Microsoft 365 Add-Ons You're Probably Paying for Twice

Microsoft's product catalogue has grown to the point where many enterprise customers are paying for capabilities they already own under a different name in a different part of their contract. Duplicate spending on Microsoft 365 add-ons is not unusual — it is the norm in environments where licensing decisions have been made incrementally over three or more renewal cycles without a unified inventory review. The patterns are consistent across our Microsoft advisory practice, and the financial impact at scale is significant. This guide identifies the most common sources of duplicate M365 spend and what to do about them before your next renewal.

Why Add-On Duplication Accumulates

Microsoft's packaging strategy deliberately creates ambiguity between add-on products and the features included in enterprise plan tiers. When a new security capability is announced, it is typically launched first as a premium add-on, then later embedded in E3 or E5 at no additional cost as Microsoft drives adoption. Organisations that purchased the add-on at launch and did not review their entitlements when the feature was embedded in the base plan continue paying for it as a separate line item. Microsoft's account teams are not incentivised to flag this duplication proactively.

The problem is compounded by organisational silos. Security teams frequently purchase Defender products independently of the M365 baseline licensing owned by IT or procurement. Finance and compliance teams add Purview capabilities separately. Individual business units add Power Platform or Dynamics 365 components. Each purchase decision looks rational in isolation but creates redundancy when viewed against the full licence estate. A unified inventory of all Microsoft licences — base plans, add-ons, and separately purchased products — is the starting point for identifying duplication. Our M365 licence reclamation framework covers the inventory methodology.

The Most Common Sources of Duplicate Spend

Defender for Office 365 Plan 1 is now included in Microsoft 365 E3 as of the most recent packaging update. Organisations that previously purchased Defender for Office 365 Plan 1 as a standalone add-on on top of E3 are therefore paying twice for the same email security capability. At approximately $2 per user per month, this duplication costs a 5,000-user organisation $120,000 per year. The fix is straightforward once identified, but it requires an active entitlement review — Microsoft will not raise it unprompted.

Power BI Pro is included in Microsoft 365 E5. Organisations with E5 licences that are also paying separately for Power BI Pro licences for the same user population are carrying duplicate spend. At $10 per user per month for Power BI Pro, a 500-user overlap in a 5,000-user estate with mixed E3/E5 licensing represents $60,000 in annual duplication. The correct approach is to confirm which users are on E5 (and therefore entitled to Power BI Pro) before purchasing standalone Power BI Pro licences for any user in the organisation.

Microsoft Entra ID P1 is included in both Business Premium and E3. Organisations that also hold Azure Active Directory Premium P1 subscriptions as a standalone Azure product — common in environments where Azure identity services were procured separately from M365 — are paying twice for the same identity and conditional access capability. This duplication is particularly common in organisations that migrated to Microsoft 365 from an existing Azure-first infrastructure.

Microsoft Intune Plan 1 is included in E3, E5, and Business Premium. It is also available as a standalone Endpoint Management add-on. Organisations that added the standalone Intune subscription before migrating to E3 or Business Premium, and did not remove it at migration, carry this cost unnecessarily. The duplication is invisible in many environments because the Intune subscription is managed through a different administrative portal than the M365 base plans. Our EA true-up guidance includes a checklist for cross-portal entitlement verification.

How to Identify and Eliminate Duplication Before Your Next Renewal

The most effective approach is a pre-renewal entitlement mapping exercise. For each add-on currently in your contract, identify which users are assigned, which M365 base plan those users hold, and whether the add-on capability is included in that base plan. Where overlap exists, document the duplicate cost and the removal action required. This exercise typically takes 15 to 25 hours for a 5,000-user estate and consistently identifies $200,000 to $600,000 in annual duplicate spend.

Bring the results into your EA renewal negotiation as documented evidence of the correct licence baseline. Microsoft's renewal proposal will almost always overstate what you need. Coming in with validated entitlement data that demonstrates exactly what is and is not needed — and why — positions you to negotiate from a defensible commercial position rather than accepting Microsoft's baseline. Our EA discount negotiation guide covers how to use this analysis as a lever in the broader commercial conversation. Download the Microsoft EA Renewal Playbook for the full framework.