN connectivity at $3 to $6/user/month versus $12 to $24 for Calling Plans, saving 40 to 70%.
M365 E3/E5 includes seeded Power Apps and Power Automate with standard connectors only. The moment you need premium connectors (SQL, Dataverse, SAP, HTTP, custom APIs), AI Builder, or Dataverse storage beyond 1GB, you need premium licences. Choose per-app ($5/user/app) for users accessing 1 to 3 specific apps, or per-user ($20/user) for builders creating many apps.
No. Most organisations use 1 to 2 Viva modules. At $12/user/month for the suite vs $4 for a single module, the suite is only cost-effective if you deploy and actively use 3+ modules. Buy individual modules for specific teams: Viva Learning for L&D, Viva Insights for managers, Viva Goals for OKR-driven teams.
Four tactics: (1) Negotiate add-ons as separate line items, not bundled into blended pricing. (2) Demand annual exit rights on every add-on. (3) Use the E5 crossover as leverage to push add-on prices down. (4) Negotiate 90-day pilots at 50 to 75% of full rate with defined success criteria. Add-ons have wider pricing variability than base M365 SKUs.
Our Microsoft advisory team helps enterprises right-size add-on deployments, model the E3/E5 crossover, negotiate EA terms, and eliminate 30 to 50% of avoidable add-on spend. Independent, fixed-fee, vendor-neutral.
Microsoft Advisory ServicesIndependent Microsoft licensing advisory. Fixed-fee engagement models. 100% vendor-independent.