Microsoft 365 E5 · Deployment and tuning
An E5 licence pays for the controls. Each one still needs a policy, a sensor or an onboarding step before it protects anything: Defender for Identity needs sensors on your domain controllers, Defender for Endpoint needs devices onboarded, and auto-labelling and Insider Risk Management need policies. The rest run on defaults written for every tenant at once. We configure them in a safe order, tune them to how you work, and hand over a tenant your team can run.
An illustrative order of work for a Microsoft 365 E5 tenant, in six phases. 01 Tenant baseline: admin roles, app consent, the audit log and mail authentication. 02 Identity: risk-based Conditional Access runs in report-only first, while Privileged Identity Management and access reviews go straight to enforced. 03 Devices: Defender for Endpoint P2 onboarding and Endpoint Privilege Management go through a pilot or audit stage first, and Cloud PKI goes straight to enforced. 04 Defender: Defender for Identity sensors, Defender for Office 365 Plan 2 and Defender for Cloud Apps each run in audit before they enforce. 05 Data: auto-labelling, Teams and endpoint DLP, and Insider Risk Management each run in simulation or test before they enforce. 06 Operate: a monthly posture review and Security Copilot readiness. Every E5 capability starts licensed but not configured and ends enforced.
E3 and E5 compared
Since July 2026, E3 carries more security than it used to: Defender for Office 365 Plan 1, Intune Plan 2, Remote Help and Advanced Analytics. These are the rows where E5 still adds something.
| Capability | In Microsoft 365 E3 | What E5 adds |
|---|---|---|
| Defender for Endpoint | Plan 1 | Plan 2: endpoint detection and response, automated investigation and remediation, vulnerability management, and the prerequisite for automatic attack disruption |
| Defender for Office 365 | Plan 1, included since 1 July 2026 | Plan 2: attack simulation training, threat hunting and automated investigation |
| Defender for Identity | Not included | Included |
| Defender for Cloud Apps | Shadow IT discovery: basic | Defender for Cloud Apps in full |
| Entra ID | P1, including Conditional Access | P2: ID Protection risk policies, Privileged Identity Management, access reviews and entitlement management |
| Purview sensitivity labels | Custom labels applied by hand | Default labels, automatic labelling, and labels on SharePoint and Teams sites |
| Purview data loss prevention | SharePoint, Exchange and OneDrive | Adds Teams and endpoints |
| Insider Risk Management, Communication Compliance, Adaptive Protection | Not included | Included |
| eDiscovery and audit | Standard tiers | eDiscovery (Premium), and Audit (Premium) with one-year default retention. Ten-year retention needs an add-on licence. |
| Customer Key and Double Key Encryption | Not included | Included |
| Intune | Plan 2, Remote Help and Advanced Analytics since July 2026, rolling out gradually | Endpoint Privilege Management, Cloud PKI and Enterprise Application Management |
| Security Copilot | Not included | Eligible. Microsoft enables it tenant by tenant, and eligibility alone does not switch it on. 400 SCUs a month for every 1,000 licences, capped at 10,000, per Microsoft Learn, June 2026. Not designed for US government clouds, including GCC High. |
| Microsoft Sentinel | Billed separately on Azure | Still billed separately, with a grant of up to 5 MB per user per day of qualifying Microsoft 365 data on EA, EAS or CSP |
As of October 2026. Source: Microsoft Learn service descriptions. Microsoft Defender Suite was formerly Microsoft 365 E5 Security, and Microsoft Purview Suite was formerly Microsoft 365 E5 Compliance. Checked against Microsoft Learn on 11 October 2026.
E3 with Microsoft Defender Suite carries the Defender and Entra ID P2 rows above, and none of the Purview E5 rows. Since August 2026, Entra ID P2, Defender for Endpoint P2 and Defender for Office 365 P2 are also sold as single add-ons for E3 through CSP.
For US defence work that handles CUI, Microsoft's guidance points to GCC High, where Security Copilot isn't designed for use.
CMMC readiness assessmentWhen teams bring us in
Each one starts with a sentence we hear almost word for word. If one of them is yours, here is what we do about it.
E5 at renewal
We renewed E5, and Defender and Purview are still on the settings they shipped with.”
The licence has been paid for since the last renewal. Defender for Identity has no sensors, auto-labelling has no policy, and Conditional Access still runs the policies written at migration.
What we do
We audit what the licence includes against what is switched on, then configure it in a safe order: identity first, then devices, then the Defender workloads and data.
The order we deploy inAn Essential Eight finding
Our Essential Eight assessment flagged admin privileges and application control, and we already pay for E5.”
Both findings sit where the tenant already has the tools: Privileged Identity Management and Endpoint Privilege Management in E5 for admin rights, and App Control for Business deployed through Intune for application control.
What we do
We design the privileged access model and the application control policy, run both in audit first, and leave you with evidence your next assessment can test.
Where E5 supports each strategySecurity Copilot is coming
Microsoft has told us Security Copilot is coming to our tenant.”
Microsoft gives 30 days' notice before it activates Security Copilot for an eligible tenant. It works with the permissions of the person signed in, so today's admin roles decide what it can reach.
What we do
We get the tenant ready: who can use it, which included agents run, how SCU use tracks against the allocation, and Privileged Identity Management and role-based access tightened first.
PSPF protective markings
We need PSPF protective markings in Microsoft 365, including on email from other agencies.”
Manual labels and subject markings work on E3. Auto-labelling the markings that arrive from other agencies needs E5, according to Microsoft's Australian Government guidance.
What we do
We agree the label taxonomy with your records and security owners, run auto-labelling in simulation, and turn on data loss prevention only after it has been tested.
Consolidating tools
We want to retire our third-party email gateway and EDR when their contracts renew.”
E5 already includes Defender for Office 365 Plan 2 and Defender for Endpoint Plan 2. The cut-over has to land before the old contracts end, with no gap in protection.
What we do
We pilot both in your production tenant, tune policies and exclusions against your mail flow and devices, and set the cut-over date with you. Where a third-party tool stays, we configure E5 around it so the two do not double up.
Every one of them starts with the same audit: what the licence includes, and what is switched on.
That audit is the first phase of the order below.
How the work runs
Six phases, each ending in settings that are switched on and tuned. Each phase carries the delivery track it belongs to, so you can take the whole sequence or one phase of it.
The tenant itself, before any E5 feature: who can administer it, what it records, and what it lets leave.
Conditional Access and the Entra ID P2 controls, each proven in report-only before it enforces.
The four Defender workloads, piloted in your production tenant and tuned before they block.
Automatic attack disruption
It needs Defender for Endpoint Plan 2, which E5 includes. We confirm its prerequisites and rehearse an incident with your team before handover.
Security Copilot readiness
Who can use it, which included agents run, and SCU use against the allocation. Privileged Identity Management and role-based access come first, because it works with the signed-in user's permissions.
The sequence follows Microsoft's own Zero Trust guidance for Microsoft 365: starting-point identity and device access policies first, then Intune enrolment, then enterprise policies that require compliant devices.
Architecture-led
E5 covers identity, devices, email, cloud apps and data, and some jobs still belong to other tools. We decide with you where each job sits before anything is switched on, so every job has an owner and nothing runs twice.
Security tooling deploymentEssential Eight
Microsoft publishes an Essential Eight guide on Learn with a page per strategy, including Conditional Access policies for each maturity level. This is how the licence lines up against the eight strategies.
| Strategy | E5 adds | E3 already covers | Outside E5 |
|---|---|---|---|
| Restrict administrative privileges | Privileged Identity Management, access reviews, Endpoint Privilege Management and Defender for Identity. The strongest fit of the eight. | Entra ID roles, and Conditional Access for admin sign-ins | Admin access to systems that do not sign in through Entra ID |
| Patch applications | Enterprise Application Management, and vulnerability management in Defender for Endpoint to find what is missing | App deployment and updates through Intune | Internet-facing services, network devices, and apps outside the Enterprise Application Management catalogue |
| Patch operating systems | Vulnerability discovery across onboarded devices | Windows update rings through Intune | Network devices and appliances |
| Multi-factor authentication | Risk-based sign-in and user policies through ID Protection | Conditional Access policies that require MFA (Entra ID P1) | Systems that do not sign in through Entra ID |
| Application control | Advanced hunting data to tune policies while they run in audit mode | App Control for Business, deployed through Intune | The policy design itself: which publishers, paths and files you allow |
| Restrict Microsoft Office macros, and user application hardening | Hunting and reporting evidence that the settings hold | Intune settings and attack surface reduction rules | Applications Intune does not manage |
| Regular backups | None | None | A backup product. Microsoft 365 E5 includes none. |
ServersMicrosoft 365 E5 is a user licence. Servers need a Defender server licence of their own, through Defender for Servers in Defender for Cloud or Defender for Endpoint for servers, per Microsoft Learn.
Microsoft calls its Essential Eight documents consumer guidance, and maturity is assessed separately, against ASD's Essential Eight Maturity Model, by an assessor. The E5 configuration becomes evidence for that assessment.
On 15 June 2026 ASD opened consultation on evolving the Essential Eight into a broader Essentials series. The Essential Eight remains in force.
Questions
What security and IT leads ask before an E5 deployment starts.
Tell us which licences you hold and what is switched on. We start with the tenant baseline audit and scope the rest in writing before anyone changes a policy.