Microsoft offers two distinct families of Microsoft 365 plans: the Business plans (Basic, Standard, Premium) designed for organisations with up to 300 users, and the Enterprise plans (E3, E5, F3) designed for larger organisations without a user cap. The two families differ in security capabilities, compliance tools, administrative controls, device management depth, analytics, and the commercial agreement structures available to each. This guide maps every meaningful difference, identifies the hidden costs on both sides, and provides the decision framework for choosing the right plan family or combination.
Before diving into the differences, here is what each plan includes and what it costs. All prices are per user per month at list pricing as of 2026.
Web and mobile versions of Office applications (Word, Excel, PowerPoint, Outlook) only — no desktop apps. Exchange Online with a 50 GB mailbox. Teams, SharePoint, and OneDrive (1 TB per user). Basic security features. This is the entry-level plan for organisations that need email, collaboration, and cloud storage without the desktop Office suite.
Everything in Business Basic plus full desktop Office applications (Word, Excel, PowerPoint, Outlook, Access, Publisher on PC). This is the plan most SMBs need: it provides the complete productivity suite at a fraction of enterprise pricing. Also includes basic webinar and event capabilities through Teams.
Everything in Business Standard plus advanced security: Intune device management, Defender for Business (endpoint protection), Azure AD P1, conditional access policies, Azure Information Protection P1, and data loss prevention. Business Premium is Microsoft’s most feature-rich SMB offering and represents the closest Business-tier equivalent to the Enterprise E3 plan.
Designed for frontline workers. Web and mobile Office apps only (no desktop). 2 GB Exchange mailbox. Teams, SharePoint, OneDrive (2 GB). Basic Intune and Azure AD P1. F3 is purpose-built for employees who work on shared devices and do not need full Office or large mailboxes — retail staff, factory workers, healthcare aides, logistics personnel.
The standard enterprise knowledge worker licence. Full desktop Office applications, 100 GB Exchange mailbox, Teams, SharePoint, OneDrive (unlimited in practice). Intune, Azure AD P1, Azure Information Protection P1, advanced compliance tools including eDiscovery Standard, Data Loss Prevention, and sensitivity labels. Windows Enterprise upgrade rights. This is the plan that 70–80% of enterprise knowledge workers need.
Everything in E3 plus advanced security (Defender for Office 365 Plan 2, Defender for Endpoint P2, Cloud App Security, Azure AD P2 with Identity Protection and Privileged Identity Management), advanced compliance (eDiscovery Premium, Advanced Audit, Communication Compliance, Information Barriers, Insider Risk Management), and the Phone System for Teams voice. E5 is the premium tier for users who require the most sophisticated security and compliance capabilities.
Every Business plan is hard-capped at 300 users per tenant. This is not a soft limit or a recommendation — it is a technical restriction. An organisation with 301 users cannot use Business plans.
Organisations approaching the 300-user threshold face a forced migration to Enterprise plans. Business plans are purchased through CSP partners or direct from Microsoft at published pricing. Enterprise plans are most advantageously purchased through an Enterprise Agreement (EA), which requires a minimum of 500 users. An organisation with 350 users is in the gap: too large for Business plans, too small for an EA. Plan the transition before you hit the ceiling, not after.
| Security Capability | Business Basic/Standard | Business Premium | Enterprise E3 | Enterprise E5 |
|---|---|---|---|---|
| Exchange Online Protection | Yes | Yes | Yes | Yes |
| Azure AD P1 (conditional access) | No | Yes | Yes | Yes |
| Azure AD P2 (Identity Protection, PIM) | No | No | No | Yes |
| Endpoint protection | No | Defender for Business | Basic (via Intune) | Defender for Endpoint P2 |
| Advanced threat protection (email) | No | No | No | Defender for Office 365 P2 |
| Cloud App Security (CASB) | No | No | No | Yes |
| Intune device management | Basic MDM only | Yes (simplified) | Yes (full) | Yes (full) |
| Data Loss Prevention | No | Yes (basic) | Yes | Yes (advanced) |
Business Standard at $12.50/user has essentially no advanced security. Adding third-party endpoint protection ($3–$8/user), a CASB solution ($3–$5/user), and advanced email protection ($2–$4/user) brings the effective cost to $20.50–$29.50/user — approaching Business Premium ($22) or even E3 ($36) territory, but with multiple vendors, multiple consoles, and integration complexity. For organisations where security is a priority, the “cheaper” Business plan may be the more expensive choice once the security gaps are filled.
| Compliance Capability | Business Plans (All Tiers) | Enterprise E3 | Enterprise E5 |
|---|---|---|---|
| Basic data retention / litigation hold | Exchange only | Yes | Yes |
| eDiscovery Standard | No | Yes | Yes |
| eDiscovery Premium | No | No | Yes |
| DLP (Exchange, SharePoint, Teams) | No | Yes | Yes |
| Sensitivity labels | No | Yes | Yes |
| Advanced Audit | No | No | Yes |
| Communication Compliance | No | No | Yes |
| Insider Risk Management | No | No | Yes |
| Information Barriers | No | No | Yes |
An organisation that starts on Business plans and later faces a regulatory audit or legal discovery request discovers that the data retention, audit logging, and eDiscovery capabilities they need simply do not exist in their plan. Migrating to Enterprise plans mid-crisis is expensive and disruptive. Organisations in regulated industries should evaluate compliance requirements before selecting a plan family, not after a regulator asks for data they cannot produce.
Business plans include basic mobile device management (MDM). Business Premium adds Intune with a simplified management experience. Enterprise E3 and E5 include the full Intune suite with advanced capabilities: co-management with Configuration Manager (SCCM), Windows Autopilot for zero-touch device provisioning, granular app configuration policies, and compliance policies with remediation actions. For organisations managing thousands of devices across multiple locations, the Enterprise Intune implementation provides capabilities that Business Premium cannot match.
Enterprise E3 and E5 include the right to upgrade Windows Pro devices to Windows Enterprise, which provides additional security features (Credential Guard, AppLocker, Windows Defender Application Guard) and management capabilities. Business plans do not include this right. Organisations that require Windows Enterprise features must either purchase Enterprise M365 plans or license Windows Enterprise separately.
| Plan | Primary Mailbox | Archive Mailbox |
|---|---|---|
| Business Basic / Standard / Premium | 50 GB | 50 GB (with archive add-on) |
| Enterprise F3 | 2 GB | No archive |
| Enterprise E3 / E5 | 100 GB | Unlimited (auto-expanding) |
Business plans include basic Microsoft 365 usage reports. Enterprise E3 adds more detailed usage analytics and custom reports through the Microsoft Graph API. Enterprise E5 includes Power BI Pro for every licensed user (a $10/user/month value included in the E5 price) and Viva Insights with advanced workplace analytics. The Power BI Pro inclusion alone is worth $120/user/year — for organisations that would otherwise purchase Power BI Pro separately, E5 begins to close the pricing gap with E3.
Business plans are purchased at published pricing through CSP partners or direct from Microsoft. There is minimal negotiation leverage. Volume discounts are limited to the CSP partner’s margin, which is typically 5–15%.
Enterprise plans purchased through an Enterprise Agreement open the full Microsoft negotiation framework: tiered pricing (Level A through D based on organisation size), additional negotiation discounts (15–40% beyond tier pricing for well-negotiated deals), bundled Azure commitments, Software Assurance benefits, price protections and caps, and multi-year pricing stability. The EA creates a commercial relationship with structure, leverage, and flexibility that Business plans simply cannot provide.
Our independent Microsoft advisory helps enterprises negotiate optimal EA terms, benchmark discount levels, and build commercial frameworks that deliver maximum value.
Microsoft Negotiation Service →If you are under 300 users today and expect to stay under 300 for the foreseeable future, Business plans are a valid option. If you are approaching 300 or expect to exceed it within the next EA cycle, plan for Enterprise now. If you are over 500 users, Enterprise plans through an EA are almost always the right choice — the volume discounts and negotiation leverage justify the higher list price.
If you operate in a regulated industry (financial services, healthcare, legal, government, defence), Enterprise E3 is the minimum viable plan. The compliance tools in E3 (eDiscovery, DLP, sensitivity labels, advanced audit) are not available in any Business plan and cannot be adequately replicated with third-party alternatives at lower cost. If you face advanced threat actors or require advanced compliance, E5 is justified for the relevant user population.
Business Basic ($6) and Enterprise F3 ($8) do not include desktop Office apps. If your users need Word, Excel, and PowerPoint on their desktops (most knowledge workers do), the minimum plan is Business Standard ($12.50) or Enterprise E3 ($36). The gap between $12.50 and $36 is substantial — $282/user/year. The question is whether the security, compliance, device management, and administrative capabilities in E3 justify the premium.
If your organisation manages hundreds or thousands of Windows devices and needs capabilities like Autopilot, co-management with SCCM, granular compliance policies, and Windows Enterprise upgrade rights, Enterprise plans are required. The Enterprise Intune suite is significantly more capable for large-scale device management than the Business Premium implementation.
If the choice is purely about minimising the per-user cost for email and Office, Business Standard at $12.50/user wins on price. But if the choice is about building a commercial relationship with Microsoft that provides negotiation leverage, volume discounts, Azure integration, bundled benefits, and a framework for managing the Microsoft relationship as it grows, Enterprise plans through an EA provide a foundation that Business plans cannot.
A 10,000-user enterprise might deploy 2,000 F3 licences ($8/user), 6,500 E3 licences ($36/user), and 1,500 E5 licences ($57/user). The blended per-user cost: $31.30/month — 13% less than an all-E3 deployment and 45% less than an all-E5 deployment. This segmentation saves approximately $572,000 annually compared to E3-for-all, and $3.1M annually compared to E5-for-all. The segmentation requires ongoing governance (reassigning users as roles change, auditing plan assignments quarterly), but the economics are compelling.
For organisations where a subset of users needs E5 capabilities, Microsoft offers E5 component add-ons: E5 Security (~$12/user/month), E5 Compliance (~$12/user/month), and E5 Voice ($8/user/month when bundled). These can be applied to E3 licences, providing targeted E5 capabilities without upgrading the entire user base. An E3 + E5 Security user costs approximately $48/month — 16% less than full E5 while providing the advanced security features.
Moving from CSP-purchased Business plans to an EA-governed Enterprise environment requires establishing a new commercial agreement, negotiating terms, and transitioning billing. This is a procurement event, not just an IT event, and should involve independent advisory to ensure the transition terms are favourable.
Security policies, conditional access rules, DLP configurations, and retention policies configured in Business Premium do not always translate directly to Enterprise plan equivalents. The underlying technology is the same (Azure AD, Intune, Exchange Online), but the administrative interfaces and policy granularity differ. Plan for a 2–4 week configuration review and adjustment period after migration.
Enterprise plans cost 2–3× more per user than Business Standard. For a 300-user organisation moving from Business Standard ($12.50) to Enterprise E3 ($36), the annual cost increases from $45,000 to $129,600 — an $84,600 annual increase. This cost increase should be anticipated, budgeted, and offset where possible through EA negotiation discounts, user segmentation (not everyone needs E3 — some may qualify for F3), and elimination of third-party tools that E3 replaces.
Microsoft 365 Copilot ($30/user/month) is available as an add-on to both Business and Enterprise plans with an important distinction. For Business plans, Copilot requires Business Standard or Business Premium as a prerequisite. For Enterprise plans, Copilot requires E3 or E5. Copilot is not available with Business Basic or F3. The Copilot add-on cost is the same regardless of plan family, but the underlying plan capabilities (security, compliance, device management) that govern how Copilot data is protected vary significantly between Business and Enterprise plans. Organisations deploying Copilot should ensure their base plan provides adequate data governance before adding the AI layer.
Business Standard ($12.50) or Business Premium ($22) depending on security needs. Business Premium is strongly recommended over Business Standard for any organisation handling sensitive data. The $9.50/user premium for Defender for Business, Intune, and conditional access is justified by the security capabilities alone.
Enterprise E3 ($36) even if you are below the 300-user threshold. The compliance tools (eDiscovery, DLP, sensitivity labels, advanced audit) are not available in any Business plan. The cost premium over Business Premium ($14/user) buys compliance capabilities that would cost more to replicate with third-party tools.
Enterprise E3 through an MCA or CSP agreement, with active negotiation on pricing. Explore whether you qualify for EA terms through negotiation. Segment users between F3 (frontline), E3 (knowledge workers), and E5 (security/compliance roles) to optimise the blended cost.
Enterprise plans through an EA with full negotiation. Segment F3/E3/E5 based on user roles. The EA commercial framework provides the leverage and flexibility that justify the higher per-user pricing. Negotiate price protections, escalation caps, and Azure bundling.
Ensure your base plan (Business Standard/Premium or Enterprise E3/E5) provides adequate data governance, DLP, and sensitivity labels before adding the $30/user Copilot layer. The AI capabilities are only as secure as the underlying data protection framework.
Model the savings from segmenting your workforce across F3, E3, and E5 licence tiers with our interactive optimisation calculator.
Use the Calculator →Microsoft permits organisations to use both Business and Enterprise plans within the same tenant under certain conditions, though the practical implementation is complex and the licensing rules require careful navigation. The more common and cleaner hybrid approach is segmentation within the Enterprise family: F3 for frontline workers, E3 for standard knowledge workers, E5 for security/compliance-intensive roles.
The 300-user limit is a hard technical cap. You cannot add user 301 on a Business plan. You must migrate to Enterprise plans, which involves a change in commercial structure (from CSP to EA or MCA), configuration review, and typically a 2–3× cost increase per user. Plan the transition proactively — ideally 6–12 months before reaching the ceiling — rather than scrambling at the limit.
Business Premium ($22/user) includes many of the same security features as E3 ($36/user) — Intune, Azure AD P1, conditional access, and basic DLP. However, E3 provides full eDiscovery Standard, more granular Intune capabilities, 100 GB mailboxes (vs 50 GB), unlimited archive, Windows Enterprise upgrade rights, and the commercial framework of an EA. For regulated industries, the E3 compliance tools alone justify the $14/user premium.
A 10,000-user enterprise deploying 2,000 F3, 6,500 E3, and 1,500 E5 achieves a blended cost of ~$31.30/user/month — saving approximately $572,000 annually compared to all-E3 and $3.1M annually compared to all-E5. The savings scale linearly with user count. Segmentation requires ongoing governance (quarterly audits of plan assignments), but the ROI is significant for any organisation with a mixed workforce.
No. Copilot ($30/user/month) can be added to Business Standard, Business Premium, E3, or E5. However, the data governance, DLP, and sensitivity label capabilities that protect the data Copilot accesses vary significantly between plans. Organisations deploying Copilot at scale should ensure their base plan provides adequate data protection — E3 minimum is recommended for enterprises, Business Premium minimum for SMBs.
E5 Security add-on (~$12/user/month added to E3) costs ~$48/user total — 16% less than full E5 ($57/user). If you need only advanced security (Defender for Endpoint P2, Azure AD P2, Cloud App Security) but not advanced compliance or Phone System, the add-on is more cost-effective. If you also need eDiscovery Premium, Insider Risk Management, Communication Compliance, or Teams Phone System, full E5 provides better value as a bundle.
Redress Compliance provides independent Microsoft licensing advisory for enterprises. We analyse your user population, security/compliance requirements, and commercial context to recommend the optimal plan mix. We negotiate EA terms, benchmark discount levels, model segmentation savings, and manage the commercial transition from Business to Enterprise plans. All engagements are fixed-fee and 100% vendor-independent.
Redress Compliance provides independent Microsoft licensing advisory — plan selection, EA negotiation, licence segmentation, and cost optimisation. Fixed-fee, 100% vendor-independent.