CIO Playbook: Selecting the Right Microsoft 365 Enterprise Plan

The 2026 M365 SKU Landscape: Four Tiers, Four Different Commercial Propositions

Microsoft 365 E7 launches May 1, 2026 at $99 per user per month — and Microsoft's field teams are actively pushing every E5 renewal toward it. The bundle saves 15% against buying E5, Copilot, Entra Suite, and Agent 365 separately. But it only makes financial sense for users who genuinely need all four components. The rest of your population belongs on a cheaper tier — and choosing wrong in either direction costs real money. What was once a relatively straightforward choice between E1, E3, and E5 is now a four-tier decision that incorporates AI, identity governance, advanced security, and compliance capabilities at each successive level. Understanding what each tier delivers — and crucially, what it does not — is the foundation of any rational M365 procurement strategy in 2026.

The four enterprise tiers are E1, E3, E5, and E7. Each tier is a superset of the one below it, adding capabilities rather than replacing them. The pricing ladder reflects this: E1 is the entry point for cloud-only access, E3 is the standard productivity and governance tier, E5 adds advanced security and compliance analytics, and E7 is the newly launched premium tier that bundles AI, identity management, and agentic capabilities above E5. Microsoft's field motion in 2026 is to accelerate the migration from E3 to E5, and from E5 to E7, at every renewal opportunity.

Pricing Reference: M365 Enterprise Tiers in 2026

List pricing for M365 enterprise tiers reflects both the July 2026 increases and the E7 introduction. M365 E1 is approximately $10 per user per month, covering web-only Office apps, Exchange Online, Teams, SharePoint, and OneDrive. M365 E3 moves to $39 per user per month from July 2026 (up from $36), adding full desktop Office applications, Windows Enterprise licensing, device management through Intune, and Microsoft Purview for information protection at the E3 compliance tier. M365 E5 moves to $60 per user per month from July 2026 (up from $57), adding Microsoft Defender for Endpoint, Defender for Office 365 Plan 2, Microsoft Sentinel SIEM, Power BI Pro, and Purview at the E5 compliance and eDiscovery level.

M365 E7, launching May 1, 2026 at $99 per user per month, bundles the full E5 stack plus Microsoft 365 Copilot (AI assistant across Office apps), the Microsoft Entra Suite (advanced identity, governance, and network access), and Agent 365 (the AI agent management and deployment control plane). Purchasing these components separately — E5 at $60, Copilot at $30, Entra Suite at $12, Agent 365 at $15 — would cost $117 per user per month. E7 therefore delivers approximately 15% savings against an unbundled equivalent stack, for users who genuinely require all four components.

E1: Who It Is Actually For

E1 at $10 per user per month is Microsoft's cloud entry point. It provides browser-based access to Office applications (no desktop installs), Exchange Online with a 50 GB mailbox, Teams, SharePoint Online, and OneDrive for Business with 1 TB storage. It does not include desktop Office applications, Windows Enterprise, device management, or any advanced security capability beyond standard anti-malware.

E1 is appropriate for a specific and often underserved user population: workers who operate exclusively from shared devices, thin clients, or browser-based environments and who do not require locally installed productivity software. This includes call centre agents working from managed kiosks, retail staff using shared terminals, and certain categories of contractor or contingent worker who need email and collaboration access without full endpoint provisioning.

For knowledge workers who use personal or company-owned endpoints as their primary device, E1 is insufficient — the absence of desktop applications creates friction and workarounds that cost more in productivity terms than the $26 per user per month delta versus E3. The error many organisations make is over-deploying E1 to populations that genuinely need E3, driven by an instinct to minimise per-unit licence cost without modelling total productivity impact. Conversely, deploying E3 to populations that would function equally well on E1 is a straightforward overspend that right-sizing resolves.

E3: The Workhorse Tier for Most Enterprise Populations

E3 at $39 per user per month (from July 2026) is the appropriate baseline for the majority of enterprise knowledge workers. It delivers the full desktop Office suite — Word, Excel, PowerPoint, Outlook, OneNote, Access (Windows), and Publisher (Windows) — installable on up to five PCs or Macs, five tablets, and five mobile devices per user. This covers the standard enterprise productivity requirement for any user who works primarily from assigned endpoints.

E3 includes Microsoft Intune for device management, Azure Active Directory P1 (now Microsoft Entra ID P1) for identity and conditional access, Microsoft Defender for Business (basic endpoint protection), and Microsoft Purview at the E3 information protection level, covering sensitivity labels and basic data loss prevention. For compliance-sensitive organisations, E3's Purview entitlement covers the most common data governance requirements without requiring the full E5 compliance uplift.

E3 also includes Windows Enterprise licensing under the Microsoft 365 framework — a significant value component for organisations that would otherwise purchase Windows Pro or Windows Enterprise per-device licences separately. This bundled Windows entitlement is often overlooked in E1/E3 cost comparisons, and when properly accounted for, it narrows the apparent price differential between E3 and a separate Windows licence plus Office 365 E3 combination.

E5: Advanced Security and Compliance for High-Risk User Populations

E5 at $60 per user per month (from July 2026) adds Microsoft's full advanced security stack above E3. The key additions are Microsoft Defender for Endpoint Plan 2 (EDR with threat hunting, automated investigation, and response), Microsoft Defender for Office 365 Plan 2 (advanced anti-phishing, safe links, safe attachments, and attack simulation), Microsoft Sentinel (cloud-native SIEM and SOAR), Microsoft Defender for Identity (Active Directory threat detection), and Microsoft Purview at the E5 compliance level (including Advanced eDiscovery, Insider Risk Management, Communication Compliance, and Customer Lockbox).

E5 is the appropriate tier for users in roles that carry elevated security and compliance risk: executives, finance personnel, legal and compliance staff, IT administrators, and M&A team members. These user populations are disproportionately targeted in phishing and social engineering campaigns, handle sensitive data that triggers compliance obligations, and represent the highest-consequence targets in the event of a breach. The incremental cost of E5 over E3 for this population — $21 per user per month — is justified by the material reduction in risk exposure.

E5 is not the appropriate default for every user in an enterprise, and it is not the highest M365 tier available in 2026 — that is now E7. Microsoft's field teams were previously positioning E5 as the premium tier and running an upsell motion from E3. That positioning has shifted: E7 is now the premium offering, and the E5-to-E7 upsell is the primary motion at renewal for customers already on E5.

E7: The New Premium Tier — What It Is and When It Genuinely Makes Sense

Microsoft 365 E7, branded as the "Frontier Suite," launches May 1, 2026 at $99 per user per month. It is the highest tier in the M365 enterprise SKU stack — above E5, completing the E1, E3, E5, E7 hierarchy. E7 bundles four components: M365 E5 (the full existing premium stack), Microsoft 365 Copilot ($30 standalone), the Microsoft Entra Suite ($12 standalone) covering Entra ID Governance, Entra Internet Access, Entra Private Access, and Entra ID Protection, and Agent 365 ($15 standalone), Microsoft's new control plane for deploying and managing AI agents across the enterprise.

Microsoft's field teams are actively running the E5-to-E7 upsell at every renewal conversation. The pitch is that E7 represents the future of work — AI-native productivity, zero-trust identity architecture, and agentic automation — at a 15% discount versus purchasing each component separately. This is technically accurate for users who need all four components. The commercial question is what fraction of your user population genuinely needs all four, and what the right deployment structure looks like for the majority who do not.

The E7 Economic Analysis

For an E5 customer evaluating E7, the incremental cost is $39 per user per month — the delta between E5 ($60) and E7 ($99). This $39 buys three components: Copilot ($30 standalone), the Entra Suite ($12 standalone), and Agent 365 ($15 standalone) — a $57 bundle at a $39 price, saving $18 per user per month versus standalone acquisition. For users who genuinely need all three incremental components, E7 is the economically rational choice.

The critical analysis: what percentage of your user population needs Copilot, the full Entra Suite, and Agent 365 simultaneously? In most enterprise environments, the answer is: a meaningful fraction of the total population, but not all of it. Executive teams, knowledge workers with high document and communication loads, IT and security administrators, and compliance personnel are strong E7 candidates. Task workers, frontline employees, and users in tightly defined roles with limited collaboration requirements are not. A blanket E7 rollout for a 10,000-seat organisation at $99 versus a tiered deployment — E7 for 2,000 power users, E5 for 5,000 knowledge workers, E3 for 3,000 task workers — delivers approximately $2.8 million in annual savings at list price.

The Tiered Deployment Framework: Matching SKU to User Role

The most consistent cost optimisation available in M365 licensing is tiered deployment: assigning each SKU tier to the user segment for which it delivers genuine value, rather than applying a single SKU across the entire population. Organisations that implement rigorous tiered deployment consistently reduce their per-user average M365 cost by 10–30% versus a homogeneous rollout, while maintaining appropriate capability levels for each user segment.

Tier 1: Frontline and Task Workers — E1 or F3

Workers who primarily use Teams, SharePoint, and email from shared or managed devices — retail associates, warehouse operatives, healthcare frontline staff, and manufacturing floor workers — are candidates for E1 or the Frontline Worker F3 licence at $8 per user per month. F3 includes Teams, Office for the web, SharePoint, and Exchange Online with a 2 GB mailbox at a lower price point than E1, specifically designed for shift workers and task-oriented roles. Neither E1 nor F3 is appropriate for users who need offline document editing, advanced security coverage, or compliance tooling.

Tier 2: Standard Knowledge Workers — E3

The majority of enterprise employees — office-based knowledge workers who use desktop Office applications daily, access corporate data across multiple devices, and require standard device management and data protection — are well-served by E3. This tier covers the full productivity requirement for most roles without the premium security and compliance overhead of E5. E3 is the appropriate default for roles where the primary risk is productivity, not security exposure or regulatory compliance.

Tier 3: High-Risk and Compliance Users — E5

Finance, legal, HR leadership, executives, IT administrators, and security personnel represent a minority of most enterprise populations but carry disproportionate security and compliance risk. E5 is the appropriate tier for these users. The Defender for Endpoint Plan 2, Sentinel SIEM integration, and Purview Advanced eDiscovery capabilities that E5 delivers for this population cannot be replicated at E3 pricing — and the cost of a breach or compliance failure for these user groups materially exceeds the $21 per user per month E3/E5 delta.

Tier 4: AI Power Users and Administrators — E7

Executives, senior knowledge workers with high collaboration and communication loads, Copilot early adopters, IT and security administrators managing AI agent deployments, and compliance officers who need the full Entra governance stack represent the E7 population. This is typically 15–25% of an enterprise's total seat count, not the entire organisation. For these users, E7 at $99 delivers genuine value across all four bundled components. For the broader population, it delivers premium pricing for capabilities they will not fully use.

NCE Pricing Structure: How Term Commitment Affects Plan Economics

Under Microsoft's New Commerce Experience (NCE), the term commitment you choose materially affects the effective price you pay for any M365 SKU. Monthly-term subscriptions are priced at list price — there is no discount available for monthly commitments. Annual commitments with monthly billing now carry a 5% surcharge above the annual upfront price (applied from April 2025). Annual commitments with annual upfront billing provide the best NCE pricing, up to approximately 5% below the equivalent monthly billing option. Three-year commitments provide the deepest NCE discounts, typically around 10% below equivalent annual pricing — at the cost of maximum rigidity on seat counts and SKU selection for the full term.

For a tiered M365 deployment across a large user population, the term structure decision interacts with the SKU selection decision. A 3-year commitment locks both the SKU mix and the seat count. If your organisation's E7 population grows during a 3-year term — as AI adoption scales and more users need Copilot — you can add seats mid-term, but you cannot reduce them. Conversely, if E7 adoption proves lower than projected and you have over-committed, you carry the excess cost for the full term. Building a realistic adoption model into your term decision is as important as the SKU selection itself.

The July 2026 Price Increase: Planning Your Response

Microsoft has confirmed a global price increase for Microsoft 365 and Office 365 commercial subscriptions effective July 1, 2026. E3 moves from $36 to $39 per user per month — an 8.3% increase. E5 moves from $57 to $60 per user per month — a 5.3% increase. For an organisation with 5,000 E3 seats and 500 E5 seats, this represents approximately $195,000 in additional annual cost from July 2026 at list price.

The mitigation strategy is clear: organisations with renewals due before July 2026 — or with the flexibility to renew early — can lock current pricing for a multi-year term before the increase takes effect. A 3-year NCE commitment signed in April or May 2026 preserves E3 pricing at $36 until approximately mid-2029, delivering approximately $540,000 in cumulative savings for that 5,000-seat E3 estate versus renewing after July 2026 at the higher price.

This is also a meaningful negotiation window. Microsoft's Q4 runs April through June — the period when field representatives have maximum incentive to close and broadest discount authority. Current EA discounts on M365 online services stand at 10–20% off list price, down from the historical 15–25% range — and those discounts are available to buyers who engage with preparation and competitive benchmarks. The combination of the pre-increase window and Q4 quota pressure creates a dual leverage dynamic that well-prepared buyers can exploit. Organisations that engage their renewal conversations in Q4 2026 with current pricing benchmarks, a competitive evaluation, and a consolidated portfolio position will consistently achieve better outcomes than those that simply respond to the renewal proposal from their account team.

How to Evaluate the E7 Upsell: A Decision Framework for CIOs

Microsoft's E7 upsell is arriving at every renewal conversation in Q2 2026. The following framework provides a structured approach to evaluating whether E7 is the right choice for your organisation — and for which users.

Step 1: Baseline Your Current SKU Distribution

Before any E7 conversation, confirm your current M365 licence distribution across user populations. How many users are on E1, E3, and E5? Are those assignments accurately reflecting current role requirements, or has the estate drifted from the original deployment intent? Many organisations find that their E5 population has expanded beyond the originally defined high-risk user group through individual provisioning decisions made over time. Right-sizing E5 before evaluating E7 eliminates the double cost of E5 overcommitment combined with E7 upsell.

Step 2: Identify Your Genuine E7 Candidate Population

Map your user population against the four E7 components. For each user, ask: do they need Copilot productivity AI? Do they need Entra Suite identity governance and network access? Do they need Agent 365 for AI agent management? For most users, the answer to at least one of these questions is no. The users for whom all three answers are yes represent your genuine E7 population. Size this group accurately before entering any E7 commercial conversation.

Step 3: Build the Per-User Economics

Compare the cost of E7 at $99 versus your current E5 stack plus targeted standalone additions for each user segment. For users who need E5 plus Copilot only, the cost is $90 standalone versus $99 for E7 — E7 is $9 more expensive if Entra Suite and Agent 365 are not required. For users who need E5 plus Copilot plus Entra Suite, the cost is $102 standalone versus $99 for E7 — E7 begins to deliver savings. For users who need all four components, E7 at $99 versus $117 standalone delivers $18 per user per month savings. Build this matrix for each user segment before accepting Microsoft's account team narrative that E7 is "always the right choice."

Step 4: Model the Transition Cost

Moving users from E5 to E7 is not purely a licensing change — it may require configuration work for Entra Suite deployment, training investment for Copilot adoption, and administrative overhead for Agent 365 governance. These transition costs are real and should be included in any total cost comparison. A per-user licensing saving that is partially consumed by deployment and training costs may not deliver the net benefit that headline pricing suggests.

Step 5: Negotiate the Outcome

Armed with your genuine E7 population size, your per-user economics, and your competitive benchmark data, engage Microsoft's account team with a specific counterproposal: E7 for the users where the bundle economics justify it, continued E5 for users who do not need all E7 components, and an EA or NCE structure that prices both tiers competitively. Our experience as Microsoft EA advisory specialists is that organisations presenting a detailed segmented deployment proposal consistently achieve better commercial terms than those accepting Microsoft's default upsell proposal.

Security Add-Ons vs E5 vs E7: Avoiding Duplication

Organisations that have been building their security stack incrementally — purchasing Microsoft Defender for Endpoint standalone, Entra ID P2, Sentinel, and compliance add-ons separately — may find that their current per-user spend on M365 base licences plus security add-ons exceeds the E5 or even E7 per-user price. This is a common and expensive outcome in organisations that manage IT and security purchasing in separate budget cycles with separate approval processes.

Before any E5 or E7 evaluation, conduct a full audit of your Microsoft security and compliance add-on spend. Include Microsoft Defender for Endpoint standalone licences, Entra ID P1 and P2 add-ons, Sentinel workspace costs, Purview compliance add-ons, and any standalone Power BI Pro licences. In many cases, consolidating these standalone add-ons into E5 or a targeted E7 deployment delivers net cost savings while simplifying the licence estate and closing capability gaps created by inconsistent add-on deployment.

Common Mistakes CIOs Make in M365 Plan Selection

The following mistakes recur consistently across enterprise M365 deployments and carry the highest long-term cost.

Blanket Single-SKU Deployment

Deploying a single SKU across all users — whether E3 for cost control or E5 for capability — is almost always suboptimal. Enterprises that deploy a single SKU overspend on users who need less and under-provision users who need more. Tiered deployment is operationally slightly more complex but consistently delivers 10–30% cost savings on a large estate.

Accepting the E7 Upsell Without Population Analysis

Microsoft's field teams are deploying the E7 upsell at scale in 2026. Accepting E7 for the full enterprise population without a user-by-user needs analysis and economic model is the single most expensive mistake available in M365 licensing today. For a 10,000-seat organisation, the cost of applying E7 where E3 would suffice exceeds $7 million annually.

Ignoring the July 2026 Renewal Window

The window to lock current M365 pricing before the July 2026 increase closes at the end of June. Organisations that miss this window and renew after July 2026 pay 5–8% more on their existing SKUs. With Q4 discount pressure also active through June, the combination of pre-increase pricing and Q4 negotiation leverage makes the April–June window the highest-value renewal period available to M365 buyers in 2026.

Managing M365 and Security in Separate Budget Silos

Add-on security spending managed separately from M365 base licences consistently creates overlap and sub-optimal total cost. Integrating M365 and Microsoft Security licensing into a single commercial view is a prerequisite for identifying consolidation opportunities and presenting a unified portfolio position in your negotiation.

What to Do in the Next 60 Days

With E7 launching May 1, the July price increase 90 days away, and Microsoft's Q4 open, CIOs with M365 renewal activity in the next six months should take the following actions immediately. First, audit your current M365 licence distribution against active user roles. Confirm that E3, E5, and any other tier assignments match the user population's genuine requirements. Right-size the estate before any renewal conversation begins. Second, model the E7 economics for your specific user population. Identify your genuine E7 candidates, run the per-user cost comparison against current E5 plus standalone additions, and establish your quantified position before Microsoft presents theirs. Third, confirm your renewal date and term structure. If your renewal falls before July 2026, initiate the commercial conversation now to lock current pricing before the increase. If your renewal falls after July, evaluate whether an early renewal with a multi-year term is financially justified. Fourth, engage your Microsoft licensing advisory team or an independent specialist to benchmark your target pricing against current market rates. The combination of SKU segmentation, pre-increase timing, and Q4 leverage is the most powerful commercial position available to M365 buyers today — but extracting it requires preparation and benchmarked data, not a reactive conversation with your account team.

What a Correctly Tiered M365 Deployment Looks Like in Practice

In one engagement, a professional services firm with 4,600 users had their entire workforce on M365 E5. The original rationale was security uniformity — but an audit revealed that 2,900 of those users were in roles with no exposure to the regulated data or insider threat scenarios that E5 security is designed for. Redress modelled a tiered deployment: 1,700 users in high-risk, compliance-intensive roles retained on E5; 2,900 users migrated to E3 with targeted Defender for Endpoint P1 add-ons where needed. Annual saving versus the all-E5 position: £1.12M. The engagement fee was under 4% of first-year savings.

The Cost of Getting SKU Selection Wrong — and the Savings When You Get It Right

Selecting the right Microsoft 365 enterprise plan in 2026 is not a one-time decision — it is an ongoing governance discipline. The SKU stack now spans E1, E3, E5, and E7, with materially different price points and capabilities at each level. E7's launch and the July price increase create a specific commercial window in Q2 2026 that well-prepared CIOs can exploit. The organisations that perform best are not those with the most sophisticated plans — they are those with the most accurate segmentation. Match the right SKU to the right user, lock current pricing before July, and negotiate with data. The savings are real, the window is open, and the moment to act is now.