Unbundle the Microsoft Security Stack and Stop Overbuying E5

M365 E5 lists at $57 per user per month and rises to $60 on 1 July 2026. Across a modeled 12,000 seat estate, persona segmentation cut security licensing about 19 percent, near $1.54 million a year.

Prepared by Redress Compliance · June 2026 · Representative Microsoft estate scenario (benchmark scenario, not a quote).

E5 carries the full Microsoft security stack: Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps, Entra ID P2, Microsoft Sentinel access, Purview compliance, and Intune Plan 2. None of it is priced on your invoice. You see one number.

That one number defeats scrutiny. When security and productivity sit in one SKU, nobody asks whether the security half is used. The E5 over E3 premium is about $21 per user per month, near $252 a year. Across an estate, that bundled security line is one of the largest unexamined items in the IT budget.

Priced a la carte, the same capabilities tell a different story. The E5 Security add on carries the Defender suite and Entra ID P2 on an E3 base and lists near $12. What pushes E5 past the add on price is Sentinel, Purview, and Intune Plan 2, and most seats use none of the three.

List prices are current as at the Microsoft public pricing pages, April to June 2026. Defender for Identity and Defender for Cloud Apps are not sold as separate retail SKUs at scale; they reach an E3 estate through the E5 Security add on.

Every Defender product has a standalone or add on path. You do not have to buy E5 to run Microsoft endpoint, email, identity, and SaaS security. You can assemble exactly the tier each population needs.

• Defender for Endpoint Plan 1: $2.50 per device per month for core endpoint detection and response. Right for frontline and shared devices.
• Defender for Endpoint Plan 2: $5.20 per device per month, adding advanced hunting, automated investigation, and threat intelligence. Right for SOC monitored fleets.
• Defender for Office 365 Plan 1: $2.00 per user per month for safe attachments and safe links. From 1 July 2026 Microsoft folds Plan 1 into M365 E3 itself.
• Defender for Office 365 Plan 2: $5.00 per user per month, adding attack simulation, threat trackers, and automated response.
• E5 Security add on: near $12 per user per month, bundling Endpoint Plan 2, Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps, and Entra ID P2 on an E3 base.

The add on is the lever. It requires an E3 or Office 365 E3 plus EMS E3 base and cannot sit on top of an E5 base. That packaging rule is what makes the E3 plus add on path cheaper than E5 for security heavy users who still do not need Sentinel or Purview.

Sentinel is the component buyers misread most. It is not seat priced. It is priced on data ingestion, so the cost driver is log volume, not licenses. E5 grants access to Sentinel, not free ingestion, which means the bill arrives through Azure either way.

The analytics tier prices pay as you go between $4.30 and $5.59 per GB by region. Commitment tiers reserve daily capacity and cut the effective rate sharply.

Two mechanics matter here. A commitment tier can be raised at any time but lowered only after a 31 day minimum, so over committing is a one way door for a month. And Sentinel ingestion draws down your Azure MACC, so moving Sentinel outside E5 shifts the cost onto Azure consumption rather than removing it.

Purview is the second capability where E5 oversells. The full Purview suite that justifies E5 includes advanced eDiscovery, advanced data loss prevention, insider risk management, communication compliance, and records management. Most organizations need a subset, scoped to regulated populations.

• Compliance Manager and basic data loss prevention already ship inside lower tiers and E3.
• Advanced eDiscovery and insider risk reach an E3 estate through the E5 Compliance add on at near $12 per user per month.
• Records management and communication compliance matter for legal, finance, and clinical staff, not the whole headcount.

The honest test is scope. Map which roles carry a real eDiscovery, retention, or insider risk obligation, then license the E5 Compliance add on for that population on an E3 base. Blanket Purview across every seat funds capabilities that legal will never invoke for a warehouse worker.

Microsoft prices security aggressively because most buyers have no walk away. Build one. A credible alternative at each capability is what converts a list price into a negotiated price, even if you never switch.

You do not need to deploy the alternative. You need it priced, scoped, and on the desk before the renewal. An account team that knows you have a real CrowdStrike quote treats the Defender line very differently from one that assumes you are captive.

Take a representative estate. Meridian Health Network runs 12,000 M365 seats, today all on E5. Split the population by actual security consumption, then license each segment to its need.

The three year gap is the headline. At $1.542 million a year, the segmented path runs $4.63 million below blanket E5 across the model. That is the overspend buying E5 for security 9,000 seats never fully use.

Benchmark ranges: Redress Compliance advisory engagement file, 2024 to 2025. Worked figures use Microsoft list prices and are a benchmark scenario, not a quote.

Unbundling is a renewal window move, not an anytime one. Under an Enterprise Agreement, you add seats through annual true ups, but you cannot reduce committed quantities mid term. Reductions and step downs land only at the anniversary order or renewal. Sequence backward from that date.

Miss the anniversary order deadline and the step down waits a full year, so the calendar, not the analysis, is the binding constraint. Start the mapping at least one quarter before the date on the agreement.