Microsoft 365 Add-On Licensing Guide: Every Add-On Explained

The M365 SKU Stack: What's Already Included

Before you can make rational add-on decisions, you need a clear picture of what each base SKU tier actually delivers. Microsoft has structured the M365 suite as a deliberate upsell staircase, where each tier bundles capabilities that used to require separate licences. In 2026 the full stack runs E1 → E3 → E5 → E7, with E7 being the newest and most comprehensive tier, released above E5 in late 2025.

E1 at approximately $10–12 per user per month covers the basics: Exchange Online, Teams, SharePoint, and OneDrive. It excludes desktop Office apps entirely, making it suitable only for task workers who rely on web-based tools. E3 at roughly $36 per user per month adds full desktop Office installations, Windows Enterprise rights, and basic compliance tooling including Information Protection and basic DLP. As of 2026, Defender for Office 365 Plan 1 has been bundled into E3 at no extra cost — a significant change that eliminates one of the most common add-on purchases for E3 customers.

E5 at approximately $57 per user per month layers in advanced security (Defender for Identity, Defender for Endpoint Plan 2, Defender for Cloud Apps), full compliance (Purview with eDiscovery and advanced audit), Entra ID P2 for identity protection and privileged identity management, and Phone System for Teams telephony. E5 remains a powerful tier but is no longer the top of the stack.

E7 at $99 per user per month is the new ceiling, released in Q4 2025. It bundles everything in E5 and adds Microsoft 365 Copilot, Entra Suite (which includes External ID and Verified ID in addition to the P2 capabilities), and Agent 365 for agentic AI workflows. Microsoft field teams are actively pushing E5 customers toward E7 at renewal, positioning the incremental cost as justified by the Copilot capability that would otherwise cost $30 per user per month as a standalone add-on.

The critical insight here is that the value of any add-on purchase must be evaluated against this staircase. If you are spending on multiple add-ons that are already bundled in the next SKU tier, the maths often favours an upgrade rather than continued piecemeal purchases — but only if the utilisation of bundled features will be genuine, not theoretical.

The E7 Build-vs-Buy Question

The most pressing add-on decision most large enterprises face in 2026 is whether to buy Microsoft 365 Copilot as a standalone add-on at $30 per user per month, or to use that spend as partial justification for upgrading eligible users to E7 at $99 per user per month. This is the "build-vs-buy" question that Microsoft's field teams are aggressively framing in favour of E7.

The calculation becomes genuinely compelling when a user is already on E5 and already deploying Copilot. The incremental E7 cost then covers Entra Suite (which alone carries a list price well above $12 per user per month when purchased separately) and Agent 365 agentic capabilities that most organisations have not yet evaluated. But many organisations have deployed Copilot to only a subset of their workforce — rolling out E7 universally would create overspend on users who will never meaningfully use AI features.

Our advisory benchmark across 40+ Microsoft renewal negotiations in 2025–2026 shows that the build-vs-buy decision should be segmented by persona. Senior knowledge workers and decision-makers who generate significant document, email, and meeting workload are strong E7 candidates. Field workers, manufacturing operators, and other task-oriented users are rarely good candidates even for Copilot, let alone the full E7 bundle. A mixed-SKU EA that deploys E7 for 20–30% of the workforce and E3 or E5 for the remainder typically outperforms a blanket E7 rollout on both cost and utilisation.

Security Add-Ons: The Defender Portfolio

Microsoft's security portfolio is built around the Defender brand, with separate products covering endpoints, identity, email, cloud applications, and operational technology. Understanding exactly what is bundled versus what requires a separate add-on purchase is complicated by the fact that the bundle has changed materially over the past 12 months.

The most important recent change is the bundling of Defender for Office 365 Plan 1 into E3 in 2026. Organisations that were paying for this as a standalone add-on for their E3 user base should immediately audit whether they are being double-charged. We find this billing error in approximately 30% of E3 customers who had standalone Defender for Office 365 P1 add-ons in place before the policy change.

Defender for Endpoint tells a different story. Plan 1 is effectively covered via Windows Enterprise in E3, but the critical Plan 2 capabilities — particularly EDR (endpoint detection and response), threat and vulnerability management, and deception technologies — require E5 or a standalone Defender for Endpoint P2 add-on. For security teams that need Plan 2 for only a subset of high-risk devices or users, a targeted add-on can be more economical than upgrading everyone to E5. The break-even point is typically around 60% of users needing Plan 2: above that threshold, the E5 upgrade economics become compelling.

Identity & Access Add-Ons: Entra ID

Entra ID (formerly Azure Active Directory) is the identity backbone of the M365 estate. The tiering here has always been clear in principle but confusing in practice because some capabilities are bundled into M365 SKUs while others require separate Entra add-ons.

Entra ID P2 is the most commonly purchased identity add-on, and the decision about whether to buy it standalone or upgrade to E5 (where it is bundled) is a frequently contested commercial question. At $9 per user per month as a standalone add-on, Entra ID P2 for a 5,000-user organisation costs $540,000 per year. Adding this to E3 ($36) results in a blended cost of $45 per user per month — which is converging on E5 territory at $57. If the organisation also needs Defender for Endpoint P2, the maths almost always favours E5. The PIM capability alone drives significant operational value by eliminating standing privileged access, which is a top audit finding in virtually every Microsoft environment we review.

Compliance Add-Ons: Microsoft Purview

Purview is Microsoft's unified compliance and data governance platform. The E3 vs E5 compliance capability gap is particularly pronounced here — what's available at E3 versus E5 represents a fundamental difference in what your legal, risk, and compliance teams can actually accomplish.

E3 includes basic Purview capabilities: Information Protection (sensitivity labels and basic encryption), basic DLP policies for Exchange, Teams, and SharePoint, and basic retention policies. E5 adds the full Purview suite: eDiscovery Premium (custodian management, advanced hold management, review sets), Audit Premium (extended log retention to 10 years, intelligent insights), Insider Risk Management, Communication Compliance, and Information Barriers.

For organisations with genuine eDiscovery requirements — particularly those in regulated industries (financial services, healthcare, legal) — the Purview eDiscovery Premium capability is a significant commercial item. Standalone Purview add-on packs exist but are priced in ways that quickly make E5 the more rational choice for users who need multiple compliance capabilities simultaneously. We typically find that any organisation needing more than two Purview capabilities beyond the E3 baseline is better served by E5 than by stacking add-ons.

AI & Productivity Add-Ons: The Copilot Family

The Copilot family has become the most discussed — and most commercially significant — add-on category in the Microsoft portfolio. Understanding the different products and their distinct pricing models is essential before committing to any AI add-on spend.

Microsoft 365 Copilot at $30 per user per month requires careful deployment planning before commitment. The licence is non-cancellable on NCE annual terms — you are locked in for 12 months. Early adopter data across our client base shows that genuine Copilot ROI is concentrated in users with high-volume, repetitive document, email, or meeting workloads. Copilot generates significant value for EA and procurement professionals writing complex RFPs, for legal teams summarising lengthy documents, and for executives with heavy meeting schedules. It generates little to no measurable value for users whose primary work happens outside Microsoft applications.

Copilot Studio operates on a fundamentally different pricing model — session-based consumption rather than per-user per-month. Each conversation or agent session consumes capacity, making it inherently variable cost. Organisations building internal chatbots or automated workflows using Copilot Studio should model expected session volumes carefully before committing to capacity blocks. Underestimating session volumes leads to throttling; overcommitting leads to wasted capacity that cannot be rolled over.

The E7 bundle changes the Copilot arithmetic materially for E5 customers. If your E5 users will genuinely use Copilot at scale, the incremental $12 to E7 buys not only Copilot but Entra Suite and Agent 365 — making E7 the rational choice. But treat Microsoft's field sales framing of this with appropriate scepticism: the key question is always utilisation, not entitlement.

Analytics Add-Ons: Power BI and Microsoft Fabric

Microsoft's analytics portfolio has undergone a significant commercial restructuring with the introduction of Microsoft Fabric. Understanding where Power BI sits within this new structure — and how capacity-based Fabric pricing differs from per-user Power BI — is now critical for procurement teams negotiating data and analytics spend.

Power BI Pro is the most widely deployed analytics add-on in the Microsoft estate, and it is also the most frequently over-licensed. The requirement for Pro licences is asymmetric: report creators and active consumers require Pro, but passive viewers consuming reports via Power BI Premium or Fabric capacity do not. Many organisations blanket-assign Pro licences without distinguishing between active report authors, frequent consumers, and occasional viewers who would be adequately served by capacity-based access.

Microsoft Fabric represents a fundamental shift in analytics licensing philosophy. Rather than per-user licences for individual analytics capabilities, Fabric uses F-SKU capacity units that can be shared across multiple workloads: Data Factory pipelines, Lakehouse storage and compute, Synapse Analytics, Real-Time Intelligence, and Power BI Premium capacity all draw from the same Fabric capacity pool. For organisations with substantial analytics workloads, F-SKU capacity pricing typically delivers better economics than stacking individual per-user licences, but the break-even analysis depends heavily on concurrent usage patterns and workload scheduling.

One important governance point: Fabric capacity operates like a shared cloud resource. If workloads are poorly governed and capacity limits are hit, reports and queries will be throttled or paused. Organisations migrating from Power BI Premium Per Capacity (P SKUs, which are being deprecated in favour of F SKUs) need to model their peak concurrent compute requirements carefully before choosing an F-SKU tier.

Telephony Add-Ons: Teams Phone

Microsoft Teams Phone (previously called Phone System) enables PSTN calling through Teams — replacing traditional PBX infrastructure or connecting to it via direct routing. The telephony add-on landscape is one of the most misunderstood areas of M365 commercial purchasing.

Phone System functionality is included at no additional cost in E5 and E7 licences. For E1 and E3 users, it requires the Teams Phone add-on at approximately $10 per user per month. This add-on enables the software PBX capabilities but does not provide calling plan minutes — those are a separate consumption purchase or require Direct Routing through your existing telephony provider.

Teams Phone Calling Plans are available as domestic-only or domestic plus international plans, with per-minute consumption beyond the included allowance or as outright per-minute consumption without a bundle. For organisations already paying for SIP trunks or PSTN capacity through an existing telecom provider, Operator Connect or Direct Routing integration avoids the Calling Plan cost entirely — you keep your existing telephony contract and simply route calls through Teams as the softphone layer. This hybrid model is the dominant approach we see in EMEA enterprise environments, where domestic Microsoft Calling Plan pricing is often uncompetitive versus local telecom rates.

Teams Rooms licences are entirely separate from user licences and are priced per room device. Teams Rooms Basic covers core meeting room functionality at no cost; Teams Rooms Pro at approximately $40 per room per month adds advanced management, AI-powered meeting intelligence, and speaker tracking capabilities. Organisations with large physical office footprints should include room licensing in the EA to capture volume discounts.

Developer Add-Ons: GitHub Copilot

GitHub Copilot sits technically in the GitHub ecosystem rather than the M365 stack, but is increasingly negotiated as part of Microsoft EA conversations. Understanding the tier structure is important for software engineering organisations making volume commitments.

GitHub Copilot Individual, at $10 per month, targets individual developers purchasing through GitHub.com. Enterprise procurement should not be buying at this tier — the Individual plan has no administrative controls, no policy management, no audit logs, and no IP indemnification.

GitHub Copilot Business at $19 per user per month adds organisation-level policy management, proxy support, and basic usage analytics. This is the appropriate entry point for most enterprise engineering teams. GitHub Copilot Enterprise at $39 per user per month adds personalisation from your organisation's codebase, GitHub.com integration, and Copilot in GitHub.com pull request workflows. For organisations with large internal codebases where institutional context significantly improves suggestion quality, the Enterprise tier premium is typically justified.

When negotiating GitHub Copilot as part of a Microsoft EA, the key leverage point is volume commitment combined with Azure consumption growth. Microsoft has discretion to bundle GitHub Copilot Business into EA renewals at discounted rates when Azure MACC commitments are growing, creating a genuine attachment incentive that benefits the buyer. We have negotiated GitHub Copilot Business inclusions at effective rates below $12 per user per month through EA consolidation deals in 2025.

The 4-Tier Decision Framework for Add-On Purchases

After evaluating hundreds of Microsoft licence configurations across different industries and organisation sizes, we apply a four-tier prioritisation framework to every add-on decision. The framework prevents the common failure mode of procurement teams purchasing every available add-on reactively as individual business units generate requests, without any coherent view of SKU upgrade economics or utilisation thresholds.

The framework operates as a filter, not just a priority list. Must-Have requirements should trigger a cost-optimisation analysis to ensure they are fulfilled in the most efficient way (often through a SKU upgrade rather than individual add-ons). Compliance-tier decisions should be cross-referenced against the E5 build-vs-buy threshold. Productivity-tier add-ons should require a documented adoption plan before commitment. Advanced-tier items should be piloted on monthly NCE terms — even at full list price — before any annual volume commitment is made.

True-Up Implications of Add-On Sprawl

Add-on licences are included in the EA True-Up process alongside base M365 licences. This creates a specific compliance and cost governance challenge that many ITAM teams underestimate when they first start accumulating add-ons reactively.

The True-Up happens annually on the anniversary of your EA start date. At that point, your total licence count — including all add-ons — is reconciled against the quantities in your order forms. If you have deployed add-ons beyond your licenced quantities, you will owe the underpayment for the full previous year at the rate in your price list — regardless of when in the year the deployment occurred. A 500-user Copilot deployment that went live 11 months into your EA year but was not on the order form means a True-Up bill for 500 × $30 × 11 months.

The inverse problem — overpaid add-ons that are not being used — is not automatically reconciled downward at True-Up. You must proactively identify over-licenced add-ons before the True-Up and either reduce quantities or negotiate a credit. Microsoft's standard position is that paid quantities cannot be reduced mid-term on traditional EA; any reduction applies at renewal. This is another area where proactive licence inventory management, ideally quarterly, prevents avoidable spend.

Add-on sprawl compounds the True-Up problem. When individual business units independently request and deploy add-ons — Teams Rooms Pro here, Copilot there, Power BI Pro everywhere — the cumulative True-Up exposure grows organically, and the central IT or procurement team often has no consolidated view until the True-Up reconciliation arrives. Establishing a pre-approval process for any add-on deployment, tied to a central licence inventory, is the single most effective governance control we recommend to ITAM teams managing complex M365 estates.

Negotiation Tactics for Add-On Purchases

Add-ons are not priced like base SKUs in Microsoft's commercial framework. They carry different discount floors, different volume break structures, and different incentive dynamics for Microsoft's field teams. Understanding this distinction is essential to negotiating effectively.

The most reliable lever for add-on pricing is volume commitment in combination with term length. Microsoft's standard EA discount for most add-ons ranges from 5–15% off list price, compared to 10–20% for base M365 SKUs. However, when add-on volume is significant — for example, deploying Copilot to 2,000 users or more — the quantities justify escalation to Microsoft's licensing desk and create genuine discount opportunity. In Q4 (April 1 to June 30), when Microsoft's field teams are maximally incentivised to close business before the June 30 fiscal year-end, add-on pricing can move materially if the commitment is structured correctly.

A tactic that consistently delivers results is bundling add-on volume commitments into the base EA renewal rather than purchasing them separately mid-term. When Copilot, GitHub Copilot Business, and Power BI Pro are all included in the initial EA negotiation as line items, Microsoft treats the aggregate deal size differently than if each add-on is purchased as a separate order. The combined volume creates a larger addressable discount, and Microsoft's sales incentives reward large single-transaction deal sizes more generously than repeated small add-on orders.

Be particularly careful with NCE add-on purchases. Monthly NCE add-ons carry no discount off list price — you are paying full MSRP for maximum flexibility. Annual NCE add-ons may carry up to 5% discount. Neither compares favourably with EA annual pricing, which typically achieves 10–20% off list for the same add-on. The choice between NCE and EA for add-on licensing should not be made on default — it should reflect a deliberate decision about how much flexibility you need versus how much discount you are willing to give up to preserve that flexibility.

Finally, always review the Software Assurance benefits associated with your add-on purchases. Many add-on subscriptions carry SA benefits that include step-up licences, training vouchers, and planning services. These are routinely unused but have real commercial value. Mapping your SA benefits to genuine organisational needs before the True-Up date creates legitimate leverage: unused SA benefits that could have been applied to add-on deployments represent value that was paid for but not realised, which is a reasonable basis for renegotiation at renewal.

Key Takeaways

Microsoft's add-on catalogue is one of the most commercially significant decisions in enterprise software procurement — both for the direct spend it represents and for the SKU upgrade economics it implies. The most important principles to carry away from this guide are these:

First, always evaluate add-on spend in the context of the full SKU staircase (E1 → E3 → E5 → E7). When multiple add-ons converge on a tier threshold, the upgrade typically delivers better economics, better governance, and better negotiating leverage than a collection of standalone purchases.

Second, E7 at $99 per user per month is the right tier for knowledge workers who will genuinely use Copilot at scale and who benefit from the full Entra Suite and Agent 365 capabilities. It is not the right tier for the majority of a typical enterprise workforce. Mixed-SKU deployments that segment by persona deliver consistently better outcomes than blanket E7 rollouts.

Third, Defender for Office 365 Plan 1 is now bundled in E3 as of 2026 — audit your billing to ensure you are not being charged for it twice. This single change eliminates a common and significant source of add-on overspend for E3 customers.

Fourth, NCE add-on purchases offer flexibility at the cost of discount. For volume add-on commitments, EA pricing consistently outperforms NCE. Use NCE monthly for pilots and for add-ons with genuine uncertainty about adoption trajectory.

Fifth, establish central governance over add-on procurement before add-on sprawl creates an unmanageable True-Up position. A pre-approval process tied to a quarterly licence inventory is the minimum viable governance control for any organisation managing more than five distinct add-on SKUs.

The Microsoft licensing relationship is a multi-year commercial partnership that rewards organisations who approach it with strategic discipline. Add-ons are where that discipline most often breaks down — and where the recovery opportunity is also most significant for organisations willing to invest in getting the governance right.