Not every employee needs the most expensive Microsoft 365 plan. E5 costs 50–70% more than E3 per user — and F3 costs a fraction of either. The right SKU mix can save millions on an Enterprise Agreement while maintaining security, compliance, and productivity across every user role. This guide gives CIOs the complete framework for right-sizing Microsoft 365 licences across the organisation.
Microsoft offers three primary Microsoft 365 enterprise SKUs, each targeting a different user profile. Understanding their scope is the foundation for cost-effective licensing.
The core enterprise suite: full desktop Office apps (Word, Excel, PowerPoint, Outlook), Exchange Online (100 GB mailbox + archive), SharePoint, OneDrive (1 TB), Teams, Windows 10/11 Enterprise, and EMS E3 (Azure AD Premium P1, Intune, basic DLP, MFA). Covers the majority of knowledge workers at roughly $36/user/month. The sweet spot for standard productivity and baseline security.
Everything in E3 plus advanced security (Defender for Endpoint, Defender for Office 365 P2, Azure AD P2, Cloud App Security), advanced compliance (Advanced eDiscovery, Audit Premium, Customer Lockbox), Power BI Pro, Teams Phone System, and Audio Conferencing. At roughly $57/user/month, it is 50–70% more expensive. Best for high-risk roles (security, compliance, data science, executives) and organisations needing to consolidate third-party security/telephony tools.
Stripped-down plan for frontline/task workers: web and mobile Office apps only (no desktop apps), 2 GB Exchange mailbox, limited SharePoint, Teams (meetings up to 24 hours), basic security and device management. At roughly $8/user/month, it is 75–80% cheaper than E3. Designed for retail staff, factory floor workers, field service, healthcare workers, and other deskless roles with basic communication needs.
“The most common Microsoft licensing mistake is treating E5 as the default for all users. In a typical enterprise, only 15–25% of users genuinely need E5 capabilities. The rest are served equally well by E3 or F3 — at a fraction of the cost. Right-sizing the SKU mix is the single highest-ROI activity in Microsoft licence optimisation.”
| Feature Category | F3 (~$8) | E3 (~$36) | E5 (~$57) |
|---|---|---|---|
| Office desktop apps | ❌ Web & mobile only | ✅ Full desktop + web + mobile | ✅ Full desktop + web + mobile |
| Exchange Online mailbox | 2 GB | 100 GB + archive | 100 GB + archive |
| OneDrive storage | 2 GB | 1 TB (expandable) | 1 TB (expandable) |
| SharePoint | Limited (site access, no personal site) | Full | Full |
| Microsoft Teams | ✅ (basic) | ✅ Full | ✅ Full + Phone System + Audio Conf |
| Windows Enterprise | ❌ | ✅ Windows 10/11 Enterprise | ✅ Windows 10/11 Enterprise |
| Azure AD | Azure AD P1 (limited) | Azure AD Premium P1 | Azure AD Premium P2 (risk-based CA, PIM) |
| Microsoft Intune | ✅ (limited device mgmt) | ✅ Full | ✅ Full |
| Data Loss Prevention | Basic | Standard DLP | Advanced DLP + auto-labelling |
| Threat Protection | Basic | Defender for Office 365 P1 | Defender for Endpoint + Office 365 P2 + Cloud App Security |
| eDiscovery | ❌ | Standard eDiscovery | Advanced eDiscovery + Audit Premium |
| Power BI | ❌ | ❌ (separate licence) | ✅ Power BI Pro included |
| Teams Phone System | ❌ | ❌ (add-on required) | ✅ Included |
| Audio Conferencing | ❌ | ❌ (add-on required) | ✅ Included |
For the majority of knowledge workers, E3 delivers everything needed for productive, secure, and compliant work.
Desktop Office apps (Word, Excel, PowerPoint, Outlook, OneNote, Access, Publisher), web and mobile versions, plus Teams for collaboration. This matches what most users need daily. No functionality gap vs E5 for standard document creation, email, and meetings.
Azure AD Premium P1 (conditional access, MFA), Microsoft Intune (device management), Defender for Office 365 Plan 1 (safe attachments/links), basic DLP, and standard information protection. Sufficient for most organisations’ baseline security posture and many regulatory frameworks.
Standard eDiscovery, retention policies, data loss prevention, audit logging, and information barriers. Meets requirements for most compliance frameworks (SOC 2, ISO 27001, HIPAA basic). Advanced compliance features (Advanced eDiscovery, Audit Premium, Customer Lockbox) require E5 or add-ons.
At ~$36/user/month, E3 is the cost-effective default for 60–80% of enterprise users. For a 10,000-user organisation, choosing E3 over E5 for 7,000 users saves approximately $1.76M per year ($21/user/month × 7,000 × 12 months).
For detailed E3 deployment guidance, see Selecting the Right M365 Enterprise Plan.
E5’s premium is justified when users actively leverage its advanced capabilities — or when the consolidated cost is lower than E3 plus equivalent third-party tools.
| E5 Capability | Equivalent Standalone Cost | Who Needs It | E5 Justified? |
|---|---|---|---|
| Defender for Endpoint | ~$5.20/user/month standalone | All users with managed devices (security teams manage centrally) | If deploying to all users, E5 bundles it cheaper than E3 + add-on for large populations |
| Azure AD Premium P2 | ~$9/user/month standalone | Admins, executives, privileged access users | Usually only 5–15% of users need PIM/risk-based CA. Add-on is cheaper than full E5. |
| Power BI Pro | ~$10/user/month standalone | Data analysts, business intelligence users, report creators | If >50% of E5 candidates use Power BI actively, the bundle is cost-effective. |
| Teams Phone System | ~$8/user/month add-on | Users who make/receive external phone calls via Teams | If you are replacing a PBX for these users, E5 bundles telephony effectively. |
| Advanced Compliance | ~$12/user/month (Compliance E5 add-on) | Legal, compliance, audit, and regulated-industry users | If more than 20–30% of E5 candidates need advanced compliance, the bundle is justified. |
The E5 break-even calculation: E5 costs ~$21/user/month more than E3. If a user would need 3+ add-ons that total more than $21/month (e.g., Defender for Endpoint $5.20 + Phone System $8 + Power BI Pro $10 = $23.20), E5 is cheaper than E3 + add-ons. If a user needs only 1–2 add-ons, E3 + those add-ons is almost always cheaper. Run this calculation for each user segment before committing to E5. See M365 E5 Value: Using Included Features.
Microsoft 365 F3 is the most underused SKU in enterprise licensing — and the one with the highest cost-saving potential.
Web and mobile Office apps (no desktop installs). 2 GB Exchange mailbox. Teams for communication. Basic security and device management. SharePoint site access. OneDrive (2 GB). Shifts, Tasks, and Walkie Talkie in Teams. Enough for email, messaging, shift scheduling, and basic document access.
Retail store associates. Factory floor and warehouse workers. Healthcare nurses and orderlies. Field service technicians. Hospitality and food service staff. Call centre agents with dedicated applications. Any role that primarily uses a shared device, mobile phone, or kiosk and does not create complex documents.
F3 at ~$8/user/month vs E3 at ~$36 saves $28/user/month. For an organisation with 5,000 frontline workers currently on E3, switching to F3 saves $1.68M per year. This is often the single largest Microsoft licensing optimisation available — and the most commonly missed.
The key to Microsoft 365 cost optimisation is mapping every user to the right SKU based on their actual needs, not their job title.
| User Segment | Typical Roles | % of Workforce | Recommended SKU | Monthly Cost |
|---|---|---|---|---|
| Power users / High-risk | IT security, compliance, legal, data science, C-suite | 10–20% | E5 | ~$57 |
| Standard knowledge workers | Finance, HR, marketing, operations, engineering, sales | 40–60% | E3 | ~$36 |
| Frontline / Task workers | Retail, manufacturing, healthcare, field service, hospitality | 20–40% | F3 | ~$8 |
Situation: A global retailer with 15,000 employees had licensed all users on E3 at $36/user/month ($6.48M/year). Microsoft proposed upgrading 5,000 corporate users to E5 during the EA renewal, which would have increased the annual cost to $8.64M.
Approach: An independent assessment segmented users: 1,200 high-risk/security/compliance users genuinely needed E5 capabilities; 6,300 knowledge workers were appropriately on E3; and 7,500 store associates, warehouse staff, and field workers only needed F3.
Microsoft supports mix-and-match SKUs within an Enterprise Agreement. You are not required to put all users on the same plan.
Microsoft offers “step-up” SKUs that upgrade users from E3 to E5 at a reduced price (the E5 minus E3 differential, typically ~$21/user/month). This is more cost-effective than buying E5 outright for users already on E3. Use step-ups to selectively upgrade specific user groups.
Instead of full E5, add individual E5 capabilities to E3 users: Microsoft 365 E5 Security (~$12/user/month), Microsoft 365 E5 Compliance (~$12/user/month), or individual products (Defender for Endpoint, Power BI Pro, Phone System). This “E3 + targeted add-ons” approach is cheaper than E5 when users need only 1–2 capability areas.
Microsoft also offers F1 (~$2.25/user/month) for the most basic frontline needs (no Exchange mailbox). For workers who need only Teams and shift scheduling without email, F1 saves even more than F3. Evaluate your frontline population for F1 eligibility.
Enterprise Agreements offer volume-based pricing tiers. Larger seat counts in a single SKU achieve better discounts. Sometimes consolidating on E3 (with add-ons) achieves a better volume discount than splitting across E3/E5/F3. Model the total cost both ways before deciding.
For Microsoft pricing strategies, see M365 Price Increases & Overpaying.
The Enterprise Agreement (EA) renewal is the ideal moment to restructure your Microsoft 365 SKU mix.
Microsoft account teams are incentivised to upsell E5. The default EA renewal proposal almost always includes an E5 recommendation for a larger population than justified. Challenge every E5 recommendation with usage data showing which users actually need advanced capabilities.
Obtain benchmark pricing from independent sources for E3, E5, F3, and key add-ons. Typical enterprise discounts range from 10–25% off list price for E3/E5, with larger organisations achieving deeper discounts. Without benchmarks, you cannot evaluate whether Microsoft’s offer is competitive. See Microsoft EA Optimisation Service.
EA true-ups (annual adjustments for added users) can drive significant cost increases if not managed. Negotiate true-up terms that allow you to change SKU assignments (e.g., move users from E3 to F3) at each true-up without penalty. Microsoft’s standard terms may restrict downgrades — push for flexibility.
Negotiate price protection for the entire EA term (typically 3 years). Microsoft has been increasing M365 prices — a price lock protects your budget from mid-term increases. This is particularly important for E5, where price increases have been most aggressive.
Microsoft 365 Copilot requires either E3 or E5 as a prerequisite. If Copilot adoption is planned, factor the Copilot add-on cost (~$30/user/month) into your SKU model. Only deploy Copilot to users with a documented productivity use case. See 30 Microsoft Copilot Use Cases.
For full EA negotiation guidance, see Microsoft Contract Negotiation Service.
| Mistake | Impact | Solution |
|---|---|---|
| E5 for everyone by default | 50–70% overspend for 60–80% of users who do not use advanced features | Segment users. Default to E3. Upgrade to E5 only where justified by usage data. |
| E3 for frontline workers | $28/user/month overspend for users who need only web/mobile apps and basic email | Deploy F3 for deskless workers. Evaluate F1 for users who do not need email. |
| Buying E5 for one feature | Paying $21/month premium for a single capability (e.g., Phone System at $8/month add-on) | Use E3 + targeted add-ons when users need 1–2 E5 capabilities. |
| Ignoring step-up pricing | Paying full E5 price instead of E3-to-E5 step-up differential | Use step-up SKUs for selective E5 upgrades within an existing E3 base. |
| No usage monitoring post-deployment | Paying for E5 licences that are underused. No data for next EA renewal. | Implement M365 usage reporting. Review quarterly. Downgrade underused E5 licences at true-up. |
Document every M365 licence assignment: which users have E3, E5, F3, F1, and any standalone add-ons. Pull data from the Microsoft 365 admin centre and Azure AD.
Use Microsoft 365 usage reports to measure which features each user actually uses: desktop app logins, Teams meetings, Exchange activity, Defender alerts, Power BI reports, Phone System calls. Identify users assigned E5 who do not use E5-specific features.
Classify every user as E5-required, E3-appropriate, or F3-eligible based on role requirements and actual usage data. Build a mapping table by department and job function.
Model the annual cost of the optimised SKU mix vs the current state. Calculate the saving. This becomes your business case for the EA renegotiation.
For E3 users who need 1–2 E5 capabilities, model the cost of E3 + add-ons vs full E5. Select the cheaper option for each user segment.
Obtain independent benchmark pricing for E3, E5, F3, and key add-ons at your volume level. Compare against Microsoft’s proposal.
Present your optimised SKU mix to Microsoft. Use the benchmark data and the competitive alternatives (Google Workspace, Zoom) to negotiate pricing. Push for true-up flexibility, price locks, and step-up options.
Execute the licence reassignments: downgrade over-licensed users to E3 or F3, upgrade justified users to E5, and add targeted add-ons. Communicate changes to affected users with adequate notice.
Set up quarterly M365 usage reviews. Track E5 feature adoption, F3 user satisfaction, and any users who have been misclassified. Adjust at each annual true-up.
12 months before the next EA renewal, repeat the analysis. User roles change, new features launch, and pricing evolves. Continuous optimisation ensures you never overpay.