Microsoft 365 E5 Security add-on vs full E5

The naming trips up many comparisons. Microsoft's release notes state that the Microsoft Defender Suite was formerly known as Microsoft 365 E5 Security, and that for Business Premium the Defender Suite add-on replaces the earlier E5 Security add-on. Older quotes, partner price lists and blog posts still say E5 Security. When a vendor quotes both names side by side, ask whether they mean the same SKU. In the price table on our July 2026 price update, the SKU is listed as Defender Suite.

The suite is an add-on, not a plan. Microsoft's enterprise overview says that if you have Microsoft 365 E3, you can also get add-ons such as the Defender Suite and the Purview Suite. It sits on top of an E3 license and does not replace it. For Business Premium customers, Microsoft sells a separate Defender Suite for Business Premium that follows the same idea.

Microsoft's documentation for the Business Premium version lists the same five components, and the Microsoft 365 plan options page confirms that E5 contains the Defender Suite, naming Safe Documents among its items. The table compares each product with what E3 already gives you in 2026.

Sources: Microsoft Learn, Microsoft Defender service descriptions for Defender for Endpoint and Defender for Office 365; Microsoft 365 plan options; Defender Suite for Business Premium.

Two interactions matter in a licensing review. Defender for Cloud Apps' Conditional Access App Control needs Entra ID P1 as well, which E3 and the Defender Suite both carry, so there is no extra gap there. And Entra ID P2 inside the suite overlaps with any standalone P2 you already pay for. If a user has the suite, a separate P2 license for that user adds nothing. Our Entra ID P1 vs P2 guide shows how that overlap turns up in a license review.

Microsoft's plan options page states that Microsoft 365 E5 includes the Microsoft 365 Purview Suite, with automatic classification and retention, Customer Key, Advanced Message Encryption, Insider Risk Management, Communication Compliance, Information Barriers, Customer Lockbox, Privileged Access Management, Audit (Premium), Records Management and eDiscovery (Premium). It also includes the Defender Suite described above.

Whether these extras are worth the money depends on actual use, not on the SKU name. A Power BI Pro license is wasted on a user who never opens a report, and Teams Phone Standard is wasted on a team that uses a third-party phone platform. In our license reviews, the compliance features tend to be the real reason a company needs E5, because the security side can be bought separately for just over half of the step-up. The same logic runs in reverse: E5 with no Insider Risk policy configured and no Purview auditing in use is a Defender Suite bought at a premium.

Our E3 vs E5 guide covers the whole plan comparison, including how to tell which E5 users use E5 features at all.

The prices below come from the table on our July 2026 price update, which carries Microsoft's published USD list prices per user and month. Swiss customers buy against a separate CHF list and your agreement's rates apply, so use the proportions for planning and your quote for budgeting.

The step from E3 to E5 is USD 21. The Defender Suite is USD 12 of that, which is 57% of the step. The remaining USD 9 buys, in effect, the Purview capabilities, voice and Power BI Pro, which cost USD 12 as a standalone Purview Suite alone. The same USD 21 difference appears in the no-Teams variants (E3 at USD 30.45, E5 at USD 51.45), so removing Teams from the bundle does not change the break-even logic.

A standalone Entra ID P2 is USD 10 per user and month on the same list. Because the Defender Suite includes Entra ID P2, a user who holds both pays USD 10 for nothing. That overlap is small per user and large across a few hundred administrators and privileged accounts.

Three cases cover most estates.

1. Security only. The user needs the Defender products but no Purview Suite features, no Teams Phone Standard, no Power BI Pro. E3 plus the Defender Suite at USD 51 is USD 9 below E5. For 1'000 users that is USD 108'000 per year.
2. Compliance only. The user needs Insider Risk Management, eDiscovery (Premium) or Audit (Premium), but not the full Defender set. E3 plus the Purview Suite costs USD 51, again below E5.
3. Both. The user needs the full security stack and the compliance stack. E3 plus both suites costs USD 63. E5 at USD 60 is USD 3 cheaper and adds Teams Phone Standard, Audio Conferencing and Power BI Pro.

The decision therefore has less to do with price than with scope. Do not ask which is cheaper. Ask how many of your users need which side. A mixed estate can beat uniform E5: if 20% of users need compliance and the rest need security only, the average is USD 52.80 per user and month against USD 60, or about USD 86'400 per year per 1'000 users, with the assumption that every user keeps the Defender Suite.

Splitting has limits. Microsoft's benefit principle says that every user who benefits from a feature must be licensed for it. A Purview feature whose policies you assign to a defined group fits a group license. A tenant-wide capability does not: if auditing or retention policies touch everyone's mailbox, the whole population is in scope. Insider Risk Management policies, for example, are created in the Purview portal and assigned to users, which allows a defined group. Decide the scope of each feature first, then count the users in scope.

These are the patterns we see. They are guidance, not a rule: check your own usage data against them before you decide.

Before moving a user from E5 to E3 with the Defender Suite, confirm that the Purview features are really unused: policies configured, retention applied, eDiscovery cases opened. The check takes an afternoon in the Purview portal and prevents the awkward discovery that a policy depended on an E5 license. The same check, run in the other direction, shows E3 users who would benefit from a single compliance feature and may be better served by a group-scoped add-on than by full E5.