Tools
Microsoft 365 E3 with add-ons, or E5: the security maths
The jump to E5 is large and the add-on route looks cheaper. Where that stops being true, and the trap of buying three add-ons.
Microsoft
Why this decision is hard on purpose
E5 bundles security, compliance, voice and analytics. Most organisations want the security half and resent paying for the rest, which is exactly why the add-on route exists. The E5 Security add-on sits on top of E3 and carries most of what a security team wants.
The maths is straightforward until you need a second add-on. At that point the bundle frequently wins, and the organisations that get this wrong are the ones who bought incrementally over two years without ever recalculating.
How to work it out honestly
List what you actually need, not what sounds good
Defender for Endpoint P2, Defender for Office P2, Defender for Identity, Defender for Cloud Apps, Entra ID P2. Which of those will genuinely be configured and watched within a year?
Price E3 plus only those
The E5 Security add-on covers most of that set. If one add-on covers your list, the add-on route usually wins on price.
Add the compliance requirement separately
If you also need advanced eDiscovery, insider risk or communication compliance, that is a second add-on and the arithmetic shifts toward the bundle.
Recalculate at renewal, not at purchase
Needs grow. The organisation that bought E3 plus two add-ons three years ago is frequently paying more than E5 today and has never rechecked.
Where the value sits in the security tier
Our weighting of what the extra spend buys, published as an opinion.
- Entra ID P2 governance35
- Defender for Endpoint P225
- Defender for Office P222
- Defender for Cloud Apps18
An argument about relative value, not measured data.
The verdict
E3 plus the E5 Security add-on, for most security-driven purchases
It covers the security stack without paying for voice and analytics you will not use, and it is a single line item rather than three.
Full E5
Wins once you need compliance features as well, or when Teams Phone is on the roadmap anyway.
Do not buy either until someone owns configuring it. The most expensive licensing mistake in this category is a fully licensed tenant with an unconfigured security stack.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.