More than a third of E5 Security seats never produced an alert worth responding to

Security licensing is the one part of the Microsoft estate bought on fear and renewed on inertia. The alert log is the usage report nobody reads: in our reviews, over a third of E5 Security seats sat on users who never generated a Defender alert worth a response.

Prepared by Redress Compliance · August 14, 2026 · Microsoft advisory. Security licensing reviews across E3 and E5 estates, 2024 to 2026.

• Read the alert log against the license assignment. A seat whose user generated no actionable Defender alert in a year is a seat licensed to a threat that did not materialize at that desk.
• Map users to Defender products by exposure tier, not by department, and apply the three plus rule per tier.
• Check what already sits inside existing seats before buying anything standalone, because capabilities inside an E5 seat are the most common double purchase.
• Hold the Plan 2 line where Defender is justified at all, and question the deployment rather than the plan level where it is not.
• Budget Sentinel separately and control it through ingestion routing, since its meter reads gigabytes, not users, and no seat decision moves it.

Every other Microsoft workload gets right sized eventually. Unused Visio seats get culled, Power BI Pro gets tiered, even the E5 mix gets audited when the renewal is large enough. Security is the exception: it deploys uniformly, renews automatically, and grows monotonically, because nobody wants to be the person who removed protection before the breach.

That asymmetry is priced in. The uniform rollout, E5 Security for everyone on E3, is administratively effortless and analytically indefensible, because threat exposure is the least uniform property in the company. A domain admin, a finance approver, and a frontline kiosk account do not face the same adversary, and licensing them identically means the kiosk is paying for the admin's threat model.

The alert log is where the truth sits, and it is the usage report nobody reads. A third or more of E5 Security seats producing no alert worth a response is not evidence the product failed. It is evidence the seat was assigned to a user whose exposure never required it, and unlike most licensing questions, this one has telemetry: the SOC's own console will tell you which seats earn their keep.

The economics compound quietly. The unnecessary bundle seat costs more than the standalone piece the user actually needed, the renewal carries the whole population forward as a block, and the capabilities already inside existing seats get bought again standalone by a different budget holder who never saw the entitlement map. Three small leaks, one direction.

The counter is to treat security licensing exactly like the security program treats everything else: by risk tier. Map exposure, apply the three plus rule per tier, hold Plan 2 where Defender is justified, and let the alert log arbitrate annually. Nothing about this weakens the security posture. It funds it, by moving spend from seats that never alert to the controls that do.

The consumption side of this estate, the Sentinel meter and the ingestion tuning that cut it 25 to 45 percent, has its own analysis in the Sentinel pricing brief. The wider position sits in the Microsoft practice.

Watch the briefing · 3:585 Tips for Your Microsoft NegotiationNever pick from the Multiple Equivalent Offers menu, right size before pricing, and split the stack so one workload never subsidizes another's optics.

Across the E3 and E5 estates we reviewed, the same picture repeated wherever security had been rolled out uniformly:

Three patterns recurred. Uniform E5 Security rollouts covering populations with radically different exposure. Standalone Defender purchases duplicating capabilities already inside existing E5 seats. And Sentinel budgeted as part of the seat conversation, where its per gigabyte meter belongs to a different discipline entirely.

The buyer side move is to let the alert log arbitrate. The wider library sits in the Microsoft practice.

How is Microsoft threat protection licensed in 2026?

Mainly through the Defender family, sold either as standalone plans per user or bundled into the Microsoft 365 E5 and E5 Security suites. You can buy a single Defender product or take the whole stack inside a larger M365 SKU.

What is in E5 Security?

E5 Security is an add on for E3 customers that bundles Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, and Defender for Cloud Apps. It delivers most of the E5 security value without the full E5 price jump.

When does E5 or E5 Security beat standalone Defender?

When you would otherwise buy three or more Defender products separately for the same user. Below that line, an E3 estate adding only the pieces each user tier needs prices better than the bundle.

Do you need Defender Plan 1 or Plan 2?

Most security teams that justify Defender at all need Plan 2, which carries the investigation and response depth the operations program actually uses. Buying Plan 1 to save money usually re opens the standalone versus bundle question rather than settling it.

Where does Microsoft Sentinel fit in the threat protection cost model?

Sentinel is the cloud SIEM and is licensed separately by data ingestion and analytics, not per user. It pairs with Defender but its cost model is consumption based, so it is budgeted apart from the Defender seat licenses and controlled through ingestion architecture.

How do you find over licensed security seats?

Read the alert log against the license assignment. In our reviews more than a third of E5 Security seats sat on users who never generated a Defender alert worth a response, which is the signature of security licensed by org chart rather than by threat model.

How do you avoid double paying for Microsoft security capabilities?

Map which users need each Defender product before renewing, and check what already sits inside their existing seats. Capabilities already included in an E5 seat are commonly bought again standalone, and the map is what prevents it.